Skip to main content
Digital Identity Management entities are linked to each other using associations defined by permission flags and, in some cases, attributes. Digital Identity Management entities can be one-to-one (one user to one account) or one-to-many (one user to an account, a group, multiple subscriptions, and so on). Every association needs an owner entity and a target entity. The owner entity grants a particular permission or access to the target entity (e.g. user to an account). User, Runtime, and Group are the only three entities that can be owners. All other can be targets.

​
Attributes

Like with primary Digital Identity Management entities, attributes may be added to an association in order to better define the relationship between those entities. For example, if an user configures Multi-Factor Authentication (MFA), and opts to trust a device during an MFA check, that trust is captured as an attribute on the User-to-Runtime association.

​
Association Flags

By default, any association comes with various association flags. These flags act as permission switches to be toggled on or off, so as to define what an owner entity can enact on a target entity. For example: Hank pays for a music streaming service. In Digital Identity Management, Hank’s User entity is associated to the Digital Identity Management Account, Subscription, and Feature entities that represent the streaming account and service. The association flags between the User entity and the Subscription entity enable Hank to listen to music on a playlist (read flag), add music to a playlist (write flag), or delete existing playlists or favorites (delete flag). Consider if Hank adds his friend Dale to his user group, and then shares access to his streaming service with Dale. Dale’s User entity will then be associated to the same Subscription or Feature entity as Hank, but the flags for that association only support the ability to listen to music (“read” flag).

​
Permissions

There are 2 permission types: primary user and regular user permissions. A primary user’s permissions are the following:
A regular user’s permissions are the following:

​
Account/Subscription/Feature Associations

Most Digital Identity Management entities exist independent of each other before they are associated to each other. Much of our Digital Identity Management documentation uses simplified entity relationship diagrams that reflect this. However, as an exception to this rule a Digital Identity Management Feature cannot exist independent of a parent Digital Identity Management subscription, and a subscription cannot exist independent of a parent Digital Identity Management account. While still considered a kind association, the relationship between Accounts, Subscriptions, and Features more resembles a kind containership or ownership. Parent topic:Digital Identity Management Data Model