DOCSEARCHbyAlgolia
Submit Docs

TOPIAM Documentation

website·Indexed 32 days ago

https://topiam.cn

Identity and Access Management (IAM) platform providing OIDC protocol support, OpenAPI for user and organization management, and integration guides for applications like GitLab, Wiki.js, MeterSphere, and NocoBase. It supports multiple identity sources and authentication providers including DingTalk, Feishu, QQ, and WeCom.

Tokens
42.2K
Snippets
103
Records
336
Agent score
62%

What's inside TOPIAM

  1. Introduction to TOPIAM Open API

    TOPIAM provides a REST-style API for developers to programmatically perform user and organization management operations. Most available API endpoints require a valid access_token for authentication before they can be called.

  2. Overview of TOPIAM Identity and Access Management

    TOPIAM is an open-source Identity and Access Management (IAM) system designed for government, corporate, and educational environments. It enables centralized management of digital identities, allowing users to achieve 'one account, one authentication, multiple access points' (Single Sign-On). The system focuses on breaking down identity data silos, enhancing security frameworks, and improving organizational management efficiency.

  3. Understand TOPIAM OIDC roles and supported modes

    TOPIAM implements OpenID Connect (OIDC), an identity layer on top of OAuth 2.0.

    Key Roles:

    • Relying Party (RP): The application (Web, Mobile, etc.) requesting authentication.
    • OpenID Provider (OP): The authentication server that verifies the user and issues tokens.
    • End-User (EU): The final user being authenticated.

    Supported Authentication Modes in TOPIAM:

    • Authorization Code Flow: Supported ✅
    • Authorization Code Flow with PKCE: Supported ✅
    • Implicit Flow: Supported ✅
    • Password Flow: Supported ✅
    • Device Flow: Not Supported ❌
    • Client Credentials Flow: Not Supported ❌

  4. Configure the QQ authentication source in TOPIAM

    Add the QQ authentication source to the TOPIAM platform using the credentials obtained from the QQ Connect platform. The following parameters are required:

    • Authentication Provider: Information about the identity provider.
    • Authentication Source Name: A custom name for the authentication source.
    • AppId: The AppId obtained from the QQ developer application.
    • AppSecret: The AppSecret obtained from the QQ developer application.
    • Display (是否显示): Determines whether this authentication source appears on the TOPIAM enterprise digital identity control platform login page.
    • Remarks: Optional notes regarding the authentication source.

  5. Understand TOPIAM application types

    TOPIAM categorizes applications into two types for integration:

    1. Standard Protocol Applications: Applications that follow universal standards such as OIDC, SAML, JWT, and CAS. These can be configured using standard templates to achieve SSO.
    2. Customized Applications: Applications that provide specific interfaces for SSO or user synchronization. TOPIAM provides specialized customized templates to facilitate the integration for these specific services.

  6. Implement fine-grained behavior auditing for system security

    The system provides fine-grained behavior auditing to record and monitor detailed actions of both administrators and regular users. This includes tracking operations, access, and modifications, along with metadata such as timestamps, location, and terminal information. This capability is used to detect security threats in real-time, meet compliance requirements (such as GDPR and HIPAA), investigate data breaches through traceability, and optimize access control policies based on user behavior analysis.

  7. Understand OAuth2 AccessToken format

    The system uses 'reference tokens' instead of JWT (JSON Web Tokens) for AccessTokens. This design is implemented for security reasons, allowing the system to maintain full control over the token's lifecycle in external environments.

  8. Secure TopIAM access with Multi-Factor Authentication (MFA) and Auditing

    TopIAM enhances security through two primary mechanisms:

    1. Multi-Factor Authentication (MFA): Supports various secondary verification methods based on specific security scenarios.
    2. Security Auditing: Maintains detailed logs of all user behaviors to track operations, monitor information security status, and identify abnormal access or potential threats.

  9. Handle TOPIAM Authentication Tokens

    TOPIAM uses three primary token types for session and identity management:

    • access_token: An authorization token used to call IdP-provided APIs.
    • id_token: An identity token that can be parsed to retrieve information about the currently logged-in account.
    • refresh_token: A token used to obtain a new access_token after the original one has expired.

  10. Implement Single Sign-On (SSO) and Unified Authentication

    TopIAM enables users to access all corporate applications using a single set of credentials. This unifies the internal identity authentication mechanism and improves the integration and management of enterprise applications.

  11. Configure Geo-IP location providers in TOPIAM

    TOPIAM allows administrators to configure Geo-IP providers to identify the geographical location of visitors based on their IP addresses. This enables the creation of access policies to improve security, such as blocking potential malicious traffic from specific countries or regions.

  12. Implement Single Sign-On using Form Filling for legacy applications

    Form Filling (表单代填) is an SSO integration method where TOPIAM simulates a login page form submission in the browser to perform authentication. This approach is recommended for application systems that do not support standard SSO protocols and cannot undergo code modifications for authentication. To function, TOPIAM must maintain a mapping table that links a TOPIAM user account to the specific usernames and passwords required by each target backend application system.