|
| 1 | +--- |
| 2 | +id: index |
| 3 | +title: Understand your current IAM system |
| 4 | +sidebar_label: Understand your current IAM system |
| 5 | +sidebar_position: 1 |
| 6 | +--- |
| 7 | + |
| 8 | +# Understand your current IAM system |
| 9 | + |
| 10 | +Before you can migrate smoothly, you need a complete picture of how your identity management system works today. This step ensures |
| 11 | +nothing gets missed—from everyday login flows to rare edge cases—and sets the foundation for mapping existing functionality to Ory |
| 12 | +Network's equivalent capabilities. |
| 13 | + |
| 14 | +:::info Why it matters |
| 15 | + |
| 16 | +Mapping your full login lifecycle is the best way to de-risk migration. Your current IAM system may be abstracting away key |
| 17 | +functionality without you realizing it. With Ory Network, you gain full control to shape and optimize every flow to your needs. |
| 18 | +::: |
| 19 | + |
| 20 | +## Identify your IAM scenario |
| 21 | + |
| 22 | +Below are example IAM scenarios supported by Ory Network. Use them to identify which scenario best fits your specific IAM needs |
| 23 | +and understand the unique requirements of each approach. Each scenario differs in complexity and implementation needs. Use these |
| 24 | +IAM scenarios to map the identity flows for your application. |
| 25 | + |
| 26 | +<Tabs |
| 27 | + defaultValue="CIAM" |
| 28 | + values={[ |
| 29 | + {label: 'CIAM', value: 'CIAM'}, |
| 30 | + {label: 'B2B', value: 'B2B'}, |
| 31 | + {label: 'Workforce', value: 'Workforce'}, |
| 32 | + {label: 'Agentic AI', value: 'Agentic AI'}, |
| 33 | + ]}> |
| 34 | + |
| 35 | +<TabItem value="CIAM"> |
| 36 | + |
| 37 | +### CIAM (Customer Identity and Access Management) |
| 38 | + |
| 39 | +Your company sells products or services directly to individual consumers. |
| 40 | + |
| 41 | +#### Key IAM requirements |
| 42 | + |
| 43 | +- Self-service registration, login, and profile management for end users |
| 44 | +- Social login, multi-factor passwordless options, and robust account recovery |
| 45 | +- Privacy compliance (GDPR, CCPA) |
| 46 | +- High-scale performance for millions of users |
| 47 | + |
| 48 | +</TabItem> |
| 49 | + |
| 50 | +<TabItem value="B2B"> |
| 51 | + |
| 52 | +### B2B (Business-to-Business) |
| 53 | + |
| 54 | +Your company sells products or services directly to other businesses rather than individual consumers. Your customers are |
| 55 | +organizations that use these products or services to run their own operations. |
| 56 | + |
| 57 | +#### Key IAM requirements |
| 58 | + |
| 59 | +- Multi-organization user management |
| 60 | +- SSO with SAML/OIDC providers |
| 61 | +- Self-service partner onboarding |
| 62 | +- Role-based permissions and API controls |
| 63 | +- Privacy compliance (GDPR, CCPA) |
| 64 | +- High-scale performance for millions of users |
| 65 | + |
| 66 | +</TabItem> |
| 67 | + |
| 68 | +<TabItem value="Workforce"> |
| 69 | + |
| 70 | +### Workforce (Business-to-Enterprise) |
| 71 | + |
| 72 | +Your company provides products or services. Your company wants to manage access for a single organization's extended workforce. |
| 73 | +You want to consolidate employee user accounts and identities across multi-tenant brands, applications and systems. You need to |
| 74 | +seamlessly connect with existing enterprise identity providers and other 3rd party systems, and streamline user onboarding, |
| 75 | +offboarding, and permission management. |
| 76 | + |
| 77 | +#### Key IAM requirements |
| 78 | + |
| 79 | +- Streamline onboarding/offboarding of employee, contractor, and temporary workers |
| 80 | +- Role-based access aligned with organizational hierarchy |
| 81 | +- HR system integration with flexible identity schemas |
| 82 | +- Integrate with enterprise identity providers and third-party systems |
| 83 | +- Time-bound permissions and role assignments |
| 84 | +- Zero-trust security, MFA, and SSO for enterprise applications |
| 85 | +- Privacy compliance (GDPR, CCPA) |
| 86 | +- High-scale performance for millions of users |
| 87 | + |
| 88 | +</TabItem> |
| 89 | + |
| 90 | +<TabItem value="Agentic AI"> |
| 91 | + |
| 92 | +### Agentic AI |
| 93 | + |
| 94 | +Your company wants to enable AI applications to securely connect to data sources and tools. For example, servers that host |
| 95 | +resources and clients (AI applications) that discover and use those resources. |
| 96 | + |
| 97 | +#### Key IAM requirements |
| 98 | + |
| 99 | +- Standardized protocol that works across many tools and data sources |
| 100 | +- Built-in authentication and access control |
| 101 | + |
| 102 | +</TabItem> |
| 103 | + |
| 104 | +</Tabs> |
| 105 | + |
| 106 | +## Map all identity flows in your application |
| 107 | + |
| 108 | +Document every identity-related (authentication and authorization) process in your system. Use your IAM scenario’s Key IAM |
| 109 | +requirements to identify these flows. This ensures you don’t miss critical flows during migration. |
| 110 | + |
| 111 | +1. Identify all entry points where an identity-related process occurs (e.g., web app login, mobile app sign-in, API tokens, social |
| 112 | + or enterprise sign-ins). |
| 113 | +1. Create a comprehensive inventory of flows, for example: |
| 114 | + - Registration |
| 115 | + - Sign-in and sign-out |
| 116 | + - Multi-Factor Authentication (MFA) |
| 117 | + - Password reset and account recovery |
| 118 | + - Account linking (social, enterprise logins) |
| 119 | + - User profile management |
| 120 | + - Token refresh and session handling |
| 121 | + - Recovery flows, consent screens, or partner-specific integrations |
| 122 | +1. Create flow diagrams (sequence diagrams or flow charts) to surface dependencies and hidden complexity. |
| 123 | +1. Note where identity-related processes interact with other systems (databases, CRMs, partner apps, or external APIs). |
| 124 | + |
| 125 | +At the end of this process you should have a living document (one that you'll update as you discover more) with diagrams that |
| 126 | +capture: |
| 127 | + |
| 128 | +- All identity-related flows |
| 129 | +- Your system's existing functionality |
| 130 | +- Any existing dependencies on external systems |
| 131 | +- Edge cases requiring special handling |
| 132 | + |
| 133 | +This will serve as your blueprint for planning, designing, testing, and validating your migration. |
| 134 | + |
| 135 | +```mdx-code-block |
| 136 | +import Help from '@site/docs/_common/need-help.mdx' |
| 137 | +
|
| 138 | +<Help/> |
| 139 | +``` |
0 commit comments