Skip to main content
An Access Manager deployment moves through four stages: Install, Bootstrap, Enable, and Operate. Each stage has its own owner.
Turn enforcement on in a product only after Access Manager runs and reports healthy. A product that enforces access first rejects every protected request.

​
Install

Deploy the two Access Manager services and connect them to their dependencies. Auth answers access decisions at runtime. Identity holds the users, groups, and applications behind those decisions. Three dependencies must be reachable before either service starts:
  • PostgreSQL, the database behind the identity backend.
  • Valkey, the cache for token, permission, and MFA-related operations.
  • Caradhras, the identity backend that stores the identity data.
Database schema changes run as a separate migration step. The services never change the schema when they start. Confirm that both services report healthy and that your products can reach Auth over the network. The platform operator does this once per environment.

​
Bootstrap

Bootstrap prepares a new environment before any product enforces access. What it seeds depends on the deployment mode.
  • Single-tenant bootstrap seeds the base organization, roles, groups, applications, and permission sets that the platform relies on.
  • Multi-tenant bootstrap prepares shared certificate material only. You create tenant organizations and access data after the tenant exists.
In both single-tenant and multi-tenant deployments, the identity backend starts with seeded administrator accounts. Change every seeded administrator password before you expose the deployment. An administrator can reset them from Lerian Console.
Bootstrap applies its seed data only during initial setup. After the environment starts, treat that data as read-only. The platform operator owns this stage, and it runs once per environment.

​
Enable

Enforcement is a per-product switch. You set the Auth variables in the .env file of each Lerian product or plugin where you want access enforced. Most products and plugins ship with enforcement off and require you to turn it on for production. Streaming Hub rejects enforcement off in production. Check each Brazil rail’s environment-variables page for its default.
With enforcement off and AUTH_REQUIRED unset, protected routes admit every request without a token. Set AUTH_REQUIRED=true to make those routes refuse with 503 when a product’s Auth client is disabled or misconfigured.
By default a machine-to-machine token acts as the product editor role. Set AUTH_M2M_INVERSION_ENABLED=true to use the application’s own subject. Variable names differ by product family. For the per-product table, read Enabling Access Manager. The team that deploys each product repeats this stage once per product.

​
Operate

Day-to-day work starts after the environment is up. It covers token requests, user and group management, MFA configuration, and calls to protected APIs. Use the Identity APIs or Lerian Console for these tasks. Access tokens issued to the applications that Identity creates expire after one hour. Applications created outside Identity carry their own lifetime. When enforcement is on, machine-to-machine tokens are verified against the issuer’s current signing keys, refreshed automatically. Administrators, end users, and integrations share this stage. It continues for the life of the deployment.

​
Next steps