Dell EMC ObjectScale 1.2.x Administration Guide

IAM provides an AWS-compatible authentication and authorization mechanism that are availed by other ObjectScale services such as:

• Datahead (S3)
• Geoservice
• Object store management service

In this release the top-most level of the ObjectScale IAM hierarchy is an Account. Several Accounts can be defined within a single ObjectScale instance. When an IAM account is added to an object store, that account becomes a tenant within that object store. A tenant is a logical construct resulting from the binding of the IAM account to the object store.

Every Account has a globally unique identifier assigned to it by the IAM service at the time of creation. An IAM Account contains other IAM entities like Users, Groups, Roles, Policies, and Service Providers associated with it. You cannot create or modify an Account to have another Account associated with it.

In ObjectScale, each account consists of replicated IAM entities and ObjectScale local IAM entities. Local IAM entities remain local within the ObjectScale instance and are not replicated. Global entities are replicated to other ObjectScale instances. Replicated IAM entities and ObjectScale local IAM entities have separate APIs.

The ObjectScale instance where the Account was created initially owns that Account and is known as the Account Owner. That account is a primary account on that ObjectScale instance. Within ObjectScale there can be only one Account Owner for any given Account and its underlying IAM entities.

Multiple ObjectScale instances can be connected to each other forming an ObjectScale Federation. Within this federation all ObjectScale instances have a trust relationship established with each other. Any Federation member knows about other Federation members through ObjectScale Federation Service. Any Federation member knows about all existing Accounts across the Federation, i.e. there is a shared Account Registry. When a primary IAM account is replicated from its ObjectScale instance to another ObjectScale instance(s) within the federation, it becomes a secondary on these other ObjectScale instances. For more information about federating ObjectScale instances, see Federate ObjectScale Systems.

An Account can be changed by an authorized user. The user can add, update, or delete any of the entities associated with that account. However, such operations must always be performed on the ObjectScale instance that owns the Account. When the IAM entity is changed, the effects of those changes may not take effect immediately.

If a user tries to change an Account from an ObjectScale that doesn't own that Account, the user will get HTTP 301 or 308 message along with the URL that corresponds to the Account Owner.

The ObjectScale Management Rest API ZIP file with the supported IAM APIs at available on the Drivers & Downloads tab of your model and version (https://www.dell.com/support/home/en-us/product-support/product/objectscale-product-family/overview).