andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-15 18:25:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: rename IAM to instance (#11351)

Browse Source 
# Which Problems Are Solved

In many cases IAM was used where instance was meant. 

# How the Problems Are Solved

- Rename wrong usage of IAM to instance all over the code base.
- Add an agents.md which explains the terms used in Zitadel's
architecture.

# Additional Context

- closes #11280

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: muhlemmer <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Marco A. <[email protected]>
This commit is contained in:
Tim Möhlmann
2026-02-10 20:25:39 +01:00
committed by GitHub
co-authored by Copilot muhlemmer Copilot Marco A.
parent 67a02a6aeb
commit 5a2181bcec
110 changed files with 392 additions and 478 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/guides/integrate/token-exchange.mdx
+3 -3
View File
@@ -433,7 +433,7 @@ This gives us a response with the ID token in the `access_token` field and the `
With impersonation we can let one user assume the role of another user.
<Callout>
Currently impersonated tokens cannot be used for the ZITADEL API. This is to prevent privilege escalation where a impersonator could become an IAM owner, for example. We might enable the use of impersonated tokens in the future.
Currently impersonated tokens cannot be used for the ZITADEL API. This is to prevent privilege escalation where a impersonator could become an instance owner, for example. We might enable the use of impersonated tokens in the future.
</Callout>
### Preparation
@@ -452,8 +452,8 @@ Next we need to configure which users are allowed to impersonate other users. ZI
| Name | Role | Description |
| ---------------------- | ------------------------- | ----------------------------------------------------------------- |
| IAM Admin Impersonator | IAM_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from all organizations |
| IAM Impersonator | IAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations |
| Instance Admin Impersonator | IAM_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from all organizations |
| Instance Impersonator | IAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations |
| Org Admin Impersonator | ORG_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from the organization |
| Org Impersonator | ORG_END_USER_IMPERSONATOR | Allow impersonation of end users from the organization |
apps/docs/content/guides/integrate/zitadel-apis/access-zitadel-apis.mdx
+1 -1
View File
@@ -65,7 +65,7 @@ Via APIs23: * [Create User (Machine)](/reference/api/management/zitadel.manageme
ZITADEL Managers are Users who have permission to manage ZITADEL itself.
There are some different levels for managers.
- **IAM Managers**: This is the highest level. Users with IAM Administrator roles are able to manage the whole instance.
- **Instance Managers**: This is the highest level. Users with IAM Administrator roles are able to manage the whole instance.
- **Org Managers**: Managers in the Organization Level are able to manage everything within the granted Organization.
- **Project Managers**: At this level, the user is able to manage a project.
- **Project Grant Manager**: The project grant manager is for projects, which are granted of another organization.
apps/docs/content/guides/manage/console/managers.mdx
+7 -7
View File
@@ -21,13 +21,13 @@ In the right part of the management console you can find **MANAGERS** in the det
| Name | Role | Description |
| ----------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------ |
| IAM Owner | IAM_OWNER | Manage the IAM, manage all organizations with their content |
| IAM Owner Viewer | IAM_OWNER_VIEWER | View the IAM and view all organizations with their content |
| IAM Org Manager | IAM_ORG_MANAGER | Manage all organizations including their policies, projects and users |
| IAM User Manager | IAM_USER_MANAGER | Manage all users and their authorizations over all organizations |
| IAM Admin Impersonator | IAM_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from all organizations |
| IAM Impersonator | IAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations |
| IAM Login Client | IAM_LOGIN_CLIENT | Get all permissions needed to implement your own Login UI. |
| Instance Owner | IAM_OWNER | Manage the Instance, manage all organizations with their content |
| Instance Owner Viewer | IAM_OWNER_VIEWER | View the Instance and view all organizations with their content |
| Instance Org Manager | IAM_ORG_MANAGER | Manage all organizations including their policies, projects and users |
| Instance User Manager | IAM_USER_MANAGER | Manage all users and their authorizations over all organizations |
| Instance Admin Impersonator | IAM_ADMIN_IMPERSONATOR | Allow impersonation of admin and end users from all organizations |
| Instance Impersonator | IAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations |
| Instance Login Client | IAM_LOGIN_CLIENT | Get all permissions needed to implement your own Login UI. |
| Org Owner | ORG_OWNER | Manage everything within an organization |
| Org Owner Viewer | ORG_OWNER_VIEWER | View everything within an organization |
| Org User Manager | ORG_USER_MANAGER | Manage users and their authorizations within an organization |
apps/docs/content/guides/manage/user/scim2.mdx
+1 -1
View File
@@ -2,7 +2,7 @@
title: SCIM v2.0
---
Zitadel’s **[SCIM v2](https://scim.cloud/) service provider interface** enables standardized provisioning and lifecycle management of users and other IAM resources.
Zitadel’s **[SCIM v2](https://scim.cloud/) service provider interface** enables standardized provisioning and lifecycle management of users and other instance resources.
By implementing the official *System for Cross-domain Identity Management (SCIM) v2.0* specification, Zitadel allows seamless and automated user creation, updates, deactivation, and deprovisioning across systems.
## API
apps/docs/content/guides/migrate/sources/zitadel.mdx
+4 -4
View File
@@ -14,7 +14,7 @@ This guide explains how to migrate from ZITADEL, this includes
The following scripts don't include:
- Global policies
- IAM members
- Instance members
- Global IDPs
- Global second factor / multi-factors
- Machine keys
@@ -30,7 +30,7 @@ Note that the resources will be migrated without the event stream. This means th
## Authorization
You need a PAT from a service user with IAM Owner permissions in both the source and target system.
You need a PAT from a service user with instance Owner permissions in both the source and target system.
### Source system
@@ -38,7 +38,7 @@ You need a PAT from a service user with IAM Owner permissions in both the source
2. Create a service user "import_user" with Access Token Type "Bearer"
3. Create a [personal access token](/guides/integrate/service-accounts/personal-access-token)
4. Go to the Default settings
5. Add the import_user as [manager](/guides/manage/console/managers) with the role "IAM Owner"
5. Add the import_user as [manager](/guides/manage/console/managers) with the role "instance Owner"
Save the PAT to the environment variable `PAT_EXPORT_TOKEN` and the source domain as `ZITADEL_EXPORT_DOMAIN` to run the following scripts.
@@ -48,7 +48,7 @@ Save the PAT to the environment variable `PAT_EXPORT_TOKEN` and the source domai
2. Create a service user "export_user" with Access Token Type "Bearer"
3. Create a [personal access token](/guides/integrate/service-accounts/personal-access-token)
4. Go to the Default settings
5. Add the export_user as [manager](/guides/manage/console/managers) with the role "IAM Owner"
5. Add the export_user as [manager](/guides/manage/console/managers) with the role "instance Owner"
Save the PAT to the environment variable `PAT_IMPORT_TOKEN` and the source domain as `ZITADEL_IMPORT_DOMAIN` to run the following scripts.