{"id":8369,"date":"2023-09-12T13:56:04","date_gmt":"2023-09-12T11:56:04","guid":{"rendered":"https:\/\/www.idstory.com\/?p=8369"},"modified":"2023-09-06T15:00:58","modified_gmt":"2023-09-06T13:00:58","slug":"funkce-identity-a-access-managementu-iam","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/funkce-identity-a-access-managementu-iam\/","title":{"rendered":"Funkce Identity a Access Managementu (IAM)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tIdentity a Access Management (IAM) je centralizovan\u00e1 spr\u00e1va identit a p\u0159\u00edstup\u016f. Z\u00e1kladn\u00ed funkce Identity a Access Managementu\u00a0je o definov\u00e1n\u00ed a spr\u00e1v\u011b rol\u00ed a \u0159\u00edzen\u00ed p\u0159\u00edstup\u016f jednotliv\u00fdch u\u017eivatel\u016f s\u00edt\u011b. T\u011bmito u\u017eivateli mohou b\u00fdt z\u00e1kazn\u00edci nebo zam\u011bstnanci. D\u016fvodem, pro\u010d IAM je vyu\u017e\u00edv\u00e1na je, \u017ee IT syst\u00e9my jsou typicky heterogenn\u00ed a jsou dostupn\u00e9 po intern\u00ed s\u00edti.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Identity a Access Management se skl\u00e1d\u00e1 ze dvou z\u00e1kladn\u00edch oblast\u00ed \u2013 z\u00a0Identity Managementu (IdM)\u00a0a Access Managementu (AM).\u00a0<\/p>

Dnes v\u011bt\u0161ina platforem IAM poskytuje ur\u010ditou kombinaci n\u00e1sleduj\u00edc\u00edch n\u00e1stroj\u016f a funkc\u00ed, i kdy\u017e s r\u016fznou \u00farovn\u00ed p\u0159izp\u016fsobitelnosti a roz\u0161i\u0159itelnosti.\u00a0<\/p>

Funkce Identity a Access Managementu<\/h2>

\u00a0<\/h3>

Spr\u00e1va \u017eivotn\u00edho cyklu u\u017eivatelsk\u00fdch identit<\/strong><\/h3>

Spr\u00e1va \u017eivotn\u00edho cyklu identit je z\u00e1kladn\u00ed funkce Identity a Access Managementu. Zahrnuje synchronizaci identit, zaji\u0161\u0165ov\u00e1n\u00ed, zru\u0161en\u00ed zaji\u0161\u0165ov\u00e1n\u00ed a pr\u016fb\u011b\u017enou spr\u00e1vu u\u017eivatelsk\u00fdch atribut\u016f, pov\u011b\u0159en\u00ed a opr\u00e1vn\u011bn\u00ed.<\/p>

Syst\u00e9my IAM spravuj\u00ed digit\u00e1ln\u00ed identity u\u017eivatel\u016f, obvykle \u00fa\u010det nebo certifik\u00e1t, token, apod. IAM je obvykle integrov\u00e1n s jedn\u00edm nebo v\u00edce dal\u0161\u00edmi zdroji u\u017eivatelsk\u00fd identity jako je nap\u0159\u00edklad Microsoft Active Directory nebo HR SAP.<\/p>

D\u00edky nasazen\u00ed IAM platformy je obvykle pokryt cel\u00fd cyklus u\u017eivatele v organizaci. Od jeho n\u00e1stupu, kdy je pot\u0159eba p\u0159edat prvotn\u00ed heslo, vygenerovat n\u00e1stupn\u00ed list, vydat vstupn\u00ed karti\u010dku a z\u0159\u00eddit licenci do o365. Identita se v pr\u016fb\u011bhu p\u016fsoben\u00ed ve firm\u011b m\u011bn\u00ed \u2013 dojde k pov\u00fd\u0161en\u00ed a jsou pot\u0159eba jin\u00e9 p\u0159\u00edstupy (nap\u0159. Vy\u0161\u0161\u00ed licence v o365) a s t\u00edm dok\u00e1\u017ee IAM platforma pomoct. V p\u0159\u00edpad\u011b odchodu zam\u011bstnance je pot\u0159eba v\u0161echny p\u0159\u00edstupy odebrat, aby nedo\u0161lo k b\u011b\u017en\u00e9mu sc\u00e9n\u00e1\u0159i, \u017ee zam\u011bstnanec odejde a p\u0159esto m\u00e1 p\u0159\u00edstupy do CRM. Pokud p\u0159ejde ke konkurenci vyu\u017eije data z p\u0159edchoz\u00edho zam\u011bstn\u00e1n\u00ed ke kter\u00fdm m\u00e1 je\u0161t\u011b p\u0159\u00edstup?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Role-Based access control (RBAC)<\/strong><\/h3>

Mnoho syst\u00e9m\u016f IAM pou\u017e\u00edv\u00e1 \u0159\u00edzen\u00ed p\u0159\u00edstupu na z\u00e1klad\u011b rol\u00ed (Role-Based access control RBAC). V r\u00e1mci tohoto p\u0159\u00edstupu existuj\u00ed p\u0159eddefinovan\u00e9 role se specifick\u00fdmi sadami p\u0159\u00edstupov\u00fdch opr\u00e1vn\u011bn\u00ed. Jako p\u0159\u00edklad m\u016f\u017ee b\u00fdt zam\u011bstnanec \u00fa\u010detn\u00edho odd\u011blen\u00ed. Ka\u017ed\u00fd zam\u011bstnanec z\u00edsk\u00e1 p\u0159i n\u00e1stupu automaticky firemn\u00ed emailov\u00fd \u00fa\u010det a pr\u00e1vo tisknout a to pomoc\u00ed p\u0159i\u0159azen\u00ed role.<\/p>

Provisioning\/deprovisioning u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f<\/strong>\u00a0<\/h3>

Jakmile je u\u017eivatel p\u0159ijat do organizace, mus\u00ed mu IT vytvo\u0159it p\u0159\u00edstupy do syst\u00e9m\u016f. Proto\u017ee by bylo \u010dasov\u011b n\u00e1ro\u010dn\u00e9 specifikovat p\u0159\u00edstupy ka\u017ed\u00e9ho jednotlivce ke ka\u017ed\u00e9mu syst\u00e9mu, syst\u00e9my spr\u00e1vy identit IAM umo\u017e\u0148uj\u00ed p\u0159i\u0159azov\u00e1n\u00ed p\u0159\u00edstupu na z\u00e1klad\u011b rol\u00ed (RBAC). U\u017eivatel\u016fm je p\u0159i\u0159azena jedna nebo v\u00edce rol\u00ed, obvykle na z\u00e1klad\u011b pracovn\u00ed pozice v organizaci.\u00a0<\/p>

\u010casov\u011b n\u00e1ro\u010dn\u00e9 tak\u00e9 b\u00fdv\u00e1 zru\u0161it p\u0159\u00edstupy ke v\u0161em aplikac\u00edm a syst\u00e9m\u016fm. Syst\u00e9m IAM automatizuje tento proces. Co\u017e je d\u016fle\u017eit\u00e9, proto\u017ee b\u00fdval\u00ed zam\u011bstnanci, kte\u0159\u00ed maj\u00ed st\u00e1le p\u0159\u00edstup, p\u0159edstavuj\u00ed v\u00e1\u017en\u00e9 bezpe\u010dnostn\u00ed riziko.\u00a0<\/p>

Ov\u011b\u0159en\u00ed u\u017eivatele (Autentizace)<\/strong><\/h3>

Syst\u00e9my IAM prov\u00e1d\u011bj\u00ed \u00falohu ov\u011b\u0159ov\u00e1n\u00ed u\u017eivatele, kdy\u017e u\u017eivatel po\u017eaduje p\u0159\u00edstup. Bezpe\u010dn\u00e9 ov\u011b\u0159ov\u00e1n\u00ed dnes znamen\u00e1 v\u00edcefaktorov\u00e9 ov\u011b\u0159ov\u00e1n\u00ed.\u00a0<\/p>

Autorizace u\u017eivatel\u016f<\/strong><\/h3>

Po ov\u011b\u0159en\u00ed (autentizaci) u\u017eivatele syst\u00e9m IAM u\u017eivatele autorizuje pro p\u0159\u00edstup ke konkr\u00e9tn\u00edm aplikac\u00edm a prost\u0159edk\u016fm. U\u017eivatel m\u00e1 tedy p\u0159\u00edstup k p\u0159edem jasn\u011b ur\u010den\u00fdm dat\u016fm a nedostane se tam kam nem\u00e1.\u00a0<\/p>

Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed \u2013 SSO<\/strong><\/h3>

Pomoc\u00ed syst\u00e9mu jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed (SSO) se u\u017eivatel\u00e9 mus\u00ed ov\u011b\u0159it (autentizovat) pouze jednou. Pot\u00e9 je u\u017eivateli umo\u017en\u011bn p\u0159\u00edstup do v\u0161ech syst\u00e9m\u016f bez nutnosti samostatn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed do ka\u017ed\u00e9ho syst\u00e9mu. Nap\u0159\u00edklad kdy\u017e se p\u0159ihl\u00e1s\u00edte do Googlu, jste automaticky p\u0159ihl\u00e1\u0161en do sv\u00fdch \u00fa\u010dt\u016f Gmail a YouTube. Jedn\u00e1 se o zjednodu\u0161en\u00ed pr\u00e1ce pro u\u017eivatele, kter\u00fd si nemus\u00ed pamatovat dal\u0161\u00ed hesla nebo loginy. Z\u00e1rove\u0148 lze z jedin\u00e9ho m\u00edsta centralizovan\u011b p\u0159\u00edstup odebrat.<\/p>

Hodn\u011b \u010dasu helpdesk tr\u00e1v\u00ed \u010dasto na tom, \u017ee si u\u017eivatel zapomn\u011bl heslo a je nutn\u00e9 jej resetovat. Z\u00e1rove\u0148 jak\u00fd komfort m\u00e1 u\u017eivatel, pokud si m\u00e1 pamatovat 10 hesel a k tomu je\u0161t\u011b o r\u016fzn\u00e9 d\u00e9lce s r\u016fzn\u00fdmi znaky (nepo\u010d\u00edt\u00e1m, \u017ee do kritick\u00fdch syst\u00e9m\u016f si ho ka\u017ed\u00e9 3 m\u011bs\u00edce mus\u00ed m\u011bnit). Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed redukuje po\u010det hesel, zvy\u0161uje komfort u\u017eivateli a sni\u017euje n\u00e1klady na helpdesk. Nap\u0159\u00edklad l\u00e9ka\u0159 v nemocnici se m\u00e1 soust\u0159edit na l\u00e9\u010den\u00ed pacient\u016f a ne \u0159e\u0161en\u00ed, \u017ee si op\u011btovn\u011b zapomn\u011bl heslo\u00a0<\/p>

Federovan\u00e1 identita (Federated identity management)<\/strong><\/h3>

Federovan\u00e1 spr\u00e1va identit v\u00e1m umo\u017e\u0148uje sd\u00edlet digit\u00e1ln\u00ed identitu s d\u016fv\u011bryhodn\u00fdmi partnery. Jedn\u00e1 se o mechanismus sd\u00edlen\u00ed ov\u011b\u0159en\u00ed identity (autentizace), kter\u00fd umo\u017e\u0148uje u\u017eivatel\u016fm pou\u017e\u00edvat stejn\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no, heslo nebo jin\u00e9 ID pro z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu do v\u00edce ne\u017e jedn\u00e9 s\u00edt\u011b.\u00a0<\/p>

Syst\u00e9m jednotn\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed (SSO) je d\u016fle\u017eitou sou\u010d\u00e1st\u00ed spr\u00e1vy federovan\u00fdch identit. Zat\u00edmco jednotn\u00e9 p\u0159ihl\u00e1\u0161en\u00ed SSO umo\u017e\u0148uje u\u017eivatel\u016fm p\u0159ihl\u00e1sit se k r\u016fzn\u00fdm syst\u00e9m\u016fm v organizaci, federovan\u00e1 identita d\u011bl\u00e1 tot\u00e9\u017e ve v\u00edce organizac\u00edch. Tento model funguje pouze mezi spolupracuj\u00edc\u00edmi organizacemi \u2013 zn\u00e1m\u00fdmi jako d\u016fv\u011bryhodn\u00ed partnee\u0159i -, kter\u00e9 v z\u00e1sad\u011b ru\u010d\u00ed za sv\u00e9 u\u017eivatele.<\/p>

P\u0159\u00ednosy funkc\u00ed Identity a Access Managementu<\/h2>

Implementace IAM firm\u011b m\u016f\u017ee zajistit v\u00fdznamnou konkuren\u010dn\u00ed v\u00fdhodu. V dne\u0161n\u00ed dob\u011b pot\u0159ebuje v\u011bt\u0161ina organizac\u00ed poskytnout u\u017eivatel\u016fm p\u0159\u00edstup k intern\u00edm syst\u00e9m\u016fm z vn\u011bj\u0161\u00ed s\u00edt\u011b. IAM organizaci umo\u017e\u0148uje roz\u0161\u00ed\u0159it p\u0159\u00edstup k jej\u00edm informa\u010dn\u00edm syst\u00e9m\u016fm nap\u0159\u00ed\u010d on-premise aplikacemi, mobiln\u00edmi aplikacemi a SaaS, ani\u017e by to ohrozilo zabezpe\u010den\u00ed. Poskytnut\u00edm p\u0159\u00edstupu z vn\u011bj\u0161\u00ed s\u00edt\u011b je mo\u017en\u00e9 zv\u00fd\u0161it produktivitu, spokojenost zam\u011bstnanc\u016f, v\u00fdzkum a v\u00fdvoj a v kone\u010dn\u00e9m d\u016fsledku i p\u0159\u00edjmy.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Identity a Access Management (IAM) je centralizovan\u00e1 spr\u00e1va identit a p\u0159\u00edstup\u016f. Z\u00e1kladn\u00ed funkce Identity a Access Managementu je o definov\u00e1n\u00ed a spr\u00e1v\u011b rol\u00ed a \u0159\u00edzen\u00ed p\u0159\u00edstup\u016f jednotliv\u00fdch u\u017eivatel\u016f s\u00edt\u011b. T\u011bmito u\u017eivateli mohou b\u00fdt z\u00e1kazn\u00edci nebo zam\u011bstnanci. D\u016fvodem, pro\u010d IAM je vyu\u017e\u00edv\u00e1na je, \u017ee IT syst\u00e9my jsou typicky heterogenn\u00ed a jsou dostupn\u00e9 po intern\u00ed s\u00edti. <\/p>\n","protected":false},"author":6,"featured_media":8386,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_theme","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[32,29],"tags":[],"class_list":["post-8369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-manager","category-access-manager"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=8369"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8369\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/8386"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=8369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=8369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=8369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}