Identity Management (IdM) is the centralized management of identities in IT systems. It enables the right people to access the right resources, at the right time, for the right reasons and with full accountability. IT systems are typically heterogeneous and accessible over an internal network. Management is performed by administrator intervention in IdM or by automated processes.
What is identity?
An identity is an electronic representation of a person or object (such as a computer or phone) from the real world. Identity Management in IT centrally manages identity access to resources (accounts, vpn, certificates) across managed IT systems.
What is Identity Manager?
Identity Manager is a software tool that provides identity management. It is a process tool that has a communication interface to many managed systems. Identity Manager integrates managed systems and allows processes to be executed over them and accounts to be managed. IdM includes synchronization tools for data transfer, auditing and reporting functions, and of course a user interface that allows you to delegate responsibility for certain tasks to users.
Why IdM?
What are the common problems that IdM helps solve?
- We don’t have an overview of who has access to where.
- It takes a long time to manually create an account and set up rights.
- It is time consuming to get supporting documentation for audit control.
- Users can’t simply request accesses themselves and have a supervisor approve.
- Administrators are overwhelmed with the routine work of setting up accesses.
- Accounts remain that should no longer be in the system.
In principle, IdM provides several basic objectives:
- It automates routine identity management processes. Relieves administrators from routine processes.
- Centralizes systems under a single administration – you get visibility into access across systems. You identify a person across systems.
- Delegate account management to business owners. I.e. for example, supervisors request and approve access to CRM. Administrators should be developing systems, not approving whether a requester should have a given access there.
- Record, audit operations over accounts and rights. They quickly get the basis for IT audits.
- Increases security by preventing dead souls from existing, for example. It no longer happens that an employee after termination of the contract still has access to the system and can take data away.
Benefits of IdM by role?
For regular users
- Reset passwords to all systems from one place.
- Request accesses without having to contact the IT helpdesk.
- Overview of permissions (where I can go, who approved it, when I got access, who is waiting for approval).
- Overview of my working hours and established rights.
- Quick onboarding with automatic access assignment
For supervisors
- Overview of subordinates’ rights + ability to change or request changes without IT intervention
- Reset a subordinate’s password, e.g. if they have forgotten their password
- Time limitation of rights e.g. for freelancers, automatic notifications
For IT security.
- Central audit tool for accounts in the company
- Approval of roles based on their importance.
- Controlled cancellation of accounts after an employee leaves, avoiding dead souls.
- Meeting security standards in terms of user rights management.
For IT staff
- Automation of manual administration (elimination of operations) – saving time
- Clear overview of accounts and permissions across the company
- Significant simplification of the preparation of audit documents
For management
- Saving time of competent staff
- IT can focus on maintenance and development of the environment, not on operations.
- Reduction in the number of help desk requests.
- Increased security of sensitive data, especially after an employee leaves or is reassigned
What accounts does IdM manage?
IdM can manage all accounts because different processes can be set up for each type of account. What accounts does it make sense to manage? Integrating and automating even with IdM costs some investment. It probably doesn’t make sense to automate a process that is rarely applied to a minimum number of accounts. Such a process can probably be done more cheaply by an administrator.
Account groups:
- Employees – usually an identity is created at the beginning of a contract period that is loaded into IdM from HR.
- Externals – customers, suppliers, students, etc. They access systems using VPNs, often using certificates. The IdM web interface can be used to create identities.
- Technical and service accounts – for example, administrator or application accounts. These accounts are usually not allowed to become obsolete after the account owner has left. They cannot be subject to normal employee HR processes. They have their own agenda processes. IdM can also handle the password handover agenda.
What objects does IdM handle?
- Identities, accounts, roles, groups, folders, organizational structure, time sheets, certificates, photos, role catalog, SW licenses, vpn accesses…
What processes does IdM provide?
One of the main benefits of IdM is automation. Different types of processes for different types of identities are used for this purpose.
Process types:
- Automated employee processes:
– Employee onboarding and identity creation, time creation,
– Change of organizational assignment within a job
– Change of descriptive attributes (phone, address, etc.)
– Exemption from registration number (maternity/parental)
– Termination of employment, loss of identity. - Manual interventions – access requests, vpn, certificate and request approval, manual account creation by administrator, etc.
- Automatic synchronisation – accounts, roles, timesheets, organisational assignments,
- Reporting – reports for audits, monthly reports, etc. basis for recertification of accesses,
What is Role Based Access Control (RBAC)?
IdM uses rights setting based on role assignment, RBAC – Role-Based Access Control. It is the basic functional mechanism of IdM. When I am assigned a role, it typically means that I have gained access to the system or some specific permission on the system, such as being assigned to an MS Active directory group.
IdM manages the following types of roles:
- Application roles – I have a role, I have access to an application or a specific right in an application.
- Access roles in IdM – I have a role, I have some higher authority to work in Identity Manager. For example, I can approve someone’s rights.
- Business roles – group the above. For example, the “secretary” role has roles for the Attendance system and Helpdesk.
- According to the type of assignment:
– Automatic – for example, based on organization affiliation, time or based on an attribute near the identity.
– Manually by an administrator or based on a request and approval by an authorized person (supervisor, business owner of the role, etc.).
Interesting features of the roles:
- Role Guarantor – typically approves the role assignment, can assign the role himself.
- Different approval workflows for roles – based on importance/criticality.
- Time-limited role assignments – for example VPN for freelancers or for the duration of the project.
- Separation of duties (SoD) – separation of responsibilities in managed applications, possibility to introduce the principle of multiple eyes in multi-round approval.
- Merging of roles into business roles
- Automatically assigned roles by organizational structure or attribute (e.g. all doctors).
- Synchronization of roles from an external source – often MS AD groups or LDAP groups.
- Exporting roles to a managed system
- Role cataloguing – simplifies role selection for the user in the role request.
- Role reporting – who has what role and how they obtained it (automatically, manually).
Support for managed systems?
Any system that is accessible over the network and has a known (or discoverable) identity structure can be connected to IdM. The above may give the impression that connecting end systems to an IdM system must require considerable customization to support identity management. The opposite is true. A major benefit of IdM is the ease of connecting an end-system without the need for customization or even rebooting. How to do it? More general approaches are used, which include so-called identity connectors.
A connector is a small software tool on the IdM side that allows data exchange with the connected system using its native API. Thus, the connector adapts to the connected system, not the other way around.
Connectors generally provide methods for:
- creating a new user account, or a group, role, organization, etc.
- edit an existing user account
- delete a user account
- reading a user account
- listing all accounts
- searching for accounts according to the selected filter (for example, only the one that has changed since the last search)
List of connectors?
Ask your supplier. Usually the list of supported systems is very extensive. If you don’t have a local system, it will be supported.
What to look out for with the offered connector?
- Whether the connector supports your version of the managed system.
- What features/operations the connector supports. For example, whether it supports account lockout, password change, or change synchronization.
- What objects in the end system it supports. For example, connectors for Active Directory often do not support group management.
- Licensing restrictions, because the cost of the connector may not be low.
Virtual or indirectly managed systems
More modern Identity Managers offer so-called virtual connections. A virtual system is one on which the IdM does not directly manage user accounts. Instead, an email notification is sent to the administrators of that system to perform the requested action (creating a user account, modifying account attributes, deleting a user account) manually and confirm the completion in IdM.
You get central identity lifecycle support and central role management for a large number of systems cheaply and quickly.
Virtual systems find applications where, for example:
- a given system cannot be connected directly for technical reasons,
- direct connection of the system is not economically viable, for example, there are only units of accounts in the system,
- or it is desirable to first connect the system as a virtual system to verify the correct functionality of the connection.
The user interface must be easy to understand for administrators.
What is not IdM?
Account centralization in Active Directory (AD) is not Identity Management by the definition of this article because AD does not offer it:
- An interface for requesting and approving access.
- Auditing who approved what and why an account has the rights it has.
- Delegation of actions to business owners.
- Ability to integrate with APIs of other systems – to integrate the system with Active Directory, the application must be ready or customized. Such customization is possible, but tends to be laborious and expensive.
Further, by definition above, it cannot be used as an IdM:
- Access Manager – This typically handles the central authentication and authorization of users across systems, not the process of assigning rights.
- Intrusion and detection SW and Monitoring tools – Addresses online or periodic reporting of current system status, but does not address actual rights management for the system.
Conclusion?
Identity Manager can be a great tool to help you get your identities in order – to centralize, automate and secure the management of accounts and their rights in IT systems. Identity Manager can also be financially rewarding for mid-sized companies struggling with the complexities of identity management. Modern Identity Managers, with their simplicity and multitude of features, enable rapid deployment into production operations and the gradual building of a central security element of a company’s IT infrastructure.
