Security and Identity
Domain 3 covers authentication, authorization, certificates, and secrets. The exam separates “who can log in” from “what they can do.”
Authentication
Cloud Pak for Data uses IBM Cloud Pak foundational services IAM. Administrators configure an identity provider: LDAP, SAML, or OIDC. The identity broker maps IdP groups to Cloud Pak for Data roles. The initial admin is created during setup; afterward, use named accounts and groups.
Authorization
Platform roles (Administrator, Editor, Viewer) control administrative actions. Project roles control collaboration inside a project. Service-specific roles control capabilities such as catalog curation or deployment. API keys authenticate automation and inherit the owning user’s permissions, so scope them narrowly.
Worked example
A data engineer authenticates successfully but cannot open a project. Authentication is proven by the successful login. Check project membership first: the user may be in the organization but not added to that project. If membership exists, inspect the role: Viewer cannot edit assets. Only then check IAM group mapping and token claims.
Traps
Granting platform Administrator to avoid project-level troubleshooting. Assuming LDAP group names equal IAM role names. Letting certificates expire because only pod status was monitored. Storing credentials in plain ConfigMaps instead of secrets.