--- title: "Aryaka Identity Management" canonical: "https://docs.aryaka.com/space/KNOW/1510247/Aryaka%20Identity%20Management" format: markdown --- The Aryaka Identity Management (AIM) page (at Global Settings > Identity Management) is a central location where you can configure identity providers (IdPs) to store and manage your enterprise users and enterprise user groups. You can configure the following IdPs: Aryaka’s IdP—Uses basic authentication. Enterprise's Active Directory—Uses basic and, optionally, Kerberos authentication. Enterprise's LDAP—Uses basic authentication. Enterprise's Okta SAML—Uses SAML authentication. Enterprise's Entra SAML—Uses SAML authentication. Enterprise's Duo SAML—Uses SAML authentication. You can configure multiple authentication providers as needed for your organization. You can also configure multiple instances for a single authentication provider. However, you can only configure one instance of Aryaka’s IdP. Users stored in AIM can be used as match criteria in your security rules. You can create security rules for an individual site or create a ruleset to apply security rules to multiple sites . The enterprise users and enterprise user groups included in your IdP are different from those configured for MyAryaka in Access Control . Authentication types Each available identity provider uses one or more of the following authentication types: Basic Kerberos SAML Active Directory uses basic authentication by default, but you can additionally configure Kerberos. Aryaka’s IdP and LDAP use basic authentication, while Okta, Entra, and Duo use SAML. Basic authentication Basic authentication requires an authorization header in a client’s HTTP request. When a client sends a request to a server without an authorization header, the client is prompted to enter user credentials (username and password). These credentials are included in the authorization header that is returned to the server. The server verifies the credentials and the authentication header is included with each subsequent request. Kerberos authentication Kerberos is a single sign-on (SSO) network authentication protocol that ensures mutual authentication between a client and server. A series of encrypted tickets are sent between the client, the server, and a Key Distribution Center to authenticate both the client and the server before the client can begin a session. Note that these elements must all exist within the same domain (for example, Active Directory). After authentication, the server allows requests from the client for a configurable time period, avoiding repeated password entry within a domain. SAML authentication SAML enables SSO by facilitating the exchange of authentication data between an identity provider and a SAML-enabled service provider. When a user tries to access a web application, they are redirected to your company’s IdP. The IdP requests the user’s credentials (username and password) and verifies their identity. This creates a SAML assertion—an XML document that contains the user’s identity, any associated attributes (for example, roles and permissions), and proof of authentication. This assertion is sent to the service provider the user was trying to access. If the service provider validates the assertion, the user is granted access to the web application. If the user accesses a different web application, the IdP uses the same SAML assertion, without requiring that user credentials be entered again. This means that SAML allows users to access multiple applications, in different domains, without requiring repeated password entry. Configure AIM If you have not previously configured AIM for your organization, the Aryaka Identity Management page indicates that AIM is not currently set up for your organization. Click Set up AIM to configure AIM for your organization. After AIM is set up for your organization, The Aryaka Identity Management page displays the following: Identity Providers tile—Displays the number of IdPs configured for your organization. Users tile—Displays the total number of users configured for your IdPs. User Groups tile—Displays the total number of user groups configured for your IdPs. Configured Identity Providers section—Displays a tile for each IdP configured for your organization. Each tile displays information about the IdP configuration, such as the name, host name, and authentication type. If you have not configured an IdP, you can add an IdP in the following section. Available Identity Providers section—Displays a tile for each of the following IdPs that you can add to your AIM configuration: Aryaka’s IdP Enterprise’s Active Directory Enterprise’s LDAP Enterprise’s Okta Enterprise’s Entra Enterprise’s Duo Complete the procedures in this topic to manage your AIM configuration. To add a new IdP to your AIM configuration Open the Aryaka Identity Management page if it is not already open: Log in to MyAryaka. The Home page appears. Click Global Settings in the left navigation pane. The Global Settings page appears and displays a series of tiles. Click Manage in the Identity Management tile. The Aryaka Identity Management page appears. In the Available Identity Providers section, click Add on an IdP tile to configure that IdP for your organization. The Configure < IdP > page appears. See the following topics for details about configuring a specific IdP: Configure AIM for Aryaka’s IdP Configure AIM for Active Directory Configure AIM for LDAP Configure Okta SAML for AIM Configure Microsoft Entra SAML for AIM Configure Cisco Duo SAML for AIM To edit an IdP’s configuration Open the Aryaka Identity Management page if it is not already open: Log in to MyAryaka. The Home page appears. Click Global Settings in the left navigation pane. The Global Settings page appears and displays a series of tiles. Click Manage in the Identity Management tile. The Aryaka Identity Management page appears. In the Configured Identity Providers section, click Manage on an IdP tile to edit that IdP’s configuration. The < IdPname > page appears. See the following topics for details about editing the configuration of a specific IdP: Manage Aryaka’s IdP Manage Active Directory Manage LDAP Manage Okta SAML Manage Entra SAML Manage Duo SAML To delete your AIM configuration Open the Aryaka Identity Management page if it is not already open: Log in to MyAryaka. The Home page appears. Click Global Settings in the left navigation pane. The Global Settings page appears and displays a series of tiles. Click Manage in the Identity Management tile. The Aryaka Identity Management page appears. Click the Delete icon to remove your AIM configuration. Note that you must delete all IdPs before you can delete your AIM configuration. After your AIM configuration is deleted, the Aryaka Identity Management page prompts you to set up AIM for your organization. In this topic Related topics Security engine rulesets Access Control Network user identity management