Grafik Airlock IAM

Airlock IAM

Central access management

Airlock identity- and access-management

The increasing automation and digitisation of business processes requires absolutely secure and efficient access procedures and this is precisely what Airlock’s customer identity and access management (cIAM) guarantees. The way in which users obtain authorisation to access data or applications is generally not standardised. This is where Airlock IAM comes in and offers centralised identity management and organisation of access permissions, for applications and APIs, alike. Integrated applications can be bundled as a single sign-on (SSO) group.

Airlock IAM is compatible with a wide spectrum of authentication methods and, therefore, offers various industries an easily integrated option for efficient user and access-rights management based on modern standards.

Airlock IAM is generally used in combination with Airlock WAF and Airlock API gateway within the Airlock Secure Access Hub. Airlock IAM’s role is to manage and authenticate users and to forward the relevant identity information to the desired application in an appropriate form.

From our point of view, the greatest advantages of Airlock IAM include the adaptability of the solution, the standardized connection options for new applications and surrounding systems, modularity and expandability. This project has clearly shown that the combination of a well thought-out architecture with the right product decision and the choice of the right partner leads to success.

Albert Frei, Head of Enterprise Platforms, Bank Vontobel AG

Case Study

Airlock IAM

  • Authentication
    • Strong authentication
    • Step-up and step-down authentication
    • Adaptive or risk-based authentication
  • Single sign-on (SSO)
  • Identity federation
  • User self-service options
  • Social registration and logins (BYOI)

Airlock 2FA

Airlock 2FA is integrated into Airlock IAM and makes strong authentication possible with a second factor. Every customer has the management and use of their personal keys on their smartphone (iOS and Android).

Airlock 2FA offers modern authentication methods such as zero touch, one touch, offline QR code, passcode and passwordless. This user-friendly and future-proof solution is also cost-efficient.

The entire functionality is implemented as a REST API and therefore enables seamless integration into modern single page applications (SPA) and native smartphone apps.

Airlock 2FA

Airlock IAM 7.3

IAM 7.3 focuses on the introduction of Airlock's own authentication factor Airlock 2FA. In addition to authentication, various self-services and transaction confirmation are supported - in the Loginapps as well as the REST interface. The Airlock 2FA app is available in the App Store and Google Play. Hardware tokens are available as well.

In addition to the Airlock 2FA support, the Loginapp REST UI has been enhanced with additional features. The mTAN functionality has been enhanced so that users can not only use mTAN tokens for authentication but also manage them. There are new self-services to maintain user account data. In the area of operations and compliance, the display of maintenance messages and the acceptance of terms of services were implemented. 

The administration of technical clients is now possible with Airlock IAM. API keys, plans, and rate limits can be managed.

In the area of OAuth 2.0 and OIDC there were also functional extensions with Dynamic Client Registration, Client Credentials Grant and Token Management for APIs.


Learn more

Customer IAM vs. Workforce IAM

Unlike workforce IAM systems, cIAM systems such as Airlock IAM focus on managing external users accessing in-house systems. cIAM systems are designed for simple scalability and large numbers of users. They also provide a seamless user experience, with optimised, integrated user interfaces for onboarding and self-services. Airlock IAM’s capacity for handling social identities (BYOI) and a high degree of flexibility in the authentication process (adaptive authentication) are two of its greatest strengths.


The authentication platform Airlock IAM  provides versatile features that make it easy for you to securely manage your users.

Connecting to user directories

cIAM projects generally do not start as a blank slate. Airlock IAM’s integrated user management has thus been to easily connect to existing user databases and directories such as LDAP and Active Directory.


Airlock supports a variety of methods

Adaptive authentication

Airlock IAM can dynamically manage user access in a range of ways, striking the perfect balance between security and user-friendliness for all requirements. In particular, it is possible to consider the real-time circumstances of the access attempt, for example, from the workplace, home or on the road, and a user’s access history. Supported concepts include:


  • RBAC/ABAC (role/attribute-based access control)
  • Risk-based authentication
  • Step-up and step-down authentication
  • Re-authentication and time-out functions for individual roles
  • Implementation of complex access policies via rules and logical operators

Strong authentication, broad selection

Strong authentication with two factors, also known as multi-factor authentication or MFA, is often used to ensure that a login is not compromised by the vulnerabilities of any single authentication method. Flexible combination options are especially important here and Airlock IAM is compatible with a range of solutions, including use with a password, Mobile TAN (mTAN), a Matrix card, email OTP, Kobil SecOVID, OneSpan (VASCO) Digipass, Swisscom Mobile ID (mobile signature services), client certificates such as X.509 or SwissID, as well as OneSpan Cronto-Sign and many more.


With Airlock 2FA, the cIAM offers the most modern methods of 2-factor authentication. 2FA is integrated directly into the IAM as a REST API.

Single Sign-On (SSO) standards

The Secure Access Hub decouples the individual accesses from the applications and can, therefore, act as a smart identity switch. Depending on to where an access attempt is being forwarded, the identity of the authenticated user can be represented differently. This enables transparent, single sign-on that combines high levels of security with high user acceptance.

Airlock IAM supports a range of SSO standards and formats, including SAML 2.0 assertions, Kerberos tickets, OAuth 2.0 tokens, OpenID Connect 1.0 tickets, HTTP headers, URL tickets, and others.

Learn more about Single Sign-on

Social registration and BYOI

Users want to register and log in quickly and easily, re-using existing identities to avoid the need to set up yet another password. If users bring their identities with them for external access, this is called Bring Your Own Identity. The alternative to a clutter of passwords are the standards OAuth 2.0 and OpenID Connect 1.0. These allow the re-use of user identities and give users control. Should you not wish to rely entirely on an external identity provider, such as Facebook, Airlock IAM can add a second factor to these identities to enable strong authentication.

OAuth 2.0 is HTTP-based and, therefore, ideally suited to protect RESTful web services. When it comes to authorising access to enterprise APIs, for example to enable partners to access them, these standards are ideally suited.

Learn more about social registration

Comprehensive user self-service options

Setting up user accounts and registration processes typically elicit a lot of questions from users. Targeted user guidance and an optimised user experience are, therefore, crucial if helpdesks are to avoid being swamped with calls. Airlock IAM provides dozens of optimised, integrated UIs for registration, onboarding and self-services. These include kiosk and portal functions for managing the user’s own data, independent registration, also available via social media channels, and management of relevant accounts and tokens, including migration workflows. The integrated consent-management system also makes it possible to meet GDPR (General Data Protection Regulation) requirements for connected applications, quickly and easily.


More about user self services


Docker image

Self-contained application

Further functions


Ready for excellent IT security?

Contact us now.
Ergon Informatik AG+41 44 268 87 00

Information for you

-Our whitepaper-

IT-security solutions

Digitalisation is presenting businesses with new challenges which go far beyond information technology. This primarily relates to an aspect which is becoming increasingly important: IT security.

Read our whitepaper to find out how IT-Security will become the pioneer of degitalization.

Request free of charge

Accelerate digitisation

To stay technically viable in this digital transformation, you must increasingly switch to hybrid cloud environments. This requires new security approaches as well as coordinated identity and access management.

Find out more in our whitepaper in collaboration with Deloitte, eperi and SHE.

Request free of charge

OWASP Top 10 for API Security

OWASP has created a new Top10 list for API Security. The top 10 listed reflect a broad consensus on what the most important API security issues are at the moment.

In our whitepaper you will learn how our Airlock API addresses the OWASP Top 10.

Request free of charge