{"id":8673,"date":"2024-01-17T15:14:26","date_gmt":"2024-01-17T14:14:26","guid":{"rendered":"https:\/\/www.idstory.com\/?p=8673"},"modified":"2024-03-04T14:45:51","modified_gmt":"2024-03-04T13:45:51","slug":"jak-spravne-nasadit-identity-management-do-produkce-a-vyhnout-se-problemum","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/jak-spravne-nasadit-identity-management-do-produkce-a-vyhnout-se-problemum\/","title":{"rendered":"Jak spr\u00e1vn\u011b nasadit Identity management do produkce a vyhnout se probl\u00e9m\u016fm?"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tImplementujete Identity management Pro\u0161li jste anal\u00fdzou, v\u00fdvojem a testov\u00e1n\u00edm vyvinut\u00e9ho \u0159e\u0161en\u00ed. Stoj\u00edte p\u0159ed nasazen\u00edm do produkce, co\u017e je velmi rizikov\u00e1 \u010d\u00e1st. Jak spr\u00e1vn\u011b postupovat p\u0159i p\u0159echodu s \u0159e\u0161en\u00edm Identity Managementu (IDM) do produktivn\u00edho provozu? Na co si d\u00e1t pozor? Kde jsou hlavn\u00ed rizika? Pokazit se p\u0159eci m\u016f\u017ee tolik v\u011bc\u00ed.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u010cl\u00e1nek je o praktick\u00fdch zku\u0161enostech z mnoha nasazen\u00ed, kter\u00fdmi jsme pro\u0161li. Je seps\u00e1n ve form\u011b checklistu, krok za krokem. Jedn\u00e1 se o nahl\u00e9dnut\u00ed do na\u0161\u00ed kuchyn\u011b, roky sb\u00edran\u00e9ho know-how.<\/p>

V\u0161e a\u017e na v\u00fdjimky (odkazy do dokumentace) je naps\u00e1no nez\u00e1visle na implementovan\u00fd produkt IdM.<\/p>

Existuj\u00ed dva z\u00e1kladn\u00ed typy projekt\u016f IDM dle velikosti:<\/p>

  1. \u00a0Mal\u00e9 projekty: \u00a0IDM se pouze instaluje a konfiguruje. Admin p\u0159ipoj\u00ed ke spr\u00e1v\u011b syst\u00e9my. Nen\u00ed t\u0159eba nic programovat.<\/li>
  2. V\u011bt\u0161\u00ed a velk\u00e9 integra\u010dn\u00ed projekty IDM. Data se transformuj\u00ed z v\u00edce syst\u00e9m\u016f a p\u0159en\u00e1\u0161\u00ed do dal\u0161\u00edch. Jsou nutn\u00e9 z\u00e1sahy v\u00fdvoj\u00e1\u0159\u016f na \u00fapravy proces\u016f.\u00a0<\/span><\/li><\/ol>

    Tento \u010dl\u00e1nek se v\u011bnuje druh\u00e9mu typu projekt\u016f, t\u011bm slo\u017eit\u011bj\u0161\u00edm integra\u010dn\u00edm projekt\u016fm.<\/p>

    Jak\u00e9 jsou nej\u010dast\u011bj\u0161\u00ed\u00a0p\u0159\u00ed\u010diny ne\u00fasp\u011bchu<\/strong>\u00a0nasazen\u00ed a jak jim p\u0159edej\u00edt:<\/p>

    1. P\u0159\u00edli\u0161n\u00e1 velikost projekt\u016f.<\/b>\u00a0\u00a0<\/span>V\u011bt\u0161\u00ed projekty doporu\u010duji rozd\u011blit na men\u0161\u00ed. Hledejte MVP \u2013 minimum viable product. Ten nasazujte do produkce a rychle zlep\u0161ujte. V\u00edm, b\u00fdv\u00e1 to t\u011b\u017ek\u00e9, co nezahrnout.<\/li>
    2. Smi\u0159te se s t\u00edm, \u017ee m\u00e1te v syst\u00e9mech\u00a0chybn\u00e1 data\u00a0<\/b>(duplicity, mrtv\u00e9 du\u0161e atd). Bohu\u017eel \u010dasto nejsou syst\u00e9my ani zdokumentovan\u00e9. Zmapovat data m\u016f\u017ee b\u00fdt extr\u00e9mn\u011b n\u00e1ro\u010dn\u00e9 nebo slo\u017eit\u00e9. Jak na to? Op\u011bt j\u00edt po men\u0161\u00edch projektech a iterac\u00edch. Nasadit, identifikovat probl\u00e9my pr\u016fb\u011bhu, opravit a rychle nasadit zlep\u0161en\u00ed.<\/li>
    3. Testing<\/b>\u00a0\u2013 na testov\u00e1n\u00ed je v\u017edy m\u00e1lo \u010dasu. Testov\u00e1n\u00ed je enorm\u011b drah\u00e9. Z\u00e1stupci z\u00e1kazn\u00edka maj\u00ed svou standardn\u00ed pr\u00e1ci, projekt IDM maj\u00ed \u010dasto nav\u00edc. Testovac\u00ed prost\u0159ed\u00ed je odli\u0161n\u00e9 od produkce apod. Toto je v\u011b\u010dn\u00e1 bolest v\u0161ech projekt\u016f. Testing si zaslou\u017e\u00ed vlastn\u00ed \u010dl\u00e1nek.\u00a0<\/span><\/li>
    4. Ned\u011blejte\u00a0zm\u011bny<\/b>\u00a0oproti anal\u00fdze a n\u00e1vrhu \u0159e\u0161en\u00ed\u00a0na posledn\u00ed chv\u00edli.<\/b>\u00a0Pokud zm\u011bny dovol\u00edte, zp\u016fsob\u00edte si pravd\u011bpodobn\u011b velk\u00e9 probl\u00e9my. Fixn\u00ed zad\u00e1n\u00ed u SW projekt\u016f bez mo\u017enost\u00ed zm\u011bn je ji\u017e p\u0159ekonan\u00fdm postupem. Postupujte agiln\u011b a iterativn\u011b.<\/li>
    5. M\u00e1te\u00a0nezn\u00e1m\u00e9 aplikace v s\u00edti<\/b>, vyu\u017e\u00edvaj\u00edc\u00ed identity v AD speci\u00e1ln\u00ed atributy. \u00a0Existuj\u00ed syst\u00e9my b\u011b\u017e\u00edc\u00ed des\u00edtky let a jejich funkce ji\u017e d\u00e1vno nejsou ve firm\u011b zn\u00e1m\u00e9. Anal\u00fdzou tedy \u010dasto nelze identifikovat. Lze \u0159e\u0161it testingem, ale ne v\u017edy pln\u011b.<\/li><\/ol>

      Obecn\u00e9 n\u00e1vyky<\/strong>\u00a0na bezprobl\u00e9mov\u00e1 nasazen\u00ed do produkce:<\/p>

      1. Chyby v datech jsou<\/b>\u00a0v\u017edy. P\u0159ijm\u011bte to. \u0158e\u0161te testingem a po nasazen\u00ed pilotn\u00edm provozem a rychl\u00fdmi n\u00e1pravami.\u00a0<\/span><\/li>
      2. I prvn\u00ed \u0159e\u0161en\u00ed\u00a0nasazujte<\/b>\u00a0do produkce\u00a0postupn\u011b<\/b>\u00a0a \u0159\u00edzen\u011b \u2013 po procesech, po syst\u00e9mech, po identit\u011b, po skupin\u011b identit. viz. cheklist<\/li>
      3. Testovac\u00ed prost\u0159ed\u00ed\u00a0<\/b>mus\u00ed b\u00fdt datov\u011b identick\u00e9. Pokud nen\u00ed, budou p\u0159i nasazen\u00ed probl\u00e9my. Postavit a provozovat testovac\u00ed prost\u0159ed\u00ed n\u011bco stoj\u00ed. Ale v kone\u010dn\u00e9m d\u016fsledku se vyplat\u00ed.<\/li>
      4. Pro\u0161kolte<\/strong>\u00a0kl\u00ed\u010dov\u00e9 u\u017eivatele IDM. Testovat mus\u00ed tak\u00e9 ti, kte\u0159\u00ed budou IDM ovl\u00e1dat. Mus\u00ed skute\u010dn\u011b proj\u00edt sv\u00e9 sc\u00e9n\u00e1\u0159e. Jedn\u00e1 se o kritickou \u010d\u00e1st testov\u00e1n\u00ed.\u00a0<\/span><\/li>
      5. Definujte\u00a0deploy proces<\/b>\u00a0a hl\u00eddejte jej. V\u00fdvoj\u00e1\u0159 nesm\u00ed zasahovat do produkce mimo tento proces. Tj. nasazuje se do produkce pouze to, co bylo otestov\u00e1no na testovac\u00edm prost\u0159ed\u00ed.\u00a0\u00a0<\/span><\/li>
      6. \u0158e\u0161en\u00ed IdM nepokr\u00fdv\u00e1 v\u0161echny mo\u017en\u00e9 v\u00fdjimky<\/b>\u00a0proces\u016f.<\/b>\u00a0\u010casto nem\u00e1 finan\u010dn\u011b\/\u010dasov\u011b smysl v\u0161e automatizovat syst\u00e9mem.\u00a0M\u011bjte \u010das<\/b>\u00a0na identifikaci v\u00fdjimek v testu i v produk\u010dn\u00edm provozu.<\/li>
      7. Sledujte co IdM d\u011bl\u00e1 na koncov\u00fdch syst\u00e9mech, nejen v IDM. Osv\u011bd\u010dilo se n\u00e1m d\u011blat diff nap\u0159\u00edklad z AD ldap LDIFF. D\u00e1 se tak podchytit nejv\u00edce zm\u011bn.<\/li>
      8. Nikomu nev\u011b\u0159te. \ud83d\ude42 Pokud v\u00e1m admin \u0159ekne, \u017ee koncov\u00fd syst\u00e9me zaz\u00e1lohoval, ud\u011blejte si\u00a0z\u00e1lohu sami<\/b>.\u00a0No kidding.<\/li>
      9. Tvo\u0159te sestavy zm\u011bn<\/b>\u00a0na \u00fa\u010dtech, kter\u00e9 pl\u00e1nuje IDM ud\u011blat a p\u0159ed\u00e1vejte je admin\u016fm k akceptaci. Teprve na z\u00e1klad\u011b t\u011bchto sestav se najde hromada chybn\u00fdch dat a v\u00fdjimek.\u00a0<\/span><\/li><\/ol>

        \u00a0<\/h3>

        Checklist nasazen\u00ed<\/strong><\/h3>

        M\u011bjme p\u0159\u00edklad IDM, kdy\u00a0napojujeme<\/strong>\u00a0HR<\/strong>\u00a0\u2013 SQL datab\u00e1zi a\u00a0Active Directory<\/strong>.<\/p>

        1. Ud\u011blejte si p\u0159\u00edpravu \u2013 harmonogram, checklist, rizika. Promyslete krok za krokem. Co se m\u016f\u017ee st\u00e1t \u0161patn\u00e9ho a jak to \u0159e\u0161it.<\/li>
        2. IDM jsme nainstalovali. Na to m\u00e1me extra checklist.\u00a0<\/span><\/li>
        3. Zkontrolujte, \u017ee na testu i produkci m\u00e1me identickou verzi IDM. Ov\u011b\u0159te shodnost workflow i pravidel.\u00a0<\/span><\/li>
        4. Zaz\u00e1lohujte data identit napojovan\u00fdch syst\u00e9m\u016f. U AD LDIF v\u0161ech strom\u016f a u SQL tabulky. M\u011bjte vy z\u00e1lohu, nev\u011b\u0159te \u017e\u00e1dn\u00e9mu syst\u00e9mu nebo jin\u00e9mu t\u00fdmu.<\/li>
        5. Z\u00e1lohujte IDM.<\/li>
        6. P\u0159epn\u011bte syst\u00e9my v IDM do read-only (RO)\u00a0\u00a0<\/span>re\u017eimu. V na\u0161em p\u0159\u00edpad\u011b AD a HR.<\/li>
        7. Vypn\u011bte star\u00e9 synchroniza\u010dn\u00ed skripty (pokud existuj\u00ed) mezi syst\u00e9my, kter\u00e9 IDM bude nahrazovat.<\/li>
        8. Vypn\u011bte v IDM automatick\u00e9 procesy, notifikace apod.<\/li>
        9. Rekoncilujte organiza\u010dn\u00ed strukturu z HR.<\/li>
        10. Rekoncilujte identity z HR a AD do IdM.<\/li>
        11. Vytvo\u0159te sestavu nesp\u00e1rovan\u00fdch identit. \u00a0\u010casto se jedn\u00e1 o mrtv\u00e9 du\u0161e nebo syst\u00e9mov\u00e9 \u00fa\u010dty admin\u016f nebo aplikac\u00ed. Kter\u00e9 identity se automaticky nesp\u00e1rovaly a pro\u010d?<\/li>
        12. Vy\u0159e\u0161te problematick\u00e9 identity. M\u016f\u017ee trvat del\u0161\u00ed \u010das.<\/li>
        13. Vyberte u\u017eivatele a toho z AD LDIFem zaz\u00e1lohujte. Viz. p\u0159\u00edklad striptu n\u00ed\u017ee.<\/li>
        14. Aktivujte v IDM spr\u00e1vu AD do R\/W.<\/li>
        15. Aktivujte brzdu provisioningu \u2013 kolik povolit zm\u011bn za jednotku \u010dasu?<\/li>
        16. Propi\u0161te jednoho u\u017eivatele do AD.
          1. St\u00e1hn\u011bte LDIF u\u017eivatele z AD a porovnejte DIFFem zm\u011bny. Jsou ok? Jsou spr\u00e1vn\u00e9?<\/li>
          2. Postupujte shodn\u011b u v\u0161ech typ\u016f u\u017eivatel\u016f nap\u0159\u00ed\u010d firmou. Logicky nejde zkontrolovat v\u0161echny, alespo\u0148 typy nap\u0159\u00ed\u010d firmou ano.<\/li><\/ol><\/li>
          3. Propi\u0161te v\u0161echny \u00fa\u010dty a zkontrolujte nam\u00e1tkou rozd\u00edly diffem koncov\u00e9ho syst\u00e9mu.<\/li>
          4. Aktivujte v IDM spr\u00e1vu AD do RO.<\/li>
          5. Person\u00e1ln\u00ed procesy z HR: spustit n\u00e1stup, odchod zm\u011bnu
            1. nejd\u0159\u00edve v RO, zkontrolovat frontu v CzechIdM k jak\u00fdm zm\u011bn\u00e1m doch\u00e1z\u00ed. Pod\u00edvat se do logu provisioningu.<\/li>
            2. Aktivujte v IDM spr\u00e1vu AD do R\/W.<\/li>
            3. Spus\u0165te person\u00e1ln\u00ed proces na jednom u\u017eivateli.<\/li>
            4. Ov\u011b\u0159te diffem v koncov\u00e9m syst\u00e9mu spr\u00e1vnost zm\u011bny.<\/li>
            5. Spus\u0165te proces na jednotk\u00e1ch u\u017eivatel\u016f. Zkontrolujte zm\u011bny diffem.<\/li>
            6. Spustit na v\u0161ech u\u017eivatel\u00edch a LDIF nam\u00e1tkov\u011b zkontrolovat.<\/li><\/ol><\/li>
            7. N\u00e1sledn\u011b synchronizovat skupiny v AD do IDM dle p\u0159edchoz\u00edho postupu.<\/li>
            8. Zkontrolujte aktivaci v\u0161ech proces\u016f, notifikac\u00ed atd.<\/li>
            9. Dejte pozor na notifikace. Aby nedo\u0161lo k neo\u010dek\u00e1van\u00e9 notifikace u\u017eivatel\u016f maily, kter\u00e9 nechcete poslat.<\/li>
            10. Zm\u011b\u0148te brzdu provisioningu do produk\u010dn\u00edho nastaven\u00ed.<\/li>
            11. Zkontrolujte syst\u00e9mov\u00e9 prost\u0159edky IDM, logov\u00e1n\u00ed, vyu\u017eit\u00ed diskov\u00e9ho prostoru, vyt\u00ed\u017een\u00ed atd.<\/li>
            12. Projd\u011bte kl\u00ed\u010dov\u00e9 sc\u00e9n\u00e1\u0159e s pracovn\u00edky, kte\u0159\u00ed budou IDM vyu\u017e\u00edvat.\u00a0Znovu pro\u0161kolte.<\/span><\/li>
            13. Zaevidujte zm\u011bny na produk\u010dn\u00edm prost\u0159ed\u00ed do servisn\u00edho syst\u00e9mu a dokumentace.<\/li>
            14. Zaz\u00e1lohujte IDM, AD LDIFF.<\/li>
            15. Aktivujte monitoring IDM. (nagios apod.)<\/li>
            16. 14 dn\u00ed v\u011bnujte \u0159e\u0161en\u00ed zv\u00fd\u0161enou pozornost. Aktivn\u011b sledujte logy a synchronizace, zejm\u00e9na na chybn\u00e1 data a nepokryt\u00e9 procesy. D\u00e1le dozorujte u\u017eivatele, zda \u0159e\u0161en\u00ed vyu\u017e\u00edvaj\u00ed dle pl\u00e1nu.<\/li><\/ol>

              \u00a0<\/p>

              Z\u00e1v\u011br<\/strong><\/h3>

              Nasazen\u00ed Identity Managementu m\u016f\u017ee zabrat pom\u011brn\u011b dost \u010dasu a pr\u00e1ce. Pro \u00fasp\u011bch je z\u00e1sadn\u00ed p\u0159\u00edprava. Ro\u010dn\u011b nasazujeme des\u00edtky \u0159e\u0161en\u00ed IDM. Ka\u017ed\u00e9 je v n\u011b\u010dem zaj\u00edmav\u00e9, jin\u00e9. Postupn\u011b si tvo\u0159\u00edme takov\u00e9to checklisty, kter\u00e9 velmi pom\u00e1haj\u00ed.<\/p>

              \u010cl\u00e1nek ne\u0159e\u0161\u00ed \u010dasovou n\u00e1ro\u010dnost. Ka\u017ed\u00fd napojovan\u00fd syst\u00e9m m\u00e1 jinou slo\u017eitost \u2013 mno\u017estv\u00ed u\u017eivatel\u016f, hloubku integrace s IDM. IDM dle slo\u017eitosti integrace napojujeme do produk\u010dn\u00edho provozu v r\u00e1mci hodin, ale i dn\u00ed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

              Implementujete Identity management Pro\u0161li jste anal\u00fdzou, v\u00fdvojem a testov\u00e1n\u00edm vyvinut\u00e9ho \u0159e\u0161en\u00ed. Stoj\u00edte p\u0159ed nasazen\u00edm do produkce, co\u017e je velmi rizikov\u00e1 \u010d\u00e1st. Jak spr\u00e1vn\u011b postupovat p\u0159i p\u0159echodu s \u0159e\u0161en\u00edm Identity Managementu (IDM) do produktivn\u00edho provozu? Na co si d\u00e1t pozor? Kde jsou hlavn\u00ed rizika? Pokazit se p\u0159eci m\u016f\u017ee tolik v\u011bc\u00ed.<\/p>\n","protected":false},"author":6,"featured_media":8674,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_theme","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[32],"tags":[],"class_list":["post-8673","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-manager"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=8673"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8673\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/8674"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=8673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=8673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=8673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}