Skip to main content
Installing Access Manager isn’t enough on its own. To start enforcing access, turn it on in each product. Set the Auth variables in the .env file of any Lerian product or plugin where you want it active.
Enabling Access Manager only turns on authorization enforcement in a product or plugin. You manage access data separately through Access Manager. This includes users, groups, applications, providers, roles, and permissions.
Every protected product must enable enforcement and point to Auth. The address variable is not the same in every repository, so use the variable expected by the product you configure:
After you enable Access Manager, protected API requests must include an Authorization header with a valid Bearer access token.Without this header, protected requests will be rejected, even for endpoints that were previously accessible without authentication.Learn how to generate and use access tokens.

​
Where to update

You’ll find the relevant .env files in these locations:
  • Midaz
    • /midaz/components/ledger uses PLUGIN_AUTH_HOST.
    • /midaz/components/tracer uses PLUGIN_AUTH_ADDRESS
  • Other products and plugins
    • Use the .env file in the product or plugin root, or in the component directory when the repository is split into components.
    • Reporter, Flowker, and Bank Transfer use PLUGIN_AUTH_ADDRESS.
    • Pix Indirect BTG uses PLUGIN_AUTH_ADDRESS.
    • Pix via JD uses PLUGIN_AUTH_HOST.
If you can’t see the files, adjust your system settings to show hidden files. .env files are often hidden by default.

​
Rebuild after changes

After updating a .env file, rebuild and restart from the root of the repository that owns that file. Lifecycle commands differ by repository: in the Midaz repository root, run make rebuild-up, because its make up target starts services without rebuilding them. For other products and plugins, use the lifecycle command documented for that product.

​
Deployment lifecycle

Access Manager setup has two phases:
  • Bootstrap seeds a new environment with the base organization, roles, groups, applications, and permission sets required by the platform.
  • Operation starts after the environment is up. From that point on, manage access through the Identity APIs or Lerian Console.
Use the operational APIs for user access, group assignment, application credentials, providers, and MFA. Don’t change a running environment by editing bootstrap seed files.
Bootstrap applies its seed data only during initial environment setup. Changes to built-in resources, actions, roles, groups, applications, or permission sets in an existing environment must be delivered through controlled platform updates. Examples include migrations and an idempotent reconciler.