Our organisation's policy regarding IAM are getting more and more strict. Already Multi-Factor Authentication will become mandatory for all access, which includes IT Users for OutSystems. Luckily, this is now possible with the new OIDC plugin included in LifeTime.

However, with regards to authorisation for IT Users, we can currently not comply to the best practice (which might become mandatory in the future). Ideally, all authorisations should be granted through a central portal (with built-in approval flows) and then automatically assigned in the target system. For IT Users, we still have to assign ourselves access manually with an Administrator user.

For front-end users we can already see the benefit of having this set-up in the Users module: No manual actions by local administrators are required anymore, only a one time configuration set-up and occasional changes, but never granting/revoking access on user level. This is both time-saving and compliant to our standards.

It would be great for us if a similar set-up could be designed for IT Users in LifeTime. Perhaps the OIDC plugin could be extended (or another option could be offered) to allow Groups claims to be included from Active Directory, which could then be automatically assigned to LifeTime roles. This would be very similar to the set-up in the Users module with AD groups claims being mapped to local Users groups.