API & Access Management

Discovery, specification export and provisioning of IFS Cloud RESTful OData APIs for integration use. The API Explorer lets developers browse projections and OData services as OpenAPI v2/v3 and OData specifications, each describing endpoints, operation parameters, authentication methods, API Usage Policy and API Class. Projections used by IFS Cloud Web are reused as OData REST APIs supporting standard HTTP methods (GET, POST, PUT, PATCH, DELETE).

Registration and lifecycle management of IAM clients in IFS Identity and Access Manager, the built-in OAuth2 authorization server of IFS Cloud that issues access tokens for backend APIs. Custom IAM clients are registered under Solution Manager > Users and Permissions > Identity and Access Manager > IAM Clients, configured as public or confidential clients, and mapped to appropriate OAuth2 flows for end-user or headless service integrations.

Administration of IFS Cloud end users and role-based access via permission sets. Covers registering users in the IFS Cloud user registry, building functional-role and end-user-role permission sets that grant access to projections, reports, lobbies, workflows, database tasks and task chains, and maintaining least-privilege and segregation-of-duties controls.

Configuration of single sign-on for IFS Cloud by brokering authentication from IFS IAM (the built-in, Keycloak-based Identity and Access Manager) to an external OpenID Connect identity provider such as Microsoft Entra ID. IFS IAM remains the token issuer for both UI and API access while login is delegated to the corporate IdP.

Automated provisioning and synchronization of IFS Cloud users from an external identity manager (e.g. Microsoft Entra ID or Okta) using IFS SCIM. Covers SCIM endpoint configuration, mandatory attribute mapping, sync-method selection and the joiner/mover/leaver lifecycle into the IFS Cloud user registry.