{"id":6630,"date":"2023-06-23T10:33:51","date_gmt":"2023-06-23T08:33:51","guid":{"rendered":"https:\/\/www.idstory.com\/?p=6630"},"modified":"2026-08-20T15:28:32","modified_gmt":"2026-08-20T13:28:32","slug":"jak-pripravit-projekt-identity-managementu","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/jak-pripravit-projekt-identity-managementu\/","title":{"rendered":"Jak p\u0159ipravit projekt Identity Managementu (aktualizace 2026)"},"content":{"rendered":"<p>Stoj\u00edte p\u0159ed rozhodnut\u00edm, jak p\u0159ipravit projekt Identity Managementu (IdM), a pot\u0159ebujete poradit? Tento \u010dl\u00e1nek popisuje, jak projekt Identity Managementu p\u0159ipravit. Motivac\u00ed \u010dl\u00e1nku je srozumitelnost a jednoduchost, nikoli detailn\u00ed popis anal\u00fdzy konkr\u00e9tn\u00edho nasazen\u00ed. K tomu jsou ur\u010deny jin\u00e9 na\u0161e \u010dl\u00e1nky. Sou\u010d\u00e1st\u00ed \u010dl\u00e1nku je i praktick\u00e1 uk\u00e1zka dat na stran\u011b p\u0159ipojovan\u00fdch syst\u00e9m\u016f.<\/p>\n<p><em>\u010cl\u00e1nek jsme v roce 2026 z\u00e1sadn\u011b aktualizovali. Nejv\u011bt\u0161\u00ed zm\u011bny oproti p\u016fvodn\u00ed verzi: implementace s pomoc\u00ed AI, bezpe\u010dnostn\u00ed po\u017eadavky vych\u00e1zej\u00edc\u00ed z NIS2, kombinace IdM + PAM, nasazen\u00ed ve skupin\u00e1ch firem a hybridn\u00ed prost\u0159ed\u00ed Active Directory + Entra ID.<\/em><\/p>\n<h2>Jak\u00e9 jsou c\u00edle projektu?<\/h2>\n<p>Ur\u010dete c\u00edle projekt konkr\u00e9tn\u011b, srozumiteln\u011b a m\u011b\u0159iteln\u011b. Co v\u00e1s p\u00e1l\u00ed? Co chcete IdM projektem vy\u0159e\u0161it? P\u0159esn\u011b vydefinovan\u00e9 c\u00edle jsou z\u00e1sadn\u00ed pro \u00fasp\u011b\u0161nost projektu. P\u0159i tvorb\u011b zad\u00e1n\u00ed se na n\u011b s klientem v\u017edy soust\u0159ed\u00edme.<\/p>\n<p>P\u0159\u00edklady spr\u00e1vn\u00fdch c\u00edl\u016f:<\/p>\n<ul>\n<li>rychlost zakl\u00e1d\u00e1n\u00ed \u00fa\u010dt\u016f pro nov\u00e9 zam\u011bstnance (n\u00e1stup v \u0159\u00e1du hodin, ne dn\u016f),<\/li>\n<li>delegace rozhodov\u00e1n\u00ed o p\u0159\u00edstupech na vlastn\u00edky dat a aplikac\u00ed,<\/li>\n<li>bezpe\u010dnost: zamezen\u00ed osi\u0159el\u00fdm a zapomenut\u00fdm \u00fa\u010dt\u016fm (tzv. mrtv\u00fdm du\u0161\u00edm),<\/li>\n<li>samoobsluha u\u017eivatel\u016f: reset hesel, \u017e\u00e1dosti o pr\u00e1va,<\/li>\n<li>compliance: schopnost auditorovi dolo\u017eit, kdo m\u00e1 k \u010demu p\u0159\u00edstup a pro\u010d; typicky to dnes \u017eene NIS2 a z\u00e1kon o kybernetick\u00e9 bezpe\u010dnosti.<\/li>\n<\/ul>\n<p>Existuj\u00ed r\u016fzn\u00e9 pot\u0159eby, r\u016fzn\u00e9 c\u00edle. Zamezte o\u010dek\u00e1v\u00e1n\u00ed: \u201e<em>IdM jako magick\u00fd n\u00e1stroj n\u00e1m vy\u0159e\u0161\u00ed v\u0161e<\/em>&#8222;. IdM magick\u00fdm n\u00e1strojem je, ale je t\u0159eba jej nam\u00ed\u0159it na konkr\u00e9tn\u00ed probl\u00e9my.<\/p>\n<h2>Jak AI m\u011bn\u00ed projekt IdM<\/h2>\n<p>Nejv\u011bt\u0161\u00ed posun od prvn\u00edho vyd\u00e1n\u00ed tohoto \u010dl\u00e1nku p\u0159inesla AI. Nejd\u0159\u00edv jedno vyjasn\u011bn\u00ed: <strong>AI nesm\u00ed rozhodovat o p\u0159id\u011blov\u00e1n\u00ed p\u0159\u00edstup\u016f.<\/strong> Rozhodnut\u00ed, kdo dostane jak\u00fd \u00fa\u010det a opr\u00e1vn\u011bn\u00ed, mus\u00ed z\u016fstat v rukou lid\u00ed a deterministick\u00fdch, auditovateln\u00fdch pravidel. Role schvaluje vedouc\u00ed nebo garant role, automaticky p\u0159id\u011bluje politika a ka\u017ed\u00e9 rozhodnut\u00ed nech\u00e1v\u00e1 auditn\u00ed stopu. \u017d\u00e1dn\u00fd regul\u00e1tor, a up\u0159\u00edmn\u011b ani \u017e\u00e1dn\u00fd bezpe\u010dnostn\u00ed t\u00fdm, nep\u0159ijme odpov\u011b\u010f \u201erozhodl to model&#8220;.<\/p>\n<p>Kde AI naopak skute\u010dn\u011b z\u00e1\u0159\u00ed, je rychl\u00e9 zaveden\u00ed syst\u00e9mu do produk\u010dn\u00edho provozu. P\u0159edpokladem je kvalitn\u00ed produktov\u00e1 dokumentace, ide\u00e1ln\u011b dostupn\u00e1 online. Z dobr\u00e9 dokumentace vytvo\u0159\u00edte kvalitn\u00ed <strong>Skill<\/strong> (znalostn\u00ed bal\u00ed\u010dek, kter\u00fd si AI asistent na\u010dte a pracuje s n\u00edm). Od t\u00e9 chv\u00edle v\u00e1m AI slou\u017e\u00ed jako konzultant:<\/p>\n<ul>\n<li>pom\u00e1h\u00e1 napojovat syst\u00e9my \u2014 navrhuje mapov\u00e1n\u00ed atribut\u016f a p\u00ed\u0161e transforma\u010dn\u00ed skripty,<\/li>\n<li>tvo\u0159\u00ed u\u017eivatelsk\u00e9 p\u0159\u00edru\u010dky a n\u00e1vody pro administr\u00e1tory p\u0159esn\u011b podle va\u0161\u00ed konfigurace,<\/li>\n<li>p\u0159ipravuje testovac\u00ed sc\u00e9n\u00e1\u0159e a pom\u00e1h\u00e1 ladit synchronizace,<\/li>\n<li>odpov\u00edd\u00e1 na ot\u00e1zky typu \u201ejak ud\u011bl\u00e1m\u2026&#8220;, kter\u00e9 by jinak skon\u010dily jako ticket u dodavatele.<\/li>\n<\/ul>\n<p>Praktick\u00fd d\u016fsledek: <strong>projekt bude levn\u011bj\u0161\u00ed, proto\u017ee nebudete tolik z\u00e1visl\u00ed na implement\u00e1torovi.<\/strong> Va\u0161i administr\u00e1to\u0159i zvl\u00e1dnou podstatn\u011b v\u011bt\u0161\u00ed \u010d\u00e1st konfigurace sami a konzultanti dodavatele se soust\u0159ed\u00ed na skute\u010dn\u011b t\u011b\u017ek\u00e9 \u010d\u00e1sti.<\/p>\n<h2>Co si p\u0159ipravit v projektov\u00e9m \u0159\u00edzen\u00ed?<\/h2>\n<p>Mus\u00edte m\u00edt jasno hlavn\u011b v zad\u00e1n\u00ed. Zn\u00ed to samoz\u0159ejm\u011b, ale velmi \u010dasto se setk\u00e1v\u00e1me s v\u00e1gn\u00edm zad\u00e1n\u00edm.<\/p>\n<p>Vyhn\u011bte se fixn\u00edmu zad\u00e1n\u00ed u velk\u00fdch projekt\u016f. To je historicky ov\u011b\u0159en\u00fd postup vedouc\u00ed k ne\u00fasp\u011bchu. Nepotkali jsme projekt IdM, kter\u00fd by se obe\u0161el bez zm\u011bnov\u00e9ho \u0159\u00edzen\u00ed. Projekty Identity Managementu jsou integra\u010dn\u00edmi projekty, u kter\u00fdch je extr\u00e9mn\u011b n\u00e1ro\u010dn\u00e9 a\u017e nemo\u017en\u00e9 p\u0159edem v\u0161e analyzovat a navrhnout. \u010c\u00edm v\u011bt\u0161\u00ed projekt a del\u0161\u00ed realizace, t\u00edm v\u00edc zm\u011bn v syst\u00e9mech, organizaci i v projektu samotn\u00e9m vznikne. Vytvo\u0159te si prostor na zm\u011bny. I se st\u00e1tn\u00edm v\u00fdb\u011brov\u00fdm \u0159\u00edzen\u00edm to jde.<\/p>\n<p>Agiln\u00ed zp\u016fsob v\u00fdvoje a implementace softwaru je spr\u00e1vnou cestou. Organizace se dnes rychle m\u011bn\u00ed a projekt pot\u0159ebuje prostor na n\u011b reagovat. Agiln\u00ed veden\u00ed projektu je v\u00fdrazn\u011b vhodn\u011bj\u0161\u00ed.<\/p>\n<p>Ka\u017ed\u00fd projekt mus\u00ed m\u00edt:<\/p>\n<ol>\n<li><strong>Zad\u00e1n\u00ed rozsahu<\/strong> \u2014 alespo\u0148 prvn\u00edho produktu (prototypu, MVP). Zad\u00e1n\u00ed mus\u00ed vych\u00e1zet z probl\u00e9m\u016f, kter\u00e9 m\u00e1 projekt a n\u00e1sledn\u00e9 \u0159e\u0161en\u00ed pomoci vy\u0159e\u0161it. Jak\u00e9 syst\u00e9my chcete Identity Managementem spravovat? Za\u0159a\u010fte tyto syst\u00e9my do zad\u00e1n\u00ed jako orienta\u010dn\u00ed, a\u0165 je lze zm\u011bnit bez z\u00e1sahu do smlouvy! Potkali jsme mnoho p\u0159\u00edpad\u016f, kdy firma vypsala v\u00fdb\u011brov\u00e9 \u0159\u00edzen\u00ed na spr\u00e1vu konkr\u00e9tn\u00edch syst\u00e9m\u016f a pak bylo pot\u0159eba jeden z nich v pr\u016fb\u011bhu vym\u011bnit. Dejte projektov\u00e9mu t\u00fdmu smluvn\u00ed pravomoc zad\u00e1n\u00ed upravovat.<\/li>\n<li><strong>Rozpo\u010det<\/strong> \u2014 kolik celkem chcete investovat? Dejte rozpo\u010det jako strop, ze kter\u00e9ho se bude agiln\u011b \u010derpat.<\/li>\n<\/ol>\n<p>D\u00e1le je t\u0159eba vydefinovat:<\/p>\n<ol>\n<li>projektov\u00fd v\u00fdbor \u2014 kdo na projektu bude pracovat. Ano, jsou pot\u0159eba i z\u00e1stupci odb\u011bratele: projektov\u00fd vedouc\u00ed, IdM administr\u00e1tor nebo produktov\u00fd vedouc\u00ed, voliteln\u011b administr\u00e1to\u0159i napojovan\u00fdch syst\u00e9m\u016f,<\/li>\n<li>projektov\u00e9 sch\u016fzky \u2014 1\u00d7 t\u00fddn\u011b nebo 1\u00d7 za dva t\u00fddny,<\/li>\n<li>risk log,<\/li>\n<li>harmonogram.<\/li>\n<\/ol>\n<h2>Dva a\u017e t\u0159i syst\u00e9my pro z\u00e1kladn\u00ed projekt<\/h2>\n<p>D\u0159\u00edve zn\u011bla standardn\u00ed rada jednodu\u0161e: \u201evyberte si 2\u20133 syst\u00e9my k prvn\u00edmu napojen\u00ed.&#8220; To pro prvn\u00ed f\u00e1zi plat\u00ed po\u0159\u00e1d, ale dnes doporu\u010dujeme za\u010d\u00edt o krok d\u0159\u00edv: <strong>zmapujte v\u0161echny syst\u00e9my ve va\u0161\u00ed organizaci.<\/strong> Ud\u011blejte si inventuru a rozt\u0159i\u010fte ji:<\/p>\n<ul>\n<li>kter\u00e9 syst\u00e9my obsahuj\u00ed <strong>osobn\u00ed \u00fa\u010dty<\/strong> (v\u00e1zan\u00e9 na konkr\u00e9tn\u00edho \u010dlov\u011bka) a kter\u00e9 <strong>technick\u00e9 a servisn\u00ed \u00fa\u010dty<\/strong> (pat\u0159\u00edc\u00ed aplikac\u00edm, skript\u016fm a integrac\u00edm),<\/li>\n<li>kter\u00e9 z nich obsahuj\u00ed <strong>privilegovan\u00fd p\u0159\u00edstup<\/strong> \u2014 administr\u00e1torsk\u00e9 \u00fa\u010dty, infrastrukturu, datab\u00e1ze,<\/li>\n<li>kdo je vlastn\u00edkem ka\u017ed\u00e9ho syst\u00e9mu a jeho dat.<\/li>\n<\/ul>\n<p>V projektov\u00e9m pl\u00e1nu pak myslete na pokryt\u00ed <em>v\u0161ech typ\u016f<\/em> syst\u00e9m\u016f v jednotliv\u00fdch f\u00e1z\u00edch \u2014 ne jen viditeln\u00fdch syst\u00e9m\u016f s osobn\u00edmi \u00fa\u010dty, zat\u00edmco zapomenut\u00e9 servisn\u00ed \u00fa\u010dty s vysok\u00fdmi pr\u00e1vy \u017eij\u00ed d\u00e1l bez spr\u00e1vy. V prvn\u00ed f\u00e1zi napojte 2\u20133 nezbytn\u00e9 syst\u00e9my. Dal\u0161\u00ed postupn\u011b vykrystalizuj\u00ed do navazuj\u00edc\u00edch f\u00e1z\u00ed.<\/p>\n<p>Nenechte se dotla\u010dit k p\u0159ipojov\u00e1n\u00ed co nejv\u00edce syst\u00e9m\u016f najednou v jedin\u00e9m projektu. Velk\u00e9 zad\u00e1n\u00ed zpravidla v\u00fdrazn\u011b zvy\u0161uje riziko ne\u00fasp\u011bchu. P\u0159ipojujte a automatizujte to, co m\u00e1 skute\u010dn\u011b smysl. O\u010dek\u00e1vejte, \u017ee se budete postupn\u011b u\u010dit \u2014 vy i va\u0161e organizace \u2014 co je IdM a jak jej nejl\u00e9pe vyu\u017e\u00edt. Pr\u00e1v\u011b to v\u00e1m umo\u017en\u00ed agiln\u00ed veden\u00ed projektu; fixn\u00ed zad\u00e1n\u00ed naopak situaci komplikuje p\u0159edev\u0161\u00edm v\u00e1m.<\/p>\n<p>Vydefinujte si syst\u00e9my, kter\u00e9 chcete spravovat (integrovat) <strong>p\u0159\u00edmo<\/strong>, a kter\u00e9 <strong>nep\u0159\u00edmo<\/strong> (naz\u00fdv\u00e1me virtu\u00e1ln\u011b). P\u0159\u00edm\u00e1 integrace stoj\u00ed \u00fasil\u00ed, proto m\u00e1 smysl tam, kde se \u00fa\u010dty a pr\u00e1va m\u011bn\u00ed \u010dasto. Pokud v syst\u00e9mu zakl\u00e1d\u00e1te \u00fa\u010det dvakr\u00e1t do roka, sta\u010d\u00ed nep\u0159\u00edm\u00e9 napojen\u00ed virtu\u00e1ln\u00edm syst\u00e9mem \u2014 vytvo\u0159\u00edte ho do minuty a slou\u017e\u00ed jako eviden\u010dn\u00ed n\u00e1stroj (kdo m\u00e1 jak\u00fd \u00fa\u010det na syst\u00e9mu) a k \u00fakolov\u00e1n\u00ed odpov\u011bdn\u00fdch admin\u016f.<\/p>\n<h3>Studium konektor\u016f p\u0159edem nep\u0159ece\u0148ujte<\/h3>\n<p>Jedna v\u011bc, kterou dnes m\u016f\u017eete \u0159e\u0161it mnohem m\u00e9n\u011b ne\u017e p\u0159ed p\u00e1r lety: konektory. Oblast IGA a jej\u00ed n\u00e1stroje jsou dnes tak pokro\u010dil\u00e9, \u017ee obsahuj\u00ed konektory prakticky na v\u0161echna rozhran\u00ed, kter\u00e1 potk\u00e1te \u2014 REST a SOAP webov\u00e9 slu\u017eby, datab\u00e1ze p\u0159es JDBC, LDAP, PowerShell, Microsoft Graph API a dal\u0161\u00ed. Ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f lze pou\u017e\u00edt existuj\u00edc\u00ed konektor tak, jak je, nebo ho upravit podle konkr\u00e9tn\u00edho syst\u00e9mu.<\/p>\n<p>A i tady pom\u00e1h\u00e1 AI: pokud v\u00fdrobce stav\u00ed na standardizovan\u00e9m konektorov\u00e9m frameworku, jako je <strong>ConnID<\/strong>, dok\u00e1\u017ee AI upravit existuj\u00edc\u00ed REST konektor podle API va\u0161eho syst\u00e9mu \u2014 nebo napsat zcela nov\u00fd \u2014 za zlomek \u010dasu, kter\u00fd d\u0159\u00edv zabral v\u00fdvoj konektoru na m\u00edru.<\/p>\n<h3>Jak\u00e1 data v syst\u00e9mech spravovat?<\/h3>\n<p>Chcete jen zakl\u00e1dat \u00fa\u010dty, nebo i do detailu spravovat pr\u00e1va? Vydefinujte si, jak\u00e1 data chcete v ka\u017ed\u00e9m syst\u00e9mu spravovat. To je \u010dist\u011b pr\u00e1ce z\u00e1kazn\u00edka \u2014 dodavatel m\u016f\u017ee pokl\u00e1dat dobr\u00e9 ot\u00e1zky, ale va\u0161e data nezn\u00e1.<\/p>\n<p>Jak\u00fd je zdroj dat o zam\u011bstnanc\u00edch? \u010casto personalistika. Pozor \u2014 pro r\u016fzn\u00e9 skupiny identit mohou existovat r\u016fzn\u00e9 zdroje. Pro ne-zam\u011bstnance b\u00fdv\u00e1 zdrojem tabulka externist\u016f, nebo vznikaj\u00ed p\u0159\u00edmo ve webov\u00e9m rozhran\u00ed IdStory, nap\u0159\u00edklad samoregistrac\u00ed se schv\u00e1len\u00edm.<\/p>\n<h2>Bezpe\u010dnostn\u00ed funkce: nov\u00e9 krit\u00e9rium v\u00fdb\u011bru<\/h2>\n<p>Tady je posun d\u016frazu, kter\u00fd pova\u017eujeme za z\u00e1sadn\u00ed. D\u016fle\u017eit\u011bj\u0161\u00ed ne\u017e d\u00e9lka seznamu konektor\u016f, nebo dokonal\u00e1 p\u0159\u00edprava synchronizovan\u00fdch atribut\u016f p\u0159edem, je dnes to, zda syst\u00e9m nab\u00edz\u00ed <strong>funkce odpov\u00eddaj\u00edc\u00ed modern\u00edm po\u017eadavk\u016fm na bezpe\u010dnost<\/strong>, p\u0159edev\u0161\u00edm t\u011bm vych\u00e1zej\u00edc\u00edm z NIS2 a navazuj\u00edc\u00ed n\u00e1rodn\u00ed legislativy (u n\u00e1s nov\u00fd z\u00e1kon o kybernetick\u00e9 bezpe\u010dnosti).<\/p>\n<p>P\u0159i v\u00fdb\u011bru IdM\/IGA syst\u00e9mu si ov\u011b\u0159te, \u017ee um\u00ed:<\/p>\n<ul>\n<li><strong>Spr\u00e1vu technick\u00fdch a servisn\u00edch \u00fa\u010dt\u016f<\/strong> \u2014 \u00fa\u010dt\u016f, kter\u00e9 nepat\u0159\u00ed lidem, ale aplikac\u00edm, skript\u016fm a integrac\u00edm. Na tyto \u00fa\u010dty se ve spr\u00e1v\u011b identit nej\u010dast\u011bji zapom\u00edn\u00e1, p\u0159itom b\u00fdvaj\u00ed vysoce privilegovan\u00e9 a s heslem, kter\u00e9 se nikdy nem\u011bn\u00ed. Ka\u017ed\u00fd mus\u00ed m\u00edt odpov\u011bdn\u00e9ho garanta, evidovanou platnost a auditn\u00ed stopu.<\/li>\n<li><strong>Privilegovan\u00e9 \u00fa\u010dty<\/strong> \u2014 p\u0159ehled, kdo dr\u017e\u00ed zv\u00fd\u0161en\u00e1 opr\u00e1vn\u011bn\u00ed, v\u010detn\u011b mo\u017enosti p\u0159edat privilegovan\u00e9 \u00fa\u010dty do PAM syst\u00e9mu k trezorov\u00e1n\u00ed a kontrole relac\u00ed.<\/li>\n<li><strong>Pravideln\u00e9 p\u0159eschv\u00e1len\u00ed pr\u00e1v (recertifikaci)<\/strong> \u2014 kampan\u011b, ve kter\u00fdch vedouc\u00ed a garanti rol\u00ed pravideln\u011b potvrzuj\u00ed nebo zam\u00edtaj\u00ed p\u0159id\u011blen\u00e1 opr\u00e1vn\u011bn\u00ed, s automatick\u00fdm odebr\u00e1n\u00edm nepotvrzen\u00e9ho a kompletn\u00edm z\u00e1znamem pro auditora.<\/li>\n<li><strong>Auditn\u00ed reporting<\/strong> \u2014 hotov\u00e9 odpov\u011bdi na ot\u00e1zky \u201ekdo m\u00e1 k \u010demu p\u0159\u00edstup&#8220; a \u201eco a kdy se zm\u011bnilo&#8220;, exportovateln\u00e9 pro auditora bez toho, aby v\u00fdvoj\u00e1\u0159 psal SQL.<\/li>\n<li><strong>Retenci dat a GDPR<\/strong> \u2014 automatickou anonymizaci nebo archivaci osobn\u00edch \u00fadaj\u016f ode\u0161l\u00fdch lid\u00ed podle va\u0161\u00ed reten\u010dn\u00ed politiky, p\u0159i zachov\u00e1n\u00ed auditn\u00ed stopy.<\/li>\n<\/ul>\n<p>Pokud vyb\u00edran\u00fd syst\u00e9m tyto v\u011bci neum\u00ed, naraz\u00edte b\u011bhem p\u00e1r let \u2014 regulace se pohybuje jen jedn\u00edm sm\u011brem. Zjednodu\u0161en\u011b: syst\u00e9m tyto funkce podporovat mus\u00ed, aby garantoval dlouhodobou udr\u017eitelnost va\u0161\u00ed investice. (IdStory IdM v\u0161echny uveden\u00e9 oblasti pokr\u00fdv\u00e1 dedikovan\u00fdmi moduly \u2014 spr\u00e1vou technick\u00fdch \u00fa\u010dt\u016f, recertifikac\u00ed, reporty, PAM integrac\u00ed a GDPR modulem \u2014 tak\u017ee tento seznam je z\u00e1rove\u0148 n\u00e1\u0161 vlastn\u00ed checklist.)<\/p>\n<h2>IdM a PAM: co nasadit d\u0159\u00edv?<\/h2>\n<p>Nej\u010dast\u011bj\u0161\u00ed dnes nasazovanou kombinac\u00ed \u0159e\u0161en\u00ed pro IGA je <strong>IdM + PAM<\/strong> (Privileged Access Management). Ka\u017ed\u00e9 z nich \u0159e\u0161\u00ed jinou vrstvu t\u00e9ho\u017e probl\u00e9mu: IdM \u0159\u00edd\u00ed procesy okolo identit a \u00fa\u010dt\u016f, t.j. kdo m\u00e1 m\u00edt jak\u00fd \u00fa\u010det a roli, schvalov\u00e1n\u00ed, \u017eivotn\u00ed cyklus, dolo\u017eitelnost. PAM \u0159\u00edd\u00ed privilegovan\u00e9 \u00fa\u010dty na n\u00edzk\u00e9 \u00farovni, neboli trezorov\u00e1n\u00ed a rotaci hesel, zprost\u0159edkov\u00e1n\u00ed a nahr\u00e1v\u00e1n\u00ed relac\u00ed.<\/p>\n<p>Zam\u011b\u0159te se na kompatibilitu va\u0161eho IdM s PAM syst\u00e9mem (st\u00e1vaj\u00edc\u00edm i t\u00edm, kter\u00fd pl\u00e1nujete). A pokud se chyst\u00e1te nasadit PAM <em>d\u0159\u00edv<\/em> ne\u017e IdM, zva\u017ete, zda tu cestu neoto\u010dit. IdM toti\u017e nejd\u0159\u00edv ud\u011bl\u00e1 po\u0159\u00e1dek v \u00fa\u010dtech, proto\u017ee ka\u017ed\u00fd \u00fa\u010det dostane vlastn\u00edka, \u00fa\u010del a \u017eivotn\u00ed cyklus, a t\u00edm p\u0159iprav\u00ed p\u016fdu pro PAM, kter\u00fd si n\u00e1sledn\u011b p\u0159evezme n\u00edzko\u00farov\u0148ov\u00e9 \u0159\u00edzen\u00ed t\u011bch privilegovan\u00fdch. Nasazovat PAM na nezmapovanou krajinu \u00fa\u010dt\u016f bez vlastn\u00edk\u016f znamen\u00e1 d\u011blat inventuru dvakr\u00e1t. V IdStory IdM je toto p\u0159ed\u00e1n\u00ed p\u0159\u00edm\u00e9: technick\u00e9 \u00fa\u010dty ozna\u010den\u00e9 jako privilegovan\u00e9 se p\u0159ed\u00e1vaj\u00ed do PAM syst\u00e9mu (nap\u0159. CyberArk) k trezorovan\u00e9mu, auditovan\u00e9mu p\u0159\u00edstupu.<\/p>\n<h2 style=\"text-align: left;\">Organizace slo\u017een\u00e9 z v\u00edce firem: myslete na multitenanci<\/h2>\n<p>Pokud jste organizace slo\u017een\u00e1 z v\u00edce firem, napl\u00e1nujte onboarding spole\u010dnost\u00ed postupn\u011b. Firmu po firm\u011b, ne v\u0161echny najednou.<\/p>\n<p>Vybran\u00e9 IdM \u0159e\u0161en\u00ed mus\u00ed um\u011bt <strong>multitenantn\u00ed p\u0159\u00edstup<\/strong>: odd\u011blit data a administr\u00e1torsk\u00e9 p\u0159\u00edstupy mezi organizacemi, ale z\u00e1rove\u0148 zvl\u00e1dat situaci, kdy jeden \u010dlov\u011bk m\u00e1 \u00favazky ve v\u00edce firm\u00e1ch skupiny. V praxi to znamen\u00e1, \u017ee IdM mus\u00ed kvalitn\u011b \u0159\u00eddit kontrakty z r\u016fzn\u00fdch spole\u010dnost\u00ed a d\u016fsledn\u011b p\u0159id\u011blovat opr\u00e1vn\u011bn\u00ed na konkr\u00e9tn\u00ed kontrakt. Role z\u00edskan\u00e1 p\u0159es \u00favazek ve firm\u011b A nesm\u00ed ti\u0161e p\u0159et\u00e9ct na \u00favazek t\u00e9ho\u017e \u010dlov\u011bka ve firm\u011b B.<\/p>\n<p>Zajist\u011bte si dop\u0159edu <strong>p\u00e1rovac\u00ed identifik\u00e1tor. <\/strong>Jde o atribut, kter\u00fd umo\u017en\u00ed sp\u00e1rovat v\u00edce z\u00e1znam\u016f t\u00e9\u017ee osoby z r\u016fzn\u00fdch HR zdroj\u016f pod jednu identitu v IdM. Ide\u00e1ln\u011b jde o osobn\u00ed \u010d\u00edslo unik\u00e1tn\u00ed nap\u0159\u00ed\u010d celou skupinou. Pokud takov\u00e9 nen\u00ed (nebo nen\u00ed unik\u00e1tn\u00ed), poslou\u017e\u00ed anonymizovan\u00e1 varianta rodn\u00e9ho \u010d\u00edsla, nap\u0159\u00edklad jeho hash. IdM pak citliv\u00fd \u00fadaj v\u016fbec nedr\u017e\u00ed, a p\u0159esto dok\u00e1\u017ee jednu osobu spolehliv\u011b sp\u00e1rovat p\u0159es v\u00edce spole\u010dnost\u00ed.<\/p>\n<h2>Hybridn\u00ed Active Directory + Entra ID<\/h2>\n<p>V\u011bt\u0161ina organizac\u00ed dnes provozuje hybridn\u00ed prost\u0159ed\u00ed Microsoftu, proto integraci pl\u00e1nujte po f\u00e1z\u00edch:<\/p>\n<ol>\n<li><strong>Prvn\u00ed f\u00e1ze:<\/strong> spravujte lok\u00e1ln\u00ed Active Directory a nechte <strong>Entra ID Connect<\/strong> synchronizovat identity do cloudu. Va\u0161e IdM by tuto konfiguraci m\u011blo podporovat rovnou.<\/li>\n<li><strong>Dal\u0161\u00ed f\u00e1ze:<\/strong> napojte Entra ID p\u0159\u00edmo p\u0159es rozhran\u00ed <strong>Microsoft Graph API<\/strong>. Pr\u00e1v\u011b to umo\u017en\u00ed spravovat i cloud-only objekty, kter\u00e9 v lok\u00e1ln\u00edm AD nikdy neexistuj\u00ed, jako jsou cloud-only skupiny, Guest \u00fa\u010dty, p\u0159i\u0159azen\u00ed licenc\u00ed.<\/li>\n<\/ol>\n<p>Jednu hranici je dobr\u00e9 dr\u017eet jasnou: single sign-on a v\u00edcefaktorov\u00e9 ov\u011b\u0159en\u00ed jsou dom\u00e9nou <em>access managementu<\/em> (Entra ID, CAS a podobn\u00e9). IdM\/IGA \u0159\u00edd\u00ed, kdo m\u00e1 jak\u00fd \u00fa\u010det a roli a vrstvu access managementu z\u00e1sobuje \u010dist\u00fdmi, aktu\u00e1ln\u00edmi daty. Ob\u011b vrstvy se dopl\u0148uj\u00ed; ani jedna nenahrazuje druhou.<\/p>\n<h2>P\u0159\u00edklad napojen\u00ed syst\u00e9m\u016f do IdM<\/h2>\n<p>N\u00ed\u017ee je uveden asi nejjednodu\u0161\u0161\u00ed p\u0159\u00edpad, jak do IdM napojit person\u00e1ln\u00ed syst\u00e9m a Microsoft Active Directory. Pokud takto p\u0159iprav\u00edte data, napoj\u00edte syst\u00e9my do IdM bez jak\u00e9koliv dal\u0161\u00ed \u00fapravy na stran\u011b IdM.<\/p>\n<h3>Personalistika (HR syst\u00e9m) jako autoritativn\u00ed zdroj o zam\u011bstnanc\u00edch<\/h3>\n<p>M\u011bjme pro uk\u00e1zku HR syst\u00e9m, kter\u00fd obsahuje data v SQL datab\u00e1zi nebo je um\u00ed exportovat do CSV soubor\u016f. N\u00e1zvy sloupc\u016f mohou b\u00fdt libovoln\u00e9. Struktura datab\u00e1zov\u00fdch view nebo CSV odpov\u00edd\u00e1 objekt\u016fm Identita, Vztah (kontrakt) a Organiza\u010dn\u00ed struktura popsan\u00fdm n\u00ed\u017ee.<\/p>\n<h4>1\/ Osoby<\/h4>\n<p>Tabulka osob slou\u017e\u00ed jako z\u00e1kladn\u00ed zdroj informac\u00ed pro zalo\u017een\u00ed identity u\u017eivatele v IdStory.<\/p>\n<table cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"top\"><strong>atribut<\/strong><\/td>\n<td valign=\"top\"><strong>unik\u00e1tn\u00ed<\/strong><\/td>\n<td valign=\"top\"><strong>povinn\u00fd<\/strong><\/td>\n<td valign=\"top\"><strong>pozn\u00e1mka<\/strong><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">id<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">\u010dasto osobn\u00ed \u010d\u00edslo; ide\u00e1ln\u011b v \u010dase nem\u011bnn\u00fd identifik\u00e1tor, kter\u00fd nen\u00ed po ukon\u010den\u00ed vztahu s osobou \u201erecyklov\u00e1n&#8220;<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">login<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">minim\u00e1ln\u00ed d\u00e9lka 2 znaky; pokud nen\u00ed dostupn\u00fd, login generuje identity manager<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">jm\u00e9no<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">p\u0159\u00edjmen\u00ed<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">titul p\u0159ed<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">titul za<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">email<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">standardn\u011b se pou\u017e\u00edv\u00e1 pro p\u0159ed\u00e1n\u00ed prvotn\u00edho hesla<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">mobiln\u00ed telefon<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">p\u0159i napojen\u00ed identity manageru na SMS br\u00e1nu lze heslo zas\u00edlat SMSkou<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">timestamp<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">\u010dasov\u00e1 zna\u010dka posledn\u00ed zm\u011bny, ide\u00e1ln\u011b tzv. \u201eunix timestamp&#8220;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2\/ Vztahy (kontrakty)<\/h4>\n<p>Vztah (kontrakt) si lze p\u0159edstavit jako pracovn\u00ed pom\u011br, DPP \u010di DP\u010c zam\u011bstnance, kontrakt extern\u00edho dodavatele, st\u00e1\u017e na odd\u011blen\u00ed, studium na fakult\u011b, \u00fa\u010dast na neplacen\u00e9m projektu a dal\u0161\u00ed. U vztahu je nejd\u016fle\u017eit\u011bj\u0161\u00ed vlastn\u00edk; maj\u00ed-li b\u011b\u017eet automatick\u00e9 procesy jako n\u00e1stup nebo ukon\u010den\u00ed zam\u011bstnance, pak i platnosti \u00favazku od\/do.<\/p>\n<p>Identita m\u016f\u017ee m\u00edt v identity manageru b\u011b\u017en\u011b evidov\u00e1no v\u00edce pracovn\u011bpr\u00e1vn\u00edch vztah\u016f \u2014 vztahy lze synchronizovat z extern\u00edho zdroje stejn\u011b jako identity. Pokud organizace vztahy nevyu\u017e\u00edv\u00e1, nen\u00ed tato synchronizace nutn\u00e1: identity manager si \u201es\u00e1m&#8220; zalo\u017e\u00ed v\u00fdchoz\u00ed vztah, na kter\u00fd navazuje ve\u0161ker\u00e1 funk\u010dnost.<\/p>\n<table cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"top\"><strong>atribut<\/strong><\/td>\n<td valign=\"top\"><strong>unik\u00e1tn\u00ed<\/strong><\/td>\n<td valign=\"top\"><strong>povinn\u00fd<\/strong><\/td>\n<td valign=\"top\"><strong>pozn\u00e1mka<\/strong><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">id<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">kl\u00ed\u010d pro zpracov\u00e1n\u00ed<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">n\u00e1zev \u00favazku<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">nap\u0159. \u201eVrchn\u00ed sestra&#8220;; nepovinn\u00e9<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">vlastn\u00edk<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">reference na id osoby<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">platnost od<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">SQL timestamp \u2014 za\u010d\u00e1tek platnosti smlouvy nebo \u00favazku<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">platnost do<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">SQL timestamp \u2014 konec platnosti smlouvy nebo \u00favazku<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">vy\u0159azen\u00ed z ev. po\u010dtu<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">boolean; p\u0159\u00edznak vy\u0159azen\u00ed z eviden\u010dn\u00edho po\u010dtu (nap\u0159. rodi\u010dovsk\u00e1 dovolen\u00e1)<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">hlavn\u00ed \u00favazek<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">boolean; p\u0159\u00edznak hlavn\u00edho \u00favazku. Pokud nen\u00ed uveden, pou\u017eije se automatick\u00fd v\u00fdpo\u010det<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">nad\u0159\u00edzen\u00fd<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">reference na id osoby; lze vyu\u017e\u00edt i bez organiza\u010dn\u00ed struktury<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">organizace<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">reference na id z organiza\u010dn\u00ed struktury<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">timestamp<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">\u010dasov\u00e1 zna\u010dka posledn\u00ed zm\u011bny, ide\u00e1ln\u011b tzv. \u201eunix timestamp&#8220;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>3\/ Organiza\u010dn\u00ed struktura<\/h4>\n<p>V p\u0159\u00edpad\u011b po\u017eadavku na synchronizaci organiza\u010dn\u00ed struktury do IdM je t\u0159eba dodr\u017eet strukturu dat. Do takto synchronizovan\u00e9 struktury lze p\u0159i\u0159azovat \u00favazky identit. IdM podporuje v\u00edce organiza\u010dn\u00edch struktur \u2014 mo\u017en\u00fdch je v\u00edce synchronizac\u00ed. P\u0159i odstran\u011bn\u00ed prvku ze zdroje dat se odpov\u00eddaj\u00edc\u00ed \u010d\u00e1st struktury v identity manageru sma\u017ee pouze tehdy, je-li pr\u00e1zdn\u00e1.<\/p>\n<table cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"top\"><strong>atribut<\/strong><\/td>\n<td valign=\"top\"><strong>unik\u00e1tn\u00ed<\/strong><\/td>\n<td valign=\"top\"><strong>povinn\u00fd<\/strong><\/td>\n<td valign=\"top\"><strong>pozn\u00e1mka<\/strong><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">id<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">nem\u011bnn\u00fd kl\u00ed\u010d pro zpracov\u00e1n\u00ed<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">n\u00e1zev<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">unik\u00e1tn\u00ed n\u00e1zev organiza\u010dn\u00ed jednotky nebo pozice<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">rodi\u010d<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">reference na id nad\u0159\u00edzen\u00e9ho prvku organiza\u010dn\u00ed struktury<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>P\u0159\u00edklady spravovan\u00fdch syst\u00e9m\u016f<\/h2>\n<ul>\n<li>Microsoft Active Directory \u2014 jedna dom\u00e9na, provisioning identit a jejich \u010dlenstv\u00ed ve skupin\u00e1ch,<\/li>\n<li>Entra ID \u2014 v hybridn\u00edm re\u017eimu p\u0159es AD + Entra ID Connect, nebo p\u0159\u00edmo p\u0159es Graph API (v\u010detn\u011b cloud-only skupin a Guest \u00fa\u010dt\u016f),<\/li>\n<li>LDAPv3 \u2014 provisioning identit a jejich rol\u00ed,<\/li>\n<li>datab\u00e1ze p\u0159es JDBC \u2014 nap\u0159. jedna tabulka u\u017eivatel\u016f.<\/li>\n<\/ul>\n<h3>Microsoft Active Directory (MS AD)<\/h3>\n<p>P\u0159\u00edklad zad\u00e1n\u00ed:<\/p>\n<ul>\n<li>instalace a konfigurace IdM,<\/li>\n<li>napojen\u00ed na dom\u00e9nu MS AD pro spr\u00e1vu u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f a jejich \u010dlenstv\u00ed ve skupin\u00e1ch,<\/li>\n<li>na\u010d\u00edt\u00e1n\u00ed skupin z MS AD a automatick\u00e9 vytv\u00e1\u0159en\u00ed odpov\u00eddaj\u00edc\u00edch rol\u00ed v identity manageru,<\/li>\n<li>spr\u00e1va dom\u00e1c\u00edch adres\u00e1\u0159\u016f u\u017eivatel\u016f,<\/li>\n<li>spr\u00e1va e-mailov\u00fdch schr\u00e1nek na MS Exchange,<\/li>\n<li>spr\u00e1va \u017eivotn\u00edho cyklu certifik\u00e1t\u016f vyd\u00e1van\u00fdch extern\u00edm u\u017eivatel\u016fm p\u0159es certifika\u010dn\u00ed autoritu.<\/li>\n<\/ul>\n<p>P\u0159\u00edklad spravovan\u00fdch dat \u2014 konektor umo\u017e\u0148uje spravovat v\u0161e, co adres\u00e1\u0159 vystavuje:<\/p>\n<table cellspacing=\"0\" cellpadding=\"0\">\n<tbody>\n<tr>\n<td valign=\"top\"><strong>atribut<\/strong><\/td>\n<td valign=\"top\"><strong>povinn\u00fd<\/strong><\/td>\n<td valign=\"top\"><strong>pozn\u00e1mka<\/strong><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">DN<\/td>\n<td valign=\"top\">*<\/td>\n<td valign=\"top\">distinguished name<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">sAMAccountName<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">login u\u017eivatele<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">cn<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">common name \u2014 \u010dasto pou\u017e\u00edvan\u00e9 jako RDN<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">displayName<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">zobrazovan\u00e9 jm\u00e9no; \u010dasto se zobrazuje v aplikac\u00edch pou\u017e\u00edvaj\u00edc\u00edch AD<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">description<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">password<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\"><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">sn<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">p\u0159\u00edjmen\u00ed<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">givenName<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">k\u0159estn\u00ed jm\u00e9no<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">mail<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">e-mail u\u017eivatele<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\">userPrincipalName<\/td>\n<td valign=\"top\"><\/td>\n<td valign=\"top\">login + dom\u00e9na<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Procesy<\/h2>\n<p>Identity Management je procesn\u00ed n\u00e1stroj. Data se na\u010d\u00edtaj\u00ed ze zdrojov\u00e9ho syst\u00e9mu, transformuj\u00ed, schvaluj\u00ed a zapisuj\u00ed do koncov\u00fdch syst\u00e9m\u016f. Doporu\u010dujeme vyu\u017e\u00edvat standardn\u00ed procesy p\u0159ipraven\u00e9 vybran\u00fdm identity managerem \u2014 rozs\u00e1hl\u00e9 \u00fapravy na m\u00edru zdra\u017euj\u00ed ka\u017ed\u00fd budouc\u00ed upgrade.<\/p>\n<p>Hlavn\u00ed typy proces\u016f:<\/p>\n<ul>\n<li><strong>\u0158\u00edzen\u00ed \u017eivotn\u00edho cyklu identit (joiner\u2013mover\u2013leaver):<\/strong>\n<ul>\n<li>synchronizace osob a jejich vztah\u016f (\u00favazk\u016f),<\/li>\n<li>standardn\u00ed proces p\u0159ed\u00e1n\u00ed hesla \u2014 prvotn\u00ed heslo se u\u017eivateli za\u0161le e-mailem (nebo SMSkou) p\u0159i vytvo\u0159en\u00ed \u00fa\u010dtu v AD\/LDAP\/DB,<\/li>\n<li>standardn\u00ed procesy \u017eivotn\u00edho cyklu: n\u00e1stup (joiner), zm\u011bna pozice \u010di organiza\u010dn\u00edho za\u0159azen\u00ed (mover), konec \u00favazku (leaver), vyn\u011bt\u00ed z eviden\u010dn\u00edho po\u010dtu,<\/li>\n<li>automatick\u00e9 p\u0159id\u011blov\u00e1n\u00ed a odeb\u00edr\u00e1n\u00ed opr\u00e1vn\u011bn\u00ed dle za\u0159azen\u00ed v organiza\u010dn\u00ed struktu\u0159e.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Synchronizace organiza\u010dn\u00ed struktury<\/strong> a dal\u0161\u00edch objekt\u016f \u2014 nap\u0159. certifik\u00e1t\u016f nebo atribut\u016f typu \u010d\u00edsla karet.<\/li>\n<li><strong>Schvalovac\u00ed proces \u017e\u00e1dosti o pr\u00e1va<\/strong> \u2014 zm\u011bny p\u0159id\u011blen\u00fdch rol\u00ed. Konfigurace standardn\u00edho schvalovac\u00edho procesu: dopln\u011bn\u00ed \u017e\u00e1dosti helpdeskem, schv\u00e1len\u00ed vedouc\u00edm u\u017eivatele a\/nebo garantem role, p\u0159\u00edpadn\u011b fin\u00e1ln\u00ed schv\u00e1len\u00ed bezpe\u010dnost\u00ed.<\/li>\n<li><strong>Manu\u00e1ln\u00ed procesy<\/strong> \u2014 prov\u00e1d\u011bn\u00e9 u\u017eivateli a spr\u00e1vci v GUI IdM: \u017e\u00e1dost o zm\u011bnu opr\u00e1vn\u011bn\u00ed, jej\u00ed schv\u00e1len\u00ed, reset hesla, hromadn\u00e9 akce, pr\u00e1ce s rolemi, spu\u0161t\u011bn\u00ed synchronizac\u00ed apod.<\/li>\n<\/ul>\n<h3>Ot\u00e1zky k proces\u016fm<\/h3>\n<ol>\n<li>Jak\u00e9 procesy chcete automatizovat? Z jak\u00fdch syst\u00e9m\u016f chcete synchronizovat data a jak\u00e1?<\/li>\n<li>Jak\u00fd je \u017eivotn\u00ed cyklus \u00fa\u010dt\u016f zam\u011bstnanc\u016f, externist\u016f, z\u00e1kazn\u00edk\u016f a technick\u00fdch \u00fa\u010dt\u016f? Sepi\u0161te si jej alespo\u0148 r\u00e1mcov\u011b \u2014 vznik, zm\u011bny, z\u00e1nik.<\/li>\n<li>Jak vypad\u00e1 \u017eivotn\u00ed cyklus organiza\u010dn\u00ed struktury a jej\u00edch jednotek? Pozor, toto b\u00fdv\u00e1 skryt\u00e1 velk\u00e1 pracnost. Organiza\u010dn\u00ed strukturu doporu\u010dujeme spravovat v personalistice; IdM ji synchronizuje a zm\u011bny propaguje d\u00e1l do syst\u00e9m\u016f.<\/li>\n<li>Jak vypad\u00e1 \u017eivotn\u00ed cyklus rol\u00ed, skupin v AD a certifik\u00e1t\u016f \u2014 vznik, zm\u011bny, z\u00e1nik? I zde se m\u016f\u017ee jednat o skryt\u011b velk\u00fd \u00fakol hodn\u00fd samostatn\u00e9ho projektu.<\/li>\n<li>Jak pot\u0159ebujete schvalovat? Doporu\u010dujeme schvalov\u00e1n\u00ed jednoduch\u00e9, maxim\u00e1ln\u011b t\u0159\u00edkrokov\u00e9. U slo\u017eit\u00e9ho schvalov\u00e1n\u00ed v \u010dase nar\u016fst\u00e1 nespokojenost s d\u00e9lkou schvalovac\u00edho kole\u010dka. P\u0159esu\u0148te schvalov\u00e1n\u00ed z administr\u00e1tor\u016f na vedouc\u00ed a vlastn\u00edky dat.<\/li>\n<\/ol>\n<h2>Opr\u00e1vn\u011bn\u00ed v identity manageru<\/h2>\n<p>Kdo a jak bude s IdM pracovat? Toto jsou obvykl\u00e9 role pr\u00e1v:<\/p>\n<ul>\n<li><strong>Super administr\u00e1tor<\/strong> \u2014 minim\u00e1ln\u011b jeden u\u017eivatel na stran\u011b z\u00e1kazn\u00edka s nejvy\u0161\u0161\u00edm opr\u00e1vn\u011bn\u00edm v identity manageru,<\/li>\n<li><strong>Helpdesk<\/strong> \u2014 zm\u011bna hesel, p\u0159\u00edstup k auditn\u00edm informac\u00edm a odeslan\u00fdm notifikac\u00edm,<\/li>\n<li><strong>B\u011b\u017en\u00fd u\u017eivatel<\/strong> \u2014 zm\u011bna vlastn\u00edho hesla, \u010dten\u00ed sv\u00e9ho profilu, pod\u00e1v\u00e1n\u00ed \u017e\u00e1dost\u00ed o zm\u011bnu opr\u00e1vn\u011bn\u00ed,<\/li>\n<li><strong>Vedouc\u00ed<\/strong> \u2014 pr\u00e1va jako b\u011b\u017en\u00fd u\u017eivatel, nav\u00edc vid\u00ed sv\u00e9 pod\u0159\u00edzen\u00e9 a m\u016f\u017ee za n\u011b \u017e\u00e1dat o zm\u011bny opr\u00e1vn\u011bn\u00ed,<\/li>\n<li><strong>Garant role \/ vlastn\u00edk dat<\/strong> \u2014 schvaluje p\u0159\u00edstupy k syst\u00e9mu \u010di roli, za kterou odpov\u00edd\u00e1,<\/li>\n<li>a dal\u0161\u00ed \u2014 nap\u0159. auditor s pr\u00e1vy pouze pro \u010dten\u00ed.<\/li>\n<\/ul>\n<h2>Jak\u00e9 \u00fa\u010dty spravovat?<\/h2>\n<p>IdM m\u016f\u017ee spravovat v\u0161echny \u00fa\u010dty a pro ka\u017ed\u00fd typ lze nastavit jin\u00e9 procesy. Jak\u00e9 \u00fa\u010dty m\u00e1 smysl spravovat? Integrace a automatizace i s n\u00e1strojem IdM stoj\u00ed n\u011bjakou investici \u2014 asi nem\u00e1 smysl automatizovat proces, kter\u00fd se dvakr\u00e1t do roka aplikuje na hrstku \u00fa\u010dt\u016f; ten levn\u011bji provede administr\u00e1tor. Typick\u00e9 skupiny \u00fa\u010dt\u016f:<\/p>\n<ul>\n<li><strong>Zam\u011bstnanci<\/strong> \u2014 identita vznik\u00e1 za\u010d\u00e1tkem smluvn\u00edho \u00favazku, kter\u00fd se do IdM na\u010dte z personalistiky.<\/li>\n<li><strong>Externist\u00e9<\/strong> \u2014 dodavatel\u00e9, z\u00e1kazn\u00edci, studenti apod. Do syst\u00e9m\u016f p\u0159istupuj\u00ed \u010dasto p\u0159es VPN, mnohdy s certifik\u00e1ty. Identity mohou vznikat ve webov\u00e9m rozhran\u00ed IdM, nebo samoregistrac\u00ed se schv\u00e1len\u00edm odpov\u011bdnou osobou.<\/li>\n<li><strong>Technick\u00e9 a servisn\u00ed \u00fa\u010dty<\/strong> \u2014 \u00fa\u010dty aplikac\u00ed a integrac\u00ed. Nesm\u00ed zaniknout s odchodem sv\u00e9ho lidsk\u00e9ho vlastn\u00edka; maj\u00ed vlastn\u00ed \u017eivotn\u00ed cyklus. Ka\u017ed\u00fd technick\u00fd \u00fa\u010det by m\u011bl m\u00edt odpov\u011bdn\u00e9ho garanta, evidovanou platnost a auditn\u00ed stopu; IdM m\u016f\u017ee \u0159e\u0161it i agendu p\u0159ed\u00e1v\u00e1n\u00ed hesla. Privilegovan\u00e9 ozna\u010dte k p\u0159ed\u00e1n\u00ed do PAM.<\/li>\n<li><strong>Privilegovan\u00e9 \u00fa\u010dty<\/strong> \u2014 administr\u00e1torsk\u00e9 \u00fa\u010dty nap\u0159\u00ed\u010d infrastrukturou a aplikacemi. Ve\u010fte jejich p\u0159ehled s garanty a spravujte je v sou\u010dinnosti s PAM syst\u00e9mem.<\/li>\n<\/ul>\n<h3>Jak\u00e9 objekty IdM zpracov\u00e1v\u00e1?<\/h3>\n<p>Identity, \u00fa\u010dty, role, skupiny, organiza\u010dn\u00ed struktury, \u00favazky, certifik\u00e1ty, fotky, katalog rol\u00ed, softwarov\u00e9 licence a majetek, VPN p\u0159\u00edstupy\u2026 a akce, kter\u00e9 nad nimi u\u017eivatel\u00e9 pot\u0159ebuj\u00ed prov\u00e1d\u011bt v GUI.<\/p>\n<h2>Po\u017eadavky na HW\/SW pro IdM<\/h2>\n<p>IdM se obvykle skl\u00e1d\u00e1 z java aplikace b\u011b\u017e\u00edc\u00ed na aplika\u010dn\u00edm serveru a datab\u00e1ze, kde jsou ulo\u017eena metadata. Nasazuje se na virtu\u00e1ln\u00ed server, do kontejner\u016f, nebo jako p\u0159ipraven\u00e1 appliance. Ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f jde o nen\u00e1ro\u010dn\u00fd provoz, kdy sta\u010d\u00ed n\u00edzk\u00fd v\u00fdkon; v\u00edc pot\u0159ebuj\u00ed jen syst\u00e9my, kter\u00e9 systematicky synchronizuj\u00ed velk\u00e9 objemy dat z mnoha zdroj\u016f.<\/p>\n<p>P\u0159\u00edklad HW po\u017eadavk\u016f na\u0161eho IdM: <a href=\"https:\/\/wiki.czechidm.com\/faq\/prerequisites_and_system_requirements\" target=\"_blank\" rel=\"noopener\">Po\u017eadavky na HW\/SW serveru<\/a>.<\/p>\n<h2>Sou\u010dinnost z\u00e1kazn\u00edka<\/h2>\n<p>Na co se p\u0159ipravit jako z\u00e1kazn\u00edk? Kvalitn\u00ed dodavatel dok\u00e1\u017ee formou sch\u016fzek a kvalitn\u00edch ot\u00e1zek z\u00edskat spr\u00e1vn\u00e9 informace. Ka\u017edop\u00e1dn\u011b je to z\u00e1kazn\u00edk, kdo zad\u00e1v\u00e1, jak\u00e9 probl\u00e9my chce \u0159e\u0161it, jak\u00e9 syst\u00e9my spravovat, jak\u00fdmi procesy a jak\u00e1 data.<\/p>\n<p>N\u00ed\u017ee uveden\u00e9 \u00fakony se o\u010dek\u00e1vaj\u00ed jako sou\u010dinnost z\u00e1kazn\u00edka:<\/p>\n<ul>\n<li>p\u0159\u00edprava serveru (hardware nebo virtu\u00e1ln\u00ed server),<\/li>\n<li>instalace opera\u010dn\u00edho syst\u00e9mu, konfigurace firewallu apod.,<\/li>\n<li>p\u0159\u00edstup k mailserveru \u2014 identity manager vy\u017eaduje SMTP server pro notifikace,<\/li>\n<li>konfigurace SSL spojen\u00ed k Active Directory (pokud se spravuje heslo),<\/li>\n<li>vzd\u00e1len\u00fd p\u0159\u00edstup pro techniky prov\u00e1d\u011bj\u00edc\u00ed implementaci,<\/li>\n<li>p\u0159\u00edprava zdroje dat dle form\u00e1tu v\u00fd\u0161e a jeho zp\u0159\u00edstupn\u011bn\u00ed v s\u00edti,<\/li>\n<li>\u00fa\u010dast na prvotn\u00edm importu dat, \u010di\u0161t\u011bn\u00ed dat a lad\u011bn\u00ed proces\u016f,<\/li>\n<li>\u00fa\u010dast na \u0161kolen\u00ed a p\u0159ed\u00e1n\u00ed prost\u0159ed\u00ed,<\/li>\n<li>a jedna nov\u00e1 polo\u017eka: zp\u0159\u00edstupn\u011bte dokumentaci va\u0161ich syst\u00e9m\u016f. Urychl\u00ed to pr\u00e1ci konzultant\u016f \u2014 a je to surovina pro AI Skilly popsan\u00e9 v\u00fd\u0161e.<\/li>\n<\/ul>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>Projekty Identity Managementu b\u00fdvaj\u00ed rozs\u00e1hl\u00e9 a komplexn\u00ed integra\u010dn\u00ed projekty a dobr\u00e1 p\u0159\u00edprava je z\u00e1kladem. Za\u010dn\u011bte minim\u00e1ln\u00edm zad\u00e1n\u00edm, vytvo\u0159te minim\u00e1ln\u00ed produkt a jd\u011bte s n\u00edm co nejd\u0159\u00edve do produkce; n\u00e1sledn\u011b \u0159e\u0161en\u00ed iterativn\u011b vylep\u0161ujte a roz\u0161i\u0159ujte. Vyvarujete se tak protahov\u00e1n\u00ed projektu a implementace funkc\u00ed, kter\u00e9 sice vypadaj\u00ed d\u016fle\u017eit\u011b, ale nakonec je nevyu\u017eijete.<\/p>\n<p>Dv\u011b z\u00e1v\u011bre\u010dn\u00e1 doporu\u010den\u00ed z pohledu roku 2026. Zaprv\u00e9: vyb\u00edrejte syst\u00e9m podle bezpe\u010dnostn\u00edch funkc\u00ed jako spr\u00e1vy technick\u00fdch a privilegovan\u00fdch \u00fa\u010dt\u016f, recertifikace, auditn\u00edho reportingu, proto\u017ee p\u0159esn\u011b to po v\u00e1s bude cht\u00edt regulace a p\u0159esn\u011b to garantuje dlouhodobou udr\u017eitelnost investice. Zadruh\u00e9: vyu\u017e\u00edvejte AI, nebo\u0165 s dobrou dokumentac\u00ed a kvalitn\u011b postaven\u00fdm Skillem implementaci zrychl\u00ed, zlevn\u00ed a v\u00fdrazn\u011b sn\u00ed\u017e\u00ed va\u0161i z\u00e1vislost na implement\u00e1torovi. Jen pamatujte na jedinou v\u011bc, kterou AI d\u011blat nesm\u00ed: rozhodovat o tom, kdo dostane p\u0159\u00edstup. To z\u016fst\u00e1v\u00e1 na va\u0161ich lidech a va\u0161ich pravidlech.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Praktick\u00fd pr\u016fvodce p\u0159\u00edpravou IdM\/IGA projektu: c\u00edle, agiln\u00ed zad\u00e1n\u00ed, mapov\u00e1n\u00ed syst\u00e9m\u016f, po\u017eadavky NIS2, PAM, hybridn\u00ed AD + Entra ID a jak AI zlev\u0148uje a zrychluje implementaci.<\/p>\n","protected":false},"author":6,"featured_media":10351,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_theme","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[35,32],"tags":[],"class_list":["post-6630","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-doporucene","category-identity-manager"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/6630","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=6630"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/6630\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/10351"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=6630"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=6630"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=6630"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}