> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/admin.md). # Administration Guide Configure and operate a running OpenIAM deployment — identities, access, connected applications, lifecycle, requests, governance, authentication, federation and day-to-day operations. ## What this is, and when you need it OpenIAM is an identity and access management platform. It keeps one record per person, attaches entitlements to that record through container objects — roles, groups, organizations and resources — and then makes the outside world match by provisioning accounts to managed systems through connectors. Authentication decides who someone is; access decides what their record entitles them to; lifecycle delivers it; governance proves it was right. This guide is for the administrator or IAM engineer who configures and operates that platform once it is installed and healthy: someone who works in the Webconsole and SelfService, reads logs and audit records, writes the Groovy the product expects at its extension points, and edits property values. Almost everything you configure is one of four things — a property, a policy, a metadata type, or a Groovy script attached to an extension point — and most pages here are telling you which of the four you are editing. ## Choose your outcome | I want to… | Go to | | -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- | | Sign in for the first time and find out what my account may administer | [Start administering OpenIAM](/administration-guide/start.md) | | Create, find, entitle, delegate or bulk-change users | [Manage identities](/administration-guide/identities.md) | | Register, govern and approve non-human identities — service accounts, keys, bots, cloud workloads and AI agents | [Manage non-human identities](/administration-guide/nhi.md) | | Model roles, groups, organizations, resources and entitlements | [Model and grant access](/administration-guide/access.md) | | Connect an application, import identities, provision accounts or reconcile drift | [Connect applications and automate lifecycle](/administration-guide/lifecycle.md) | | Write a Groovy script, or put work on a schedule | [Customize and automate](/administration-guide/automation.md) | | Make access requestable, and decide who approves it | [Configure requests and approvals](/administration-guide/requests.md) | | Open, update and close Jira or ServiceNow tickets when requests, users, provisioning or non-human identities change | [Ticket integration](/administration-guide/ticketing.md) | | Run certification campaigns — user access reviews, recertification, attestation — or segregation of duties | [Govern access](/administration-guide/governance.md) | | Score access for risk — tune the factors and policies, narrow a campaign by risk, read the reviewer badges | [Risk management](/administration-guide/risk.md) | | Give reviewers the context behind each line — who the person is, what the entitlement grants, what revoking it would do — and read an item's audit trail | [Caddie — Access Review Assistant](/administration-guide/caddie.md) | | Build a report from the Data Catalog, run it to CSV or Excel, schedule it and e-mail the file | [Report builder](/administration-guide/reports.md) | | Configure authentication, MFA, password policy or recovery | [Secure sign-in and credentials](/administration-guide/security.md) | | Let people sign in with no password at all — passwordless, phishing-resistant sign-in | [Passwordless sign-in](/administration-guide/security/authentication-model.md#passwordless-sign-in) | | Set up SAML, OAuth 2.0 or OpenID Connect with a SaaS application or another organization | [Configure federation and application SSO](/administration-guide/federation.md) | | Put an application that speaks no federation protocol behind OpenIAM sign-in | [Administer the Access Gateway](/administration-guide/gateway.md) | | Get single sign-on into an application that has only a login form — form fill, credential injection, password vaulting | [Form fill](/administration-guide/gateway/inject-identity.md#form-fill) | | Configure mail, SMS, system settings, localization or configuration promotion | [Configure platform services](/administration-guide/platform.md) | | Capture and evidence a user's agreement to a policy — consent, privacy notice acceptance, consent withdrawal | [Consent and policy acceptance](/administration-guide/consent.md) | | Investigate a failure, find audit evidence, or run a maintenance operation | [Monitor and maintain OpenIAM](/administration-guide/operations.md) | | Ask a question in my own words | [Frequently asked questions](/administration-guide/faq.md) | | Look up an exact error message, log line or UI message | [Error and symptom index](/administration-guide/error-and-symptom-index.md) | | Look up a property key, an enumerated value or a shipped object | [Reference](/administration-guide/reference.md) | | Stop a leaver's access: terminate them, deprovision their accounts, revoke what they hold and end their sessions | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md) | ## Or start from a symptom The table above is written for somebody configuring something. If what you have is a symptom, start here instead. | What is happening | Go to | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | A user cannot sign in, and all I have is their name | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md) | | Somebody has left and their access has to stop, everywhere | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md) | | One person's live sessions have to stop working now | [Terminate a user's sessions](/administration-guide/security/session-management.md) | | I have the exact error message, log line or screen text | [Error and symptom index](/administration-guide/error-and-symptom-index.md) | | I saved a change and it had no effect | [Where settings live](/administration-guide/start/where-settings-live.md) | | An operation reported success and nothing happened | [Diagnose a failed operation](/administration-guide/operations/diagnose-a-failed-operation.md) | | Search cannot find a user who is definitely there | [Rebuild a search index](/administration-guide/operations/rebuild-a-search-index.md) | | Membership is right and the user's effective access disagrees | [Rebuild the authorization graph](/administration-guide/operations/rebuild-the-authorization-graph.md) | | Every scheduled task stopped at the same moment | [Restart batch tasks that have all stopped](/administration-guide/automation/batch-tasks/diagnose-stalled-batch-tasks.md) | | A value I mapped never reaches the managed system | [Build a policy map](/administration-guide/lifecycle/policy-map.md) | | A request through the Access Gateway fails, loops or returns 404 | [Troubleshoot the Access Gateway](/administration-guide/gateway/troubleshoot-the-gateway.md) | | A certification campaign is stuck and nobody can act on it | [Diagnose a stalled campaign](/administration-guide/governance/certification/diagnose-a-stalled-campaign.md) | | Audit and log timestamps are out by a whole number of hours | [Timestamps off by a fixed offset](/administration-guide/operations/timestamps-off-by-a-fixed-offset.md) | ## Start here If you are new to OpenIAM, read these four, in this order, before you change anything. 1. [Sign in and confirm your context](/administration-guide/start/first-login.md) — what your own account is actually allowed to administer, and which product and schema version you are on. 2. [The OpenIAM object model](/administration-guide/start/object-model.md) — the object names every other page in this guide uses. 3. [Where settings live](/administration-guide/start/where-settings-live.md) — why a setting can be saved and still have no effect. This one page prevents most of the confusion new administrators run into. 4. [Change configuration safely](/administration-guide/start/change-safely.md) — the guide's single change, test and rollback standard, which task pages link to rather than restate. ## Which release this describes This guide describes **OpenIAM 2026.8.1**. Every page carries the release it was written and checked against, and the date a human last confirmed it, on its last line: > *Applies to OpenIAM 2026.8.1. Last reviewed 3 September 2026.* Read that line before you act on a page whose values matter. If the release named there is behind the one you are running, the page is not necessarily wrong — it means nobody has re-confirmed it against your release, so treat its shipped defaults as claims to verify rather than facts to rely on. Where a specific behaviour changed in a known release, the page says so at the point it matters — "ships disabled since 4.2.1.5", "renamed in 4.2.1.1", "deprecated as of 4.2.2" — and that inline statement is more precise than the page's own stamp. ## Which guide owns the task This guide owns Webconsole configuration and operation. Where a task belongs elsewhere, a page names the other guide as a prerequisite rather than duplicating it. | The task | The guide that owns it | | ----------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Install, upgrade or tune the platform, restart a service, change a container image or an orchestrator manifest | [Installation Guide](/installation/installation.md) | | Install and register a connector, grant it permissions on the target, look up connector-specific fields and limits | **Connector Configuration Guide** | | Complete the reviewer's or the employee's own click path | **SelfService Guide** | | Author extension code against the Java APIs, build a compiled extension, or integrate through REST | **Developer Guide** | | Select an installed connector, configure the managed system and policy map, run synchronization and provisioning, verify the target | This guide — [Connect applications and automate lifecycle](/administration-guide/lifecycle.md) | ## How to tell a procedure worked A `Save` message proves the configuration was accepted. It does not prove the outcome. An OpenIAM operation crosses a browser, a UI service, the ESB, a message broker, a connector and an external managed system, and each layer keeps its own record. Consequential procedures in this guide therefore name the evidence that proves the real result — the value read back, the audit action constant, the workflow or reconciliation history, the connector reply, or the account in the managed system — and where a result is asynchronous they name the terminal state to wait for rather than telling you to retry. *Applies to OpenIAM 2026.8.1. Last reviewed 3 September 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/admin.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.