Skip to main content

Authentication modes

AI summary
Explains authentication modes in Imply Lumi Enterprise. Covers Amazon Cognito for AWS deployments with internal user management. Describes external mode for SSO with identity providers. Helps you choose the right authentication approach.

About AI summaries.
Lumi Enterprise only

This information applies to Lumi Enterprise.

Imply Lumi Enterprise supports two authentication modes that determine how users and roles are managed:

You set the authentication mode using the auth_mode property in main.tf. External mode is the default.

External mode​

External mode is the default authentication mode for Lumi Enterprise. It is required for non-AWS deployments.

In external mode, Lumi Enterprise delegates user management to an external identity provider (IdP). Users authenticate through single sign-on (SSO) using their IdP credentials. The Users page is not available in the Lumi UI since user management happens in the IdP. Roles are managed through a combination of group assignments in the IdP and role mapping in Lumi Enterprise.

Amazon Cognito​

Lumi Enterprise deployments on AWS support both external mode and Amazon Cognito for authentication. Cognito mode is an alternative to external mode that doesn't require an external identity provider. In Cognito mode, users log in with a Lumi Enterprise username and password. Users with the Admin role can create and manage user accounts in Lumi Enterprise.

To enable Cognito mode, set auth_mode to cognito in main.tf.

Choose a mode​

Use the following diagram to determine which mode is right for your deployment:

Learn more​

See the following topics for more information: