Atos DirX Access

Identity and Access Management (IAM) has evolved from basic user accounts and group-based access control into a specialized, multi-component cybersecurity discipline covering provisioning, identity stores, authentication, authorization, governance, reconciliation, risk management, and integrations with other security systems. While many IAM capabilities are now standardized and partly commoditized, effective solutions must interoperate through common standards such as SCIM for provisioning, LDAP (and sometimes NoSQL for CIAM) for identity storage, Kerberos/RADIUS/PKI and modern FIDO/WebAuthn for authentication, OAuth/OIDC/SAML for federation, and JWT/UMA/XACML for authorization. IAM is commonly organized into Identity Management (lifecycle and governance/IGA), Access Management (SSO, federation, authentication, authorization), and Privileged Access Management (controls for privileged users and shared accounts).

Access Management must support both modern SaaS and legacy web applications, using federation standards where possible and fallback techniques like password injection or modified HTTPS headers when necessary. Deployment trends favor cloud delivery, but on-premises remains important for B2E/B2B and some B2C scenarios tied to enterprise backends, with scalability and high availability being mandatory—especially for peak-heavy B2C workloads.

Atos DirX Access is positioned as a mature, on-premises Access Management product enhanced with adaptive (risk/context-aware) authentication, integrated user behavior analytics, web access management, federation, and dynamic authorization based on XACML. It supports a wide range of authentication methods (including OTP, Windows Hello, WebAuthn, and FIDO2), flexible policy-driven factor combinations, session tracking and anomaly detection, and session state sharing across servers. Federation support includes SAML, OAuth 2.0, and OIDC, plus capabilities like SAML proxying, secure token transformation, and dynamic user provisioning (push and pull models). Strengths include breadth, flexibility, multi-tenancy, HA/failover, and deep integration options; challenges include lack of full IDaaS, low market visibility, and an outdated administrative UI requiring modernization, with some integrations requiring coding.

• IAM includes provisioning, identity repositories, authentication, authorization, web access management, federation/SSO, governance, reconciliation, and risk management.
• Common IAM standards listed include SCIM, LDAP, Kerberos, RADIUS, PKI/X.509, FIDO (U2F/UAF/2.0), OAuth, OpenID, OpenID Connect, SAML, JWT, UMA, and XACML.
• IAM is commonly divided into Identity Management (IGA), Access Management, and Privileged Access Management.
• Access Management can integrate with legacy applications via password injection and modified HTTPS headers when federation is unavailable.
• On-premises Access Management remains relevant for B2E and B2B use cases and for B2C scenarios tied to enterprise backend systems.
• DirX Access supports adaptive authentication, web access management, and identity federation.
• DirX Access supports modern authentication standards including W3C WebAuthn and FIDO2.
• Risk/context signals supported include geolocation, IP address ranges, and context from earlier sessions, with optional third-party call-outs.
• DirX Access supports SAML v2.0, OAuth 2.0, and OpenID Connect, including SAML proxying across multiple IdPs.
• The administrative UI is described as outdated and lacking graphical configuration of authentication flows.

• “IAM is a foundational element of cybersecurity today.”
• “Many of the components of IAM have become standardized and even commoditized.”
• “Commonly, IAM is split into three major parts.”
• “A specific requirement for all types of Access Management is scalability and high availability.”
• “DirX Access is a feature-rich solution for Access Management, supporting Adaptive Authentication including risk- and context-aware authentication.”
• “A security session is created for each user.”
• “DirX Access tracks every user session if configured.”
• “A specific capability is Dynamic Provisioning of users to target systems in combination with federation protocols.”
• “That type of in-depth integration support is rarely found in Access Management solutions.”
• “The biggest challenge, from our perspective, is the outdated UI.”