Skip to content

Identity & Access Management (IAM)

Thoth provides a robust IAM system designed to manage users and control their access to resources within a tenant.

1. Users

Users are individuals who can log into the Thoth platform.

  • Account Activation: When a user is created, an activation link is generated. The user must use this link to set their initial password.

  • Profile Management: Users can manage their own passwords and view their own activity logs.

2. Roles & Permissions

A Role is a named collection of permissions. Instead of assigning permissions directly to users, you assign roles to them.

List of Permissions

Category Permissions
Templates READ, CREATE, UPDATE, DELETE, PUBLISH, RENDER, PRINT
Datasources READ, CREATE, UPDATE, DELETE, PUBLISH, TEST
Renderers READ, CREATE, UPDATE, DELETE, PUBLISH, RENDER, PRINT, EXECUTE
Printing Clients READ, CREATE, UPDATE, DELETE
IAM USER_READ, USER_WRITE, USER_DELETE, ROLE_READ, ROLE_WRITE, ROLE_DELETE, GROUP_READ, GROUP_WRITE, GROUP_DELETE
Secrets READ, CREATE, UPDATE, DELETE
System ADMIN (Superuser access)

3. Groups (Resource Isolation)

Groups are the foundation of Thoth's multi-level isolation.

  • Resource Ownership: Every Template, Datasource, and Renderer must belong to exactly one Group.

  • User Assignment: A user can be assigned to one or more Groups.

  • Visibility: A user can only see and interact with resources that belong to the groups they are assigned to.

  • Example: An organization might have groups like "Finance", "Logistics", and "Marketing". Users in "Logistics" will not see the templates or database connectors used by "Finance".

4. API Keys

For system-to-system integrations (e.g., your e-commerce backend requesting a shipping label), you should use API Keys instead of user credentials.

  • Inheritance: Each API Key is assigned a Role. It inherits all the permissions of that role.

  • Security: API Keys are masked and only shown once during creation. They can be revoked at any time.

5. OAuth Providers

Thoth supports external identity providers (Google, Microsoft, GitHub, etc.).

  • Configuration: Administrators can configure OAuth providers at the tenant level.

  • Mapping: You can configure Thoth to automatically assign certain roles or groups to users based on their OAuth profile data.