SaaS Admins: Roles and permissions

SaaS Admin

In Airlock SaaS, a SaaS Admin is responsible for managing and operating the Airlock SaaS service. A SaaS Admin with the role SaaS Administrator has full access to the organization, including all its tenants and its administrators. This role also allows managing generic secrets and key pairs used in the IAM configurations. Additionally, a SaaS Admin with the role role SaaS Administrator can view and manage OAuth 2.0 clients used for system to system communication via Airlock APIs.

The first SaaS Administrator of an organization, automatically receives the SaaS Administrator role. This is the person who creates the Airlock as a Service account through the self-registration process. After completing the self-registration successfully, they can access the Airlock Console (see also Setup Airlock).

The first SaaS Administrator can set up the SaaS organization that represents the customer and create the required tenants. They can also invite additional administrators and assign them to tenants.

Invited administrators can by default only perform tasks on end-users, such as search for and manage end-users, view end-user logs, -profiles and authentication tokens. It is possible to assign additional roles to the invited administrator, such as the SaaS Administrator role or individual roles, depending on their task. For a detailed overview or roles, permissions, and related actors, see .

End-user

End-users are the persons that access your company's applications. They do this via the tenant Loginapp, according to the authentication and authorizations flows defined in the corresponding active tenant IAM configuration.

Airlock Partner

The Airlock Partner actor is responsible for creating/altering a tenant IAM configuration according to the requirements of your company, and uploading these new/altered IAM configurations into the Airlock Console. Currently, only employees of Airlock or Airlock partners can hold this role.

Role

Associated permissions

Granted by default to

First administrator

Invited administrator

Airlock SEC¹⁾

• Perform Getting started

• Upload IAM configuration

• Activate IAM configuration

• Read vault entries (key only, value is hidden by design)

Airlock SEC actors have access to all tenants within their organization.

ⁿᐟᵃ

ⁿᐟᵃ

AMC - Manage administrators¹⁾

• Invite administrator

• Manage administrator

• Assign and remove roles to and from an administrator

­✓ ²⁾

AMC - Activate configuration

Activate configuration

­✓ ²⁾

AMC - Manage vault

• Create vault entry

• Update vault entry

• Delete vault entry

­✓ ²⁾

AMC - Manage organization

• Edit organization

• Delete organization

­✓ ²⁾

AMC - Manage tenants

• Create a tenant

• Edit a tenant

• Delete a tenant

✓ ²⁾

AMC - Manage TLS configuration

• Read TLS configuration

• Edit TLS configuration

✓ ²⁾

AMC - Manage users

• Manage users

  • Search users (Tenant IAM Adminapp)

✓ ²⁾

­✓

AMC - View vault

Read vault entries (key only, value is hidden by design)

✓ ²⁾

SaaS Administrator¹⁾

Within the AMC:

• Perform Getting started

• Activate configuration

• Invite administrator

• Manage administrator

• Activate configuration

• Edit organization

• Delete organization

• Create a tenant

• Edit a tenant

• Delete a tenant

• Read TLS configuration

• Edit TLS configuration

• Read vault entries

• Create vault entry

• Update vault entry

• Delete vault entry

• Read OAuth 2.0 clients

• Create OAuth 2.0 clients

• Edit OAuth 2.0 clients

• Delete OAth 2.0 clients³⁾

• Manage users

  • Search users (Tenant IAM Adminapp)

The SaaS Administrator has access to all tenants within his organization.

­✓

ⁿᐟᵃ
¹⁾
²⁾
³⁾

not applicable
This role gives significant power to the holder, for the reasons mentioned in the table. Therefore, exercise caution when assigning the role.
Implicitly through the SaaS Administrator role
Currently not possible. Contact SaaS Support if you need to delete an OAuth 2.0 client.