Identity store and data model

The identity and access (IDAAS) core includes an identity store for storing all information related to the user. The identity store doesn't include credential information, which is instead stored in the credential store.

The identity store's data model is based on the SCIM specification and supports multiple SCIM schemas. To provide maximum flexibility and support any attributes that you need, you can create additional schemas. You can manipulate the identity records through the SCIM API with fine-grained authorizations.

Schemas

The OneWelcome Identity Platform (OIP) provides a flexible data model that supports three schema types:

• SCIM core schema: All attributes in the core schema come from the SCIM specification, which is an industry-standard specification for managing identities. It includes attributes such as first name, last name, email address, username, and so on.

• OneWelcome Identity Platform schema extension: This schema extension consists of the OneWelcome Identity Platform proprietary attributes, such as state, tenant, and so on. These attributes are essential for the core to work with the identity apps in the platform, such as consent, mobile identity, and user delegated manager. You cannot edit the OneWelcome Identity Platform schema.

• Tenant schema extension: You can bring your data model, including the attribute names, data validations, and other data types that your organization uses in the ecosystem. The identity store supports automated value assignment, configuration portability, and validation portability. If you have attributes with specific validations, you can include the validations with those attributes.

Schema examples

The example shows excerpts from both the OneWelcome schema extension and the tenant schema extension. The OneWelcome schema example includes the Google identifier, and the tenant schema example includes a car insurance policy number.

Assign values automatically

The automated value assignment enables you to define rules where a specific attribute is automatically assigned a value based on different triggers. For example, when you create or update a user, you can also define the condition.

In the following example, when you create a user, and the value for username is empty, the username is automatically populated based on a specific expression.

Metadata

In addition to the attributes, the identity store includes metadata based on NIST 8112. The metadata provides the necessary context for understanding the value of the actual attribute. For example, the metadata stores when the attribute was created and last updated, but also stores what processing purpose the user consented to, where the data came from, and what the trust level is.