FAQs

#FAQs

General

What is IAM

IAM stands for Identity and Access management. It serves as the foundation for application development in Trimble by offering a comprehensive solution for secure authentication and authorization across applications. Through centralized management of users, devices, applications and other related data assets, your Trimble business can leverage numerous workflows within and outside of the IAM portfolio.

IAM can be thought of in two ways:

IAM the data source IAM refers to the relational data store containing Trimble’s foundational identity data and relevant subresources. By generating unique identifiers for Identity data (Users, Applications, and Devices) that can be uniquely authenticated in to act on a resources. To authorize identities, IAM associates all identities to Accounts to enable the tracking of actors across the OneTrimble Ecosystems. These centralized identities create wholistic pictures of the customer and what they own. By storing Accounts, generating centalized unique identifiers, and storing references to the other systems storing customer accounts, we enable authorization checks on the resources Trimble and partner systems associate to account.

IAM the portfolio IAM is a suite of services that provide apis and end-to-end workflows covering foundational Authorization and Authentication. This portfolio sits alongside AECO’s DX services (e.g., Admin Console, eCommerce) and Field Systems aimed to drive connected data across Trimble.

Who should adopt IAM?

Any team looking for reusable authentication and authorization functionality or centralized identity data should adopt IAM. If you are unsure if you should adopt IAM, contact the IAM team.

How do teams adopt IAM?

To use IAM data and/ or services, detail your use case and the workflow that it works within. Once identified we will guide you to the correct services and integration workflows.

How, if at all, does IAM ensure higher Account data quality?

• Short Term: IAM works with AECO’s Account Data Governance committee to support agreed-upon schemas to support shareable data and features. Where possible, standard enumerated data values are used in place of open text fields to ensure data is readable and reusable. Additionally, we work with close collaborators within Business Systems to ensure appropriate data completeness during data migrations into the ecosystem.
• Long Term: IAM also aims to add local enrichment services such as Leadspace to fill gaps for customer data using publicly available data. Such enrichment includes Address and Organization data validation. Lastly, to retroactively manage customer Account data to remove duplicate resources, IAM will contribute internal frontend tools for select Support personas to view data aggregated across systems. Such work will allow teams like Customer master and the Data Migration teams to broaden their de-duplication and data management abilities.

How does IAM relate to AXP (‘Admin Console’) and DXP (‘Dealer Portal’)?

IAM is an Account data source for CDXP frontends - Admin Console, eCommerce, and Trimble.com. Additionally, the system works alongside Salesforce, Oracle and EMS to enable customer and dealer administration and enrichment across CDXP and DXP frontends. Customers, Dealers, and Support all leverage data and functionality within IAM.

I’ve heard IAM supports the concepts of ‘Accounts’ and ‘Organizations.’ Why does IAM need both? How do they relate?

Accounts, otherwise referred to as Billable Accounts, have contained all data pertaining to the Customer. However, Trimble’s diverse ecosystem has historically supports Customers creating more than one account for various reasons. To conceptualize who our Customers are, how they are organized, and what various accounts they own from one single ID, IAM employs Organizations.

Accounts

Can any application create accounts in IAM?

IAM carefully evaluates all sources of Account data to ensure data quality and proper integration flows. So any team can create accounts as long as their use case has been discussed, approved, and authorized by the IAM team.

If an account is created in IAM, is a matching account automatically created in CDH and Global Salesforce?

• The v1.0 version of IAM established a one-way sync from CDH to IAM; however, we are in the process of delivering the reverse sync (IAM to CDH) to help simplify IAM adoption in the most decoupled way.
• Neither CDH or IAM write Account records to Salesforce.
• IAM brings records together from various sources. It does not create records in Global Salesforce or other systems where those records originate.

Users

Will creating a user in IAM be reflected in TID?

Yes, users created in IAM are synced to TID.

Can a user have multiple roles in an account?

Yes, a user can have multiple roles in an account.

If no account ID is provided in the query parameter, under which account is a user added?

If no account ID is provided in the query parameter, the user is created in the account ID specified in the JWT of the token.

Does creating a user always trigger an invitation?

No, only users with an email address will receive an invitation. Managed users will not receive any invitation.

Groups

Does removing a user from the group also remove the user from the account?

No, removing a user from a group does not remove the user from the account.

Can a group hold users with different roles?

Yes, a group can hold different types of identities, such as users and applications, and users within the group can have different roles.

Can a user exist in multiple groups in the same account?

Yes, a user can exist in multiple groups within the same account.

Can a user associated to a different account be assigned to a group belonging to a different account?

Yes, a user associated with one account can be assigned to a group belonging to a different account.

Can accountOwner or secondaryAccountOwner make changes to any group in the account? (e.g., update group details, add/remove member to the group)

Yes, the account owner, secondary account owner, and administrators can manage all groups in an account and add/remove identities associated with them.

Roles

Can we assign a role to multiple users in the account?

Yes, same role can be assigned to multiple users. However, currently, the API support role assignment for one user at a time.

Can we assign multiple roles for the same user(s)?

Yes, the API supports assigning multiple roles for the same user in a single API call.

Can we have our own role names?

Yes, you can use your own role names.

Can I use a custom role to be assigned between user & an application?

No. Custom roles are always scoped to an account where the creator is part of.

Who can use role management in IAM?

If you want to regulate access on your resources with RBAC (Role-based access control) model you can use IAM authorization.

I use ABAC (Attribute-based access control) model for my project’s authorization, can I use IAM’s role management?

No. IAM role management is designed as an RBAC model.