The Challenge of User and Access Management

User self-service allows users to perform simple user-oriented identity management tasks that must typically be carried out by technical IT administrators in the traditional enterprise IT infrastructure. With self-service, users can register themselves with enterprise services, manage their own data, including their own passwords, and request roles, which model user access rights to enterprise resources for themselves. User self-service allows the enterprise to put common, frequently recurring identity management tasks like password resets and user profile updates into the hands of the users themselves, rather than IT, hotline, and help desk staff.

Delegated administration allows users to grant other users the right to perform their identity management tasks (or a subset of these tasks). Delegation allows an enterprise to distribute identity management tasks according to business functions and to create a hierarchy for identity management that reflects its business structure. The enterprise can use delegated administration to balance the user management and access rights administration load across both IT and non-IT departments according to areas of responsibility and expertise.

Password management allows users to maintain a single password that will automatically be synchronized to all relevant IT systems in the enterprise. Password management functions permit users to reset forgotten passwords themselves through challenge-response procedures (or request an administrator reset), change their passwords in one or more systems, for example, in an LDAP directory or in Windows, notify users when they need to change their passwords to comply with password policies established for the enterprise (for example, expiration of a password’s lifetime), and synchronize these password changes in real time to all the relevant IT systems.

User management includes all the activities related to the creation, maintenance and use of user accounts, user attributes, roles, entitlements and other data encompassing the different directories, user databases, and application-specific repositories that make up the fragmented, heterogeneous enterprise IT environment. User management consists of two main tasks: maintaining an accurate and up-to-date directory of users to be provisioned and assigning users to roles. Maintaining a consistent user directory is handled by request processes from the users themselves and/or their managers (user self-service and delegated administration) and by data synchronization workflows (for example, with the enterprise HR system) provided by the metadirectory. User facets, personas and functional users extend the user for alternative representations of users and assigned resources.

A role is a set of access rights based on either business semantics or on IT-system specific semantics that permits users to access enterprise IT resources. In a role-based access control (RBAC) model, access rights to IT systems and resources are controlled by roles, which in turn are associated with or assigned to users. The enterprise can structure its roles in a hierarchical model according to its business roles and functions or other considerations. The role concept establishes a logical layer for the modeling and management of access control information that is generic enough to cover many IT systems' access control methods, such as:

Role-based access management allows access control on each IT system to be managed in a uniform way. Role management also simplifies and structures access rights administration. High-level managers can assign roles to their staff without needing to know the IT-specific details, and IT personnel can administer the access rights in the IT systems without needing to know the business details. The assignment of roles to users can be partially automated with the help of security policies and their associated rules.

A certification campaign is the identity governance process of periodically checking user-privilege and privilege-user assignments to ensure that these assignments continue to comply with enterprise business policies. Certification campaigns specify the privileges or users and assignments to be certified, how often the certification is to take place, and who is to perform the certification. Compliance officers can monitor the certification campaign’s progress and generate reports on the completed campaign. Certification campaigns allow the enterprise to verify that access rights to its IT systems - especially security-sensitive systems - remain properly granted to its user community over time, satisfying compliance regulations and mitigating risk.

A business object is a collection of data related to a business structure in the enterprise such as an organization, a cost center or a project. Business objects in an identity management system serve two main functions:

Changes to the information in the business object – including references to roles – are automatically propagated to the users linked to the business object.

Business objects offer a way to view identities from different perspectives: for example, all people in a particular location, all members of a specific organizational unit, or all people that belong to a particular cost center. Because business objects locate data centrally instead of at individual user entries, they allow for easier data cleansing and maintenance. Finally, automatic user-role assignment via links to business objects has become a popular method for role assignment.

Policy management refers to the creation and maintenance of policies that reflect the enterprise’s security and administrative policies and their associated rules and which help to govern, automate and control identity management processes. A policy is composed of one or more rules; each rule identifies the entities - for example, a set of users, or a set of resources - to which the rule applies, the action to be taken, such as assigning one or more roles, and a priority level that is used to resolve conflicts with other rules. Policies can be applied to governance-level functions such as password creation and maintenance, role assignment, and segregation of duties (user-role assignments that constitute conflicts of interest), to provisioning-level functions like user data consolidation and reconciliation (periodic comparison of IT system data and its representation in the IAM system) and to audit-level functions to control how identities and their access rights are monitored. Policies help to control and automate identity management tasks, reducing error-prone manual administration and help to guarantee compliance with internal and external regulations.

Request workflows provide the process control mechanism that supports user self-service and delegated administration activities. Request workflows allow users to create identity management data like users or roles, request or assign resources, such as access to a company newsletter or a file share, and optionally authorize these requests according to the access policies in force in the enterprise. When a request needs approval, the request workflow notifies each person in the defined approval path - for example, by email - and each approver uses a Web browser to access a Web interface to accept or reject the request. When access policies require re-authorization of a resource at a given interval, for example, quarterly re-approval of a financially sensitive role assignment, request workflows automatically enforce compliance by re-notifying the appropriate approvers; failure to re-approve leads to automatic unassignment. Request workflows allow the enterprise to handle all of the business processes associated with identity management in a well-defined, controlled and automated way.

Provisioning is the fully automated, real-time process of calculating user access rights and distributing them to IT systems based on the roles assigned to the user. The provisioning process automatically and instantaneously grants, changes, and revokes access rights in IT systems in response to role assignment, re-assignment, and revocation. Provisioning automates the time-consuming process of managing access rights across many different IT systems over the user life-cycle and permits fast activation and de-activation of access rights across these systems for multiple user identities.

Provisioning provides a single point of administration for the enterprise’s total identity and access control information and implements the services that keep the identity and access control data in the IT systems consistent and up-to-date, allowing the enterprise to ensure the security of its data, reduce administration overhead, accelerate its business processes and improve its customer service, and protect its investments in existing IT systems.

Reconciliation is the process of periodically comparing the access rights data in an IT system to the IAM system’s central repository - its identity store - to detect local changes to the IT system data that have occurred independently of changes initiated by the IAM system. Deviations can be explicitly reconciled by hand or automatically and periodically by reconciliation policies. Reconciliation ensures the integrity of access rights data across the enterprise, a key element of compliance.

Metadirectory is the set of services that integrates the disparate directories, user databases, and application-specific information repositories in the enterprise IT network into a centralized data store and provides the connectivity, management and interoperability functions that unify the user data ("join") and ensure the bidirectional attribute flow (synchronization) in this fragmented environment.

In an IAM system, the metadirectory provides an infrastructure for automated enterprise-wide user management that addresses the problem of decentralized multiple user identities and user administration functions. Metadirectory services:

Authentication is the process of identifying users and validating their identity. Various authentication methods can be used, including basic authentication using username/password, secure tokens, digital certificates and smart cards. Authentication ensures that users are properly identified and that these identities are validated to the enterprise’s resources. Single sign-on (SSO) permits a user to access multiple IT systems and applications after being authenticated just one time. Web SSO uses encrypted cookies to store user authentication and session information, which permits users to access enterprise resources over Web-based applications without the need to re-authenticate.

Authorization is the real-time enforcement of user access requests to the enterprise resources. Authorization ensures that users can only access the IT systems in the enterprise and the corresponding resources according to their access rights. Access decisions can be based on centralized access control policies.

Identity federation permits an enterprise to share trusted identities with autonomous organizations outside of the enterprise, like trading partners or suppliers. The goal of federation is to integrate identity information across enterprise boundaries to allow the enterprise to build business communities.