Community vs Enterprise
OpenIAM is available in two versions: Community and Enterprise.
Community Edition (CE): A freely available release that customers can deploy in their environments. The CE represents the previous generation of the Enterprise Edition. For example, when v4.2.1 was released to the Enterprise, the last stable 4.2.0.x release was made available to the public as the CE. In this respect, the CE always has less features than the EE and support is provided through the community portal.
Enterprise Edition (EE): Only available through an active subscription and represents the latest stable release which customers can use in production. In addition to the commercial support, the EE contains a larger feature set in comparison to the CE. The version is being actively developed by the OpenIAM product engineering team to align with both customer requests and the published product roadmap.
Major differences between CE and EE
Authentication
The CE supports the following types of authentication: Password, OTP over email and SMS and limited adaptive authentication functionality. The EE supports all of the authentication methods found in the CE and adds OTP over IVR, certificate-based authentication, Kerberos, directory-based authentication, FIDO2 and the OpenIAM mobile authenticator with push notification. The EE also has broader adaptive authentication functionality.
The latest EE release also enables integration with Criipto to allow end users to authenticate using EU BankID such as MitID.
User life cycle management
- Improved performance: The EE includes performance and architectural improvements that allow for large datasets to be processed efficiently when executing synchronization and reconciliation functions.
- Simulation mode: This functionality assists with testing and troubleshooting in a complex environment when a non-production environment is unavailable. This feature is only found in the EE.
Privacy and consent
Consent management functionality has been introduced in the EE. This feature supports multiple languages, consent history, validate date, and admin tools to manage customer consent.
Contractor management
Allows managers to manage the contractor life cycle. Only available in the EE.
Self-service portal
The functionality to allow authorized users to create bulk access requests has been introduced in the EE.
Architecture
CE deployments are limited to RPM and Docker Swarm. The EE can be deployed on Kubernetes and OpenShift as well as RPM. The EE contains significant architectural improvements that impact system performance, scalability, and high availability (HA). HA is only supported in the EE.
Additionally, the latest EE release allows for Docker deployments on Ubuntu 22.04 and RHEL 8.8. RPM support for RHEL 8.7 and 8.8 on Azure has been added in the EE as well.
.
Feature Comparison
| Features | Community | Enterprise |
|---|---|---|
| Authentication | ||
| Password | Y | Y |
| AD/LDAP authentication | Y | Y |
| OTP over SMS | Y | Y |
| OTP over email | Y | Y |
| OTP over IVR | Y | Y |
| FIDO 2 | Y | |
| OpenIAM authenticator with push | Y | |
| Certificate-based auth | Y | Y |
| Kerberos | Y | Y |
| Social authentication | Y | Y |
| Adaptive authentication | Y | |
| Integration with Criipto | Y | |
| Single sign-on (SSO) | ||
| SAML | Y | Y |
| oAuth | Y | Y |
| OIDC | Y | Y |
| Reverse proxy | Y | Y |
| User life cycle management | ||
| Automated provisioning | Y | Y |
| Joiners (new users) | Y | Y |
| Movers (position change) | Y | Y |
| Leavers (disable, terminate) | Y | Y |
| Role-based provisioning | Y | Y |
| Reconciliation | Y | Y |
| Business rules engine | Y | Y |
| Orphan management | Y | Y |
| Entitlement management | ||
| Flexible RBAC model | Y | Y |
| Entitlement viewer and editor | Y | Y |
| Custom entitlement types | Y | Y |
| Direct entitlements | Y | Y |
| Unified view of IAM and target system entitlements | Y | Y |
| Entitlement synchronization from target applications | Y | Y |
| Entitlement provisioning to target | Y | Y |
| Access request and approvals (workflow) | ||
| Service catalog and shopping cart-based request-approval | Y | Y |
| Multi-step approvals | Y | Y |
| Integrated into self-service portal | Y | Y |
| Profile templates | Y | Y |
| Time-based auto-revocation | Y | Y |
| SLAs and escalations | Y | Y |
| Line-item level approval/rejections | Y | Y |
| Approval delegation | Y | Y |
| Out-of-office delegation | Y | Y |
| Email-based approval | Y | Y |
| Request administration (monitor, delegate, cancel) | Y | Y |
| User access reviews | ||
| User-based certifications | Y | Y |
| Entitlement-based certifications | Y | Y |
| Privileged and service account | Y | Y |
| Reports | Y | Y |
| Self-service portal | ||
| Supports integration with third party IdP for SSO | Y | Y |
| Unified SSO application launch pad | Y | Y |
| Self-service password reset (SSPR) | Y | Y |
| Change password | Y | Y |
| Profile management | Y | Y |
| View your access | Y | Y |
| View your direct reports and their access | Y | Y |
| Self-registration | Y | Y |
| Integrated request/approval | Y | Y |
| Integrated access review | Y | Y |
| Corporate directory lookup | Y | Y |
| Contractor management | Y | |
| Manager self-service | Y | |
| Bulk access requests for authorized users | Y | |
| Password management | ||
| Flexible password policy | Y | Y |
| Password synchronization | Y | Y |
| Password dictionary | Y | |
| Active Directory password filter | Y | |
| Self-service password reset | ||
| Challenge questions | Y | Y |
| One-time link | Y | Y |
| SMS-based one-time token | Y | Y |
| Credential provider | ||
| Windows | Y | |
| MacOS | Y | |
| Integration connectors | ||
| Core connectors | Y | Y |
| Cloud connectors | Y | Y |
| Enterprise connectors | Y | |
| Privacy and consent | ||
| Consent management | Y | |
| General features | ||
| Integration API | Y | Y |
| RPM deployment | Y | Y (including RHEL 8.7 and 8.8 on Azure) |
| Docker Swarm | Y | Y (including Ubuntu 22.04 and RHEL 8.8) |
| Kubernetes | Y | |
| Supports High Availability (HA) | Y | |
| Simulation mode for connectors | Y | |
| Simulation mode for email | Y | |
| Localization languages | 5 | 13 |
| Support | Community | Commercial |
Let’s Connect
Managing identity can be complex. Let OpenIAM simplify how you manage all of your identities from a converged modern platform hosted on-premises or in the cloud.
For 15 years, OpenIAM has been helping mid to large enterprises globally improve security and end user satisfaction while lowering operational costs.