Security¶
AMI provides authentication, entitlements, and encryption capabilities to control access to the platform and protect data at rest and in transit.
This page provides an overview of AMI's security features and their configuration.
Overview¶
AMI security is organized into two areas. Authentication and entitlements control who can access AMI and what they are permitted to do once logged in. AMI supports OAuth, SAML, and LDAP for identity management, with support for custom SSO and entitlements plugins where further control is required.
Encryption covers the protection of data at rest and in transit, including properties file encryption, table-level encryption, user password management, external vault integration, and SSL/TLS configuration.
Key Concepts¶
| Concept | Description |
|---|---|
| Authentication | The process of verifying a user's identity before granting access to AMI. Supported via OAuth, SAML, LDAP, or a custom SSO plugin. |
| Entitlements | Permissions assigned to a user that control which Layouts, data, and features they can access within AMI. |
| SSO | Single Sign-On: allows users to authenticate once against an identity provider and access AMI without requiring separate credentials. |
| Data filter | A plugin that restricts which rows of data a user can see, applied after entitlements at the data layer. |
| Encryption | Protection of sensitive data at rest (properties files, tables, passwords) and in transit (SSL/TLS). |
| External vault | An external secrets management service, such as Azure Key Vault, used to store and retrieve encryption keys and credentials outside of AMI's configuration files. |