Creating a Realm for Organization Admins | Teradata VantageCloud Lake - Associating Realms with Organization Admins - Teradata VantageCloud Lake

An organization admin realm uses your corporate identity provider and the organization admin's single sign-on credentials to access VantageCloud Lake. When you create an organization admin realm, your organization maintains control over its administrative credentials, helping protect sensitive data and administrative functions from unauthorized access.

• Only one organization admin realm can be created per organization.
• If the organization admin realm option is grayed out, one has already been created.
• Organization admins will no longer have access to VantageCloud Lake environments once single sign-on is enabled and required for organization admins. The admin will need to sign out and back in as a database user or dba.
• Configure group claim mapping in your Identity Provider for a successful authentication.

1. As an organization admin, select from the menu Home > Manage access > Identity providers > Realms tab and select the Organization admin realm option.
   
   
   
2. Enter a name and description for the realm.
3. Select an identity provider from the menu or select Add an identity provider.
4. Add a restricted group or keep Use defaults.
5. At this point, select Save realm and test the realm by doing the following:
   • Verify the identity provider configuration is correct and functional.
   • Confirm the restricted group mappings are correct.
   • Verify that the realm permissions work as expected.
   • Test that users outside the restricted groups cannot access the organization admin functions.
   • Do a thorough test that all organization admins can access the system using their single sign on credentials.
6. Once completed, sign back in as with your single sign-on credentials, go back to the Realms tab and enable the Require organization admins to sign in using SSO option.
   Important: Do not enable Require organization admins to sign in using SSO here.

   
   
   
7. Once completed, sign back in as with your single sign-on credentials, go back to the Realms tab and enable the Require organization admins to sign in using SSO option.
   Important: Once this option is enabled, organization admins will no longer be able to sign on to the system using the Teradata managed credentials. They will also not have access to any environments but can still create and manage them from an organization admin role.