Resource Center
Hitachi ID Facebook Page Hitachi ID Twitter Page Find us on Google+ Hitachi ID YouTube Page

Automated User Account Creation

Automated user account creation is one of multiple scenarios included in a more general automated administration system.

Automated user management works by monitoring one or more systems of record and waiting for changes to user profile data. Detected changes are then:

  1. Filtered, so that only changes within the scope of the system remain.
  2. Transformed, from the data format of the system of record, to the data format of the identity management and access governance system and of the target systems.
  3. Forwarded, from the identity management and access governance system to target systems.

Some examples of auto-provisioning/auto-deactivation are:

  1. Payroll staff create a record for a new hire in the HR application. The user provisioning system detects this event, notes that it is in scope and reformats the event into workflow requests to create a Windows/AD account, an Exchange mailbox and a mainframe login ID.

  2. HR staff set a termination date for an employee in the HR application. The user provisioning system detects this and sets the same date in the user's IAM profile. A batch process runs nightly and automatically submits "deactivate all accounts" workflow requests for every user whose termination date has passed.

  3. A rogue administrator adds his accomplice's login account to the Domain Admins AD group. The user provisioning system detects this new group membership, removes the user from the group and sends an SMS message describing what it detected to a security officer.

figure

    Automatic Propagation of Changes in User Profile Data (1)

Hitachi ID Identity Manager can monitor one or more systems of record on a periodic basis (e.g., nightly or every few hours), enumerating new, deleted and changed users. In the case of an HR application, for example, these changes may represent new hires, terminations and transfers. Auto-discovery is performed on all integrated systems and applications -- not just systems of record.

Changes detected by Identity Manager are passed through a data filter, which removes users that are outside Identity Manager's scope. For instance, in a scenario where Identity Manager manages all users in one country, but the HR system is global, Identity Manager would ignore changes to users from other countries.

All changes to a given user are aggregated and business logic is executed, with the set of changes as input. This is best illustrated with some examples:

Detected change

Actions

Net result
New user appears in an HR application.

  • Lookup appropriate role based on the user's location and job code.
  • Submit a change request to the Identity Manager workflow engine, to create a new user, with the HR-provided identity attributes and with resources specified by the role.

Auto-provisioning.
New phone number detected on white pages directory.

  • White pages has a higher priority for the phone number attribute than other systems.
  • Submit a change request to the Identity Manager workflow engine, to change the phone number in the user's profile.
  • Once approved (most likely automatically), the new phone number is mapped to other login IDs belonging to the user and connectors are run to update this information on other systems.

Identity synchronization.
Change to termination date is detected on the HR system.

  • Using the identity synchronization mechanism described above, set this date on the user's profile.
  • A separate batch process periodically identifies users with today or earlier termination dates and submits requests to disable all accounts for every matching user.

Automated termination.
User disappears from system of record (HR).

  • Lookup all of a user's login IDs.
  • Submit a "disable all accounts" change request to the Identity Manager workflow engine.
  • Given the source of the request (employee gone from HR), this type of change may be auto-approved.

Automated termination (2nd method).
User was added to Administrators group on Active Directory domain.

  • Since the change was detected on AD, it follows that it was not initiated by Identity Manager.
  • Submit two change requests to the workflow engine:
    • Remove the user from the Administrators group (this is an auto-approved change).
    • Add the user from the Administrators group (requires approval).
  • Create a security incident in the help desk system.

Detect unauthorized privilege escalation.

 

Collectively, these processes are known as automated user management. They are implemented by the ID-Track component in Identity Manager.

Return to Identity Management Concepts