Automated User Provisioning and Deactivation - Hitachi ID Identity Manager
Hitachi ID Identity Manager can monitor one or more systems of record on a periodic basis
(e.g., nightly or every few hours), enumerating new, deleted
and changed users. In the case of an HR application, for example,
these changes may represent new hires, terminations and transfers.
Auto-discovery is performed on all integrated systems and applications
-- not just systems of record.
Changes detected by Identity Manager are passed through a data filter,
which removes users that are outside Identity Manager's scope.
For instance, in a scenario where Identity Manager manages all users
in one country, but the HR system is global, Identity Manager would
ignore changes to users from other countries.
All changes to a given user are aggregated and business logic is
executed, with the set of changes as input. This is best illustrated
with some examples:
|
Detected change
|
Actions
|
Net result
|
|
New user appears in an HR application.
|
- Lookup appropriate role based on the user's location and job code.
- Submit a change request to the Identity Manager workflow engine, to
create a new user, with the HR-provided identity attributes and
with resources specified by the role.
|
Auto-provisioning.
|
|
New phone number detected on white pages directory.
|
- White pages has a higher priority for the phone number attribute
than other systems.
- Submit a change request to the Identity Manager workflow engine, to
change the phone number in the user's profile.
- Once approved (most likely automatically), the new phone number
is mapped to other login IDs belonging to the user and connectors
are run to update this information on other systems.
|
Identity synchronization.
|
|
Change to termination date is detected on the HR system.
|
- Using the identity synchronization mechanism described above,
set this date on the user's profile.
- A separate batch process periodically identifies users with
today or earlier termination dates and submits requests to
disable all accounts for every matching user.
|
Automated termination.
|
|
User disappears from system of record (HR).
|
- Lookup all of a user's login IDs.
- Submit a "disable all accounts" change request to the Identity Manager
workflow engine.
- Given the source of the request (employee gone from HR), this
type of change may be auto-approved.
|
Automated termination (2nd method).
|
|
User was added to Administrators group on Active Directory domain.
|
- Since the change was detected on AD, it follows that it was not
initiated by Identity Manager.
- Submit two change requests to the workflow engine:
- Remove the user from the Administrators group (this is an
auto-approved change).
- Add the user from the Administrators group (requires approval).
- Create a security incident in the help desk system.
|
Detect unauthorized privilege escalation.
|
Collectively, these processes are known as automated user management.
They are implemented by the ID-Track component in Identity Manager.
Watch a Movie
Automatic provisioning (scheduled batch process)
|
Play movie
|
Content:
- A new employee is added to an HR application.
- A batch process is triggered manually (just for demos -- normally
it is scheduled).
- Accounts for the new user are automatically created on AD and
elsewhere.
|
Key concepts:
- Automation is typically a batch process that runs at least once
daily.
- Business logic determines what to do when user records are added to,
removed from or changed on each system of record.
- Most suitable for coarse-grained (i.e., hire/fire) changes detected
on HR systems.
- Can also automate synchronization of identity attributes between
systems.
|
Automatically provisioning new employees
|
Play movie
|
Content:
- HR creates new employees in the HR system.
- HiIM detects the changes and requests network and application access.
- Managers approve requests and new accounts are created.
|
Key concepts:
- Leverage HR input to automatically create and delete logical access.
- Manager approval can be used if HR is not totally authoritative.
|
Scheduling and automating access deactivation
|
Play movie
|
Content:
- A termination date is scheduled for a contractor.
- HiIM reminds the manager that the date can be changed before it passes.
- Access is automatically disabled on the termination date.
- Accounts are deleted at a later date.
|
Key concepts:
- Lifecycle events, such as hires and terminations, can be scheduled.
- Sequences of events, such as advance warnings before the termination
date and actual deletion at a later date, are also automated.
|
