OneTrust Access Management Architecture

OneTrust Access Management supports user authentication through email and password and Single Sign-On (SSO), as well as automated user provisioning through Just-In-Time (JIT) Provisioning and System for Cross-Domain Identity Management (SCIM).

User access within the OneTrust Platform is managed through a combination of authentication, provisioning, and authorization mechanisms. Authentication determines who a user is, while authorization determines what a user can access and what actions they can perform within the platform. Managing user access to the OneTrust Platform is automated through Single Sign-On (SSO) and System for Cross-Domain Identity Management (SCIM).

Access Management Architecture

The following diagram illustrates the access control model for the OneTrust Platform. Included in this diagram are the following key terms:

Identity Governance Platform

: Used for Access Request, Access Certification, and Compliance Controls.

Identity Provider

: Used for User Authentication, Single Sign-On, Multifactor Authentication, and Password Reset.

When a user requests access from the Identity Governance Platform, they would be provisioned to a certain group on the Identity Provider based on their approved access. The Identity Provider then leverages either SSO or SCIM to provision users to appropriate groups within the OneTrust Platform.

Within the OneTrust Platform, access is managed through roles and other authorization controls. Roles define a user's baseline permissions, while additional access controls can be used to manage access to specific records and business processes.

Roles provide the foundation for authorization within the OneTrust Platform. A role defines the permissions available to a user and determines which features, actions, and areas of the platform they can access. This includes permissions such as creating, viewing, editing, approving, or administering records and platform configurations.

Roles can be assigned directly to users or provisioned through groups using SSO and SCIM integrations. Organizations typically use roles to standardize access for users with similar job functions and responsibilities.

Because roles grant broad access to platform capabilities, they are often used as the baseline layer of a larger access-control strategy.

Attribute-Based Access Control (ABAC) extends the OneTrust access-control model by providing more granular access management for supported solutions. ABAC works alongside existing roles to help organizations control access to specific records through assignments, sharing, attributes, workflows, and other supported access controls.

While roles determine the actions a user can perform, ABAC can be used to determine which records a user can access. This approach helps organizations implement least-privileged access, support collaboration across teams, and reduce reliance on broader role assignments.

ABAC complements Role-Based Access Control (RBAC). Roles continue to provide baseline permissions, while ABAC adds record-level access management for supported solutions and objects.

Single Sign-On

Managing user access via SSO allows you to leverage your company's identity and access management solution to allow users to access the OneTrust Platform with their existing credentials.

In setting up the SSO configuration, you will map attribute assignments between your IdP and the OneTrust Platform. OneTrust supports role, organization, and group assignments, which means that the platform will read specific values in the Security Assertion Markup Language (SAML) assertion that is sent from your IdP and assign those values to valid OneTrust values.

By defining this mapping, users will be provisioned with the mapped roles, organizations, and user groups when signing in to the OneTrust Platform via SSO.

Note:

For more information, see Managing Single Sign-On (SSO).

SCIM User & Group Provisioning

SCIM helps facilitate the automated management of user identities and groups in cloud applications using RESTful APIs, allowing you to manage and update user information and group information across applications. OneTrust's implementation of SCIM utilizes User Provisioning and Group Provisioning to manage users and groups from your IdP. User attributes and group memberships are kept in sync between the IdP and the OneTrust Platform.

User Provisioning

: Once users are successfully provisioned in your IdP, those users will be automatically created within the OneTrust Platform and will be assigned the role and organization defined in your SCIM configuration.

Group Provisioning

: Once groups are successfully provisioned in your IdP, those groups will be automatically created as user groups in the OneTrust Platform. If you provisioned certain users as members of that group in your IdP, those users will be automatically added as members of the respective user group in the OneTrust Platform.

Note:

For more information, see SCIM User & Group Provisioning.

Together, SSO, SCIM, roles, and ABAC provide a comprehensive approach to access management.

• SSO authenticates users and simplifies sign-in experiences.

• SCIM automates user and group provisioning and helps keep identity information synchronized.

• Roles provide baseline permissions and access to platform capabilities.

• ABAC provides additional record-level access management for supported solutions and use cases.

By combining these capabilities, organizations can improve governance, support least-privileged access, and streamline access management across the OneTrust Platform.