Enterprise Scale User Provisioning

with Hitachi ID Identity Manager

© 2011 Hitachi ID Systems, Inc. All rights reserved.

This document describes the business problems of user provisioning: slow resource provisioning, redundant systems administration and unreliable access termination. It then describes how Identity Manager addresses these problems with process change and user provisioning technology. Finally, the business benefits of effective user provisioning are described.

Contents
1 Introduction 2 Business Challenges Related to Identity and Privilege Management 3 Shared Infrastructure for Identity Management 4 Streamlined User Provisioning Processes 4.1 4.2 4.3 4.4 4.5 4.6 4.7 User Lifecycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Automated Change Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change Request Workflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Templates and Roles to Simplify Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 2 4 4 4 7 8

Consolidated and Delegated Security Administration . . . . . . . . . . . . . . . . . . . . . . 10 Enterprise-wide Security Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Web Services Flexibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 13

5 Identity Manager Technology 5.1 5.2 5.3 5.4 5.5 5.6

Network Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Supported Target Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Process Integration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Rapid Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 21 22

6 Return on Investment 7 Summary

APPENDICES
A Management Suite Overview

23
24

i

Enterprise Scale User Provisioning with Identity Manager

1

Introduction

This document describes the business problems of user provisioning: slow resource provisioning, redundant systems administration and unreliable access termination. It then describes how Hitachi ID Identity Manager addresses these problems with process change and user provisioning technology. Finally, the business benefits of effective user provisioning are described. Identity Manager is the user provisioning component of Hitachi ID Management Suite. Management Suite is described in Appendix A on Page 24. The remainder of this document is organized as follows: • Business Challenges Related to Identity and Privilege Management The motivation for deploying Identity Manager. • Shared Infrastructure for Identity Management How the proliferation of systems, each with their own user database, creates an administrative problem, and how consolidating administration of user identity can help. • Streamlined User Provisioning Processes How Identity Manager simplifies management of user identity data across multiple, heterogeneous systems. • Identity Manager Technology The Identity Manager network architecture, and design features that make it scalable, secure and deployable. • Return on Investment A basic ROI model describing how Identity Manager can generate significant cost savings. • Summary

© 2011 Hitachi ID Systems, Inc. All rights reserved.

1

Enterprise Scale User Provisioning with Hitachi ID Identity Manager

2

Business Challenges Related to Identity and Privilege Management

Several factors combine to make management of users and their security rights a growing challenge for many organizations: • The number of individual systems and platforms that users must access is large and growing. • Users are increasingly dependent on systems access: they cannot do their jobs without it. • Organizations cannot afford additional IT staffing to cope with the growing burden of systems administration. On the contrary, most organizations would prefer to reduce the size of IT as a proportion of organization size. These factors lead to the following costly business problems: • Overloaded administration: Access / security administrators are overworked. This leads to staff burn-out and turn-over. Overloaded administrators are prone to make errors, and improperly assign privileges. • Lost productivity: Requests for new access are delayed, and the productivity of users waiting for new access rights is reduced. • Security risk: System access persists even after users change responsibility or leave an organization. This is not only a serious security vulnerability, but can violate regulatory requirements for effective internal controls. Hitachi ID Identity Manager is an automated user provisioning solution, designed to address these challenges.

3

Shared Infrastructure for Identity Management

Systems administration burden is growing because there are an increasing number of systems to manage, and because almost every system manages user profiles in its own silo. For example, a single (human) user might have a personal profile on the mainframe, an LDAP directory, an e-mail system, an ERP system and elsewhere. Each of these systems is managed separately – by different administrators, using different tools. The natural solution for this problem is to consolidate information about users (sometimes referred to as user directories or security databases) into a single repository, and configure every system to refer to that single repository as an authoritative system of record regarding user identity. This approach has some merit, hence the popularity of LDAP. However, it also has problems:
© 2011 Hitachi ID Systems, Inc. All rights reserved.

2

Enterprise Scale User Provisioning with Identity Manager

• Many systems are not compatible with LDAP, and cannot externalize their user/security databases. • Some systems that can externalize user data can only do so for some attributes, and continue to have internal user profiles, which must still be managed directly. • Many systems require data about users that is special to them, and would not benefit any other part of the IT infrastructure. If the data storage requirements of every application were added to a single LDAP directory, then the schema would grow to thousands of attributes per user – thus creating new performance, scalability, reliability and management problems. • Some user-related data is confidential, and does not belong in a shared directory. The result of these problems is that while LDAP has helped to slow the proliferation of user databases, organizations continue to require, and must still manage, multiple systems that house data about users. Since most organizations continue to have multiple user directories, the next best solution is to implement consolidated processes to manage user objects and access rights across multiple systems. Identity Manager is designed to provide a shared set of processes and infrastructure to manage users and access across heterogeneous systems. It implements multiple processes that an organization can use to provision, update and deactivate user access to multiple systems.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

3

Enterprise Scale User Provisioning with Identity Manager

4
4.1

Streamlined User Provisioning Processes
User Lifecycle

The basic lifecycle of identity management begins with hiring a user. This business event triggers creation of one or more system login accounts and other user objects (e.g., HR record, phone book entries, etc.). Over time, the user will make numerous routine password changes, and may periodically forget his password, and require an administrative password reset on one or more systems. As the user moves through an organization, changing job functions and possibly locations, the systems he must access, and his required privileges on those systems will change. Finally, when a user leaves an organization, his access rights must be terminated. In most cases, his login accounts and related data objects persist for a while, until they are no longer required. In many organizations, user identifiers are never reused, to support long-term audit trails. Each of the above processes is traditionally handled separately on each system. Each system has its own internal directory of users and its own administration console. Typically, different IT staff manage users, passwords and privileges on different systems. Hitachi ID Identity Manager, a part of the Hitachi ID Management Suite, is designed to leverage a single set of business processes to manage users and access rights on multiple systems, as illustrated in Figure 1.

Figure 1: User Lifecycle Management

4.2

Automated Change Propagation

Hitachi ID Identity Manager can monitor one or more systems of record on a periodic basis (e.g., nightly or every few hours), enumerating new, deleted and changed users. In the case of an HR application, for example, these changes may represent new hires, terminations and transfers. Auto-discovery is performed on all integrated systems and applications – not just systems of record.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

4

Enterprise Scale User Provisioning with Identity Manager

Changes detected by Identity Manager are passed through a data filter, which removes users that are outside Identity Manager’s scope. For instance, in a scenario where Identity Manager manages all users in one country, but the HR system is global, Identity Manager would ignore changes to users from other countries. All changes to a given user are aggregated and business logic is executed, with the set of changes as input. This is best illustrated with some examples: Detected change New user appears in an HR application. Actions • Lookup appropriate role based on the user’s location and job code. • Submit a change request to the Identity Manager workflow engine, to create a new user, with the HR-provided identity attributes and with resources specified by the role. • White pages has a higher priority for the phone number attribute than other systems. • Submit a change request to the Identity Manager workflow engine, to change the phone number in the user’s profile. • Once approved (most likely automatically), the new phone number is mapped to other login IDs belonging to the user and connectors are run to update this information on other systems. • Using the identity synchronization mechanism described above, set this date on the user’s profile. • A separate batch process periodically identifies users with today or earlier termination dates and submits requests to disable all accounts for every matching user. • Lookup all of a user’s login IDs. • Submit a "disable all accounts" change request to the Identity Manager workflow engine. • Given the source of the request (employee gone from HR), this type of change may be auto-approved. Net result Autoprovisioning.

New phone number detected on white pages directory.

Identity synchronization.

Change to termination date is detected on the HR system.

Automated termination.

User disappears from system of record (HR).

Automated termination (2nd method).

© 2011 Hitachi ID Systems, Inc. All rights reserved.

5

Enterprise Scale User Provisioning with Identity Manager

Detected change User was added to Administrators group on Active Directory domain.

Actions • Since the change was detected on AD, it follows that it was not initiated by Identity Manager. • Submit two change requests to the workflow engine: • Remove the user from the Administrators group (this is an auto-approved change). • Add the user from the Administrators group (requires approval). • Create a security incident in the help desk system.

Net result Detect unauthorized privilege escalation.

Collectively, these processes are known as automated user management. They are implemented by the ID-Track component in Identity Manager. Several Identity Manager modules are involved in automated user management: 1. The PSUPDATE auto-discovery engine, which extracts lists of users, attributes, groups and group memberships from every integrated system and application. In most deployments, PSUPDATE runs nightly. 2. The LOADDB batch loader, which collects detected changes to users on target systems and updates the internal identity cache accordingly. 3. Login ID mapping data, which connects unique user identifiers on different systems. For example, this may map employee numbers in HR to login IDs on other systems. This data may be the produced through consistent login IDs, mapping other attributes or self-service reconciliation initiated through invitations sent to users. 4. The ID-Track module, which aggregates changes on a per-user basis and executes organizationspecific business logic for each changed user. This business logic typically submits workflow change requests based on detected changes. 5. The API service, which accepts change requests from ID-Track and/or external programs and submits them to the workflow service. 6. The IDWFM workflow service, which accepts change requests, validates them, fills in missing data (e.g., assigning login IDs and e-mail addresses), selects suitable authorizers and invites them to approve or reject each change. 7. The IDTM transaction manager, which accepts approved changes from the workflow engine and runs connectors to effect changes. IDTM retries failed updates to enable reliable updates to target systems. 8. A set of connectors, almost all of which run locally on the Identity Manager server, each of which is designed to discover and manage users on a particular type of system or application.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

6

Enterprise Scale User Provisioning with Identity Manager

4.3

Change Request Workflow

A key capability in Hitachi ID Identity Manager is to accept change requests, to route them to the appropriate authorizers, and to act on change requests once sufficient authority has been received. This is designed to streamline requests, and to eliminate the need for system administrators to manually fulfill authorized changes. Identity Manager’s workflow automation engine streamlines the process of requesting and authorizing the creation of new accounts, as well as other security changes such as adding/removing group membership, changing attribute values, renaming or moving accounts, deleting or deactivating accounts and so on. The Identity Manager workflow engine accepts change requests from the Identity Manager web UI, the Identity Manager web services API or the auto-provisioning engine. Its main task is to validate change requests and manage authorization of changes by business users, who are invited to review requests via e-mail and provide approval via the web UI. The workflow automation engine works as follows: • Request input: – Users can authenticate to the system and make change requests. – Third party programs can submit change requests via a web services API. – The unattended Identity Manager process used to implement auto-provisioning, auto-deactivation and identity synchronization can submit change requests programmatically. – Change requests are formulated as changes to user profiles – the requester’s own (self-service) or another user’s (the recipient). – Change requests may be to update profile attributes, add new accounts, add or remove group memberships, enable or disable accounts, etc. – Plug-in programs can limit or alter requests – for example by limiting who can submit a given type of request, for whom they can make requests and by validating or populating the contents of a request. • Request routing: – Requests are automatically routed to appropriate authorizers, which are selected based on the identities of the requester and recipient plus the specified operations and resources. – All authorizers are prompted to respond concurrently. 1. Authorizers may delegate their responsibility in advance if they plan to be unavailable for an extended period. 2. Identity Manager can check an authorizer’s out-of-office status in an e-mail system (example: Exchange) and preemptively escalate the request to someone else. – In most cases, a response is only required from a subset of the authorizers – for example, any one of three people can approve a new account on a given application. – Authorizers are notified by e-mail that their input is required. They click on a URL embedded in the e-mail to respond.
© 2011 Hitachi ID Systems, Inc. All rights reserved.

7

Enterprise Scale User Provisioning with Identity Manager

– Reminders are sent to non-responsive authorizers. – If an authorizer fails to respond after too many reminders, a new authorizer is selected by escalation logic. • Authorization: – Authorizers review requests using a web form, over a secure connection (HTTPS). – Authorizers normally have to sign in before they can approve a request. • Executing approved requests: – Once sufficient approvals has been collected, Identity Manager will generally apply the requested changes to target systems. – For un-integrated systems, Identity Manager can execute a separate workflow process to invite “implementers” (typically system administrators) to make the approved change manually. Reminders, escalation and delegation apply to this workflow as well. Workflow is used in Identity Manager to approve change requests, to implement approved requests, to certify user access and more. A participant in the workflow process is a person who is being asked to complete a task, most commonly change authorization. The Identity Manager workflow engine has built-in support for automatic reminders, escalation and delegation, so as to elicit reliable responses from individually-unreliable users: • When participants are first chosen, their out-of-office status on their primary e-mail system may be checked, to trigger early escalation to an alternate participant. • Non-responsive participants that have been asked to review a request receive automatic reminders. The reminder interval is configurable. • Participants who remain non-responsive (too many reminders) are automatically replaced with alternate participants, identified using escalation business logic. Escalation is most often based on OrgChart data – i.e., the original authorizer’s direct manager is often the escalated authorizer. • Participants can pro-actively delegate their authority, temporarily or permanently. Delegation may trigger its own approval – asking the new participant to accept a new responsibility. • A workflow manager can reassign participants attached to open requests, for instance when they are terminated or when a request is urgent and already-assigned participants are not available.

4.4

Templates and Roles to Simplify Configuration

Hitachi ID Identity Manager can create login accounts using templates and roles: • Rather than requiring an administrator to provide every parameter when creating a new account on a target system, Identity Manager can copy all relevant parameters from a template account. In effect, Identity Manager implements a “clone user” operation.
© 2011 Hitachi ID Systems, Inc. All rights reserved.

8

Enterprise Scale User Provisioning with Identity Manager

• Note that not every user object on every target system can or should be cloned. Requiring the organization administrators to name the accounts which should be available as templates ensures that users whose profiles have accumulated excess entitlements over time are not cloned. • Change requests, automated processes or updates initiated by administrators may specify attributes that override those copied from the template. For example, a new account may be created by copying a model account but overriding the employee number, phone number, e-mail address, login ID, directory OU, home directory server, mail server, etc. • Attributes may be entered by a user or administrator (e.g., phone number), may be validated by a plug-in that implements business logic (e.g., building code) or may be assigned by a plug-in that implements business logic (e.g., login ID, directory OU, e-mail address). Plug-ins embody business rules, and may be as simple or as complex as required. • Template accounts and membership in security groups can be collected into named sets called roles. This allows requests to specify whole sets of entitlements, rather than individual accounts and groups, should be granted or revoked. This simplifies the UI for business users, who may not have a clear, technically accurate idea of what entitlements to ask for. • Roles may be functional – i.e., encapsulating all the entitlements needed by a given class of user. • Roles may also be application-oriented – i.e., encapsulating a commonly used set of entitlements within one or more applications. • Functional roles are appropriate for large groups of users with identical business responsibilities. • Functional roles are also an excellent baseline for all users. For example, a functional role may be defined for “basic network and e-mail access.” • Application-oriented or technical roles are appropriate for users whose requirements are relatively unique. • Roles can be nested, to simplify definition of complex sets of entitlements. For example, functional roles can and typically should be composed of application roles, which in turn encapsulate fine-grained entitlements on target systems. • Change requests may include adding or removing roles, adding or removing accounts, adding or removing group memberships and updating profile attributes. Identity Manager does not require that users be classified into roles. Identity Manager can be configured to compare users’ actual security entitlements on target systems to the entitlements that their assigned roles predict and to automatically make adjustments to bring users into compliance. This process is called RBAC enforcement. RBAC enforcement is not a mandatory component of Identity Manager and indeed the scope of enforcement can be controlled at multiple levels: 1. Users can be enabled/disabled for enforcement. 2. Roles can be enabled/disabled for enforcement.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

9

Enterprise Scale User Provisioning with Identity Manager

3. Entitlements (i.e., accounts on target systems and security groups whose membership is managed by Identity Manager can be enabled/disabled for enforcement). 4. The number of users whose profiles are subjected to enforcement per day can be capped. These mechanisms allow Hitachi ID Systems customers to use RBAC enforcement – or not – based on the appropriateness of this mechanism to their environment. In general, we have found that RBAC enforcement is manageable for large numbers of users with identical needs (e.g., point of sale, retail, etc.) and to small numbers of high-risk users (e.g., finance/budget) but not usually cost-effective for other, unique, back-office user populations. Attributes can be attached to templates, groups and roles in Identity Manager, to make them easier to find. For example, these resources can be classified by type and location and automatically assigned, filtered on search results, etc. accordingly.

4.5

Consolidated and Delegated Security Administration

Delegated user administration makes it possible to grant limited security privileges to departmental or regional staff. For example, an IT administrator at a business unit may be allowed to create accounts for user users in that business unit, and manage the user profiles and access privileges of local users. The same IT administrator would be unable to access user profiles for staff working in other business units and may only be able to perform certain types of updates, on certain systems. Delegated user administration is implemented in the same manner as consolidated user administration, but with the addition of access controls, as is illustrated in Figure 2.
Transaction Manager
refresh current state
Connectors

Security admin UI

Administrators

read current state

Identity Cache

Create, delete, update accounts

Target Systems

Figure 2: Consolidated and Delegated User Administration Console The scope of authority of a given security administrator can be limited to certain users, certain systems, certain groups or certain OUs. Access controls are normally implemented using business logic, which accesses information about both the administrator and intended recipients of security changes, to dynamically determine what kinds of updates are allowed.

4.6

Enterprise-wide Security Reporting

All data in Hitachi ID Identity Manager is available via SQL and accessible using standard analytical tools (Crystal Reports, Cognos, MS-Excel, SQL queries, etc). The schema is well documented and is available to all product licensees and evaluators under NDA. The current release schema documentation is about 127 pages long, and includes detailed descriptions of every field, table, relation, value constraint, etc.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

10

Enterprise Scale User Provisioning with Identity Manager

Data available through Identity Manager includes: • • • • • • A list of IDs per user. A list of IDs per system. A list of IDs per group. Allocation of login IDs to user profiles. Full detail of transaction history. Additional identity attributes (e.g., roles, employee ID) for users who were created using Identity Manager. • Select identity attributes drawn from target systems – such as last login time/date, account enabled/disabled, etc. Identity Manager includes a number of standard reports, available through a web user interface, from the command-line, or by e-mail: • • • • • • • • • • • • • • Orphan and dormant accounts. Users who have accounts on specific systems. Templates and roles that a particular user has been assigned. User groups available on target systems. Membership of users in user groups on target systems. Transaction history per time period. Authorizer actions. Delegations (current and pending). Implementer definitions. Physical inventory availability. Requests, by status, state and result. Request statistics. Identity attributes, by user and by system. Past Reports.

Advantages of the reporting subsystem in Identity Manager include: • The Identity Manager schema is a simple, relational, SQL-based database. This makes it open to reports by third party programs, such as Crystal Reports or Cognos. In comparison, some competing products (most notably from Sun) store all their data in opaque XML objects and are therefore not accessible to third party reporting software. • A rich set of built-in reports, including lists of users, accounts, group memberships, workflow requests, etc. • Dual-format output (HTML, CSV) in all reports. These formats are readily convertible to Excel, Word, PDF, etc. • Asynchronous report generation – i.e,. generate a report, and browse the output while the report is still running. • Reports can be scheduled and data selection criteria can be relative to the run date. This supports constructs such as “run a weekly report on workflow requests, including all requests submitted in the trailing 7 days and e-mail the output to...”
© 2011 Hitachi ID Systems, Inc. All rights reserved.

11

Enterprise Scale User Provisioning with Identity Manager

• Hitachi ID Systems provides full schema documentation is provided, which is guaranteed correct, as it is automatically generated from the same source code that produces the SQL tables.

4.7

Web Services Flexibility

A web services API (application programming interface) is exposed by Hitachi ID Identity Manager, allowing other applications to access the workflow request queue and data about users and resources. The API is accessed using SOAP and includes a WSDL specification. This makes it accessible across a wide range of platforms and programming languages, including Windows and Unix, .NET and J2EE, Perl, Python and PHP, etc. The Identity Manager API supports a wide range of operations, including: • Submitting new workflow requests. This includes requests to: – Create new user profiles. – Add login accounts to new or existing profiles. – Add users to or remove users from managed groups. – Assign roles to users or remove roles from users. – Get or set user identity attributes. • Initiating previously configured certification rounds. • Searching for users or roles matching specified criteria. • Creating, updating or deleting roles. • Getting or changing the set of authorizers attached to a request. • Approving or rejecting open requests. The API allows organizations to develop their own request forms without having to code custom validation or authorization logic and without having to develop integrations with target systems and applications where users will be provisioned. This is helpful for specialized onboarding applications or to connect Identity Manager to an IT service catalog, for example.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

12

Enterprise Scale User Provisioning with Identity Manager

5
5.1

Identity Manager Technology
Network Architecture

Hitachi ID Identity Manager is designed for: • Security: Identity Manager is installed on hardened servers. All sensitive data is encrypted in storage and transit. Strong authentication and access controls protect business processes. • Scalability: Multiple Identity Manager servers can be installed, using a built-in data replication facility. Workload can be distributed using any load-balancing technology (IP, DNS, etc.). The end result is a multimaster, distributed architecture that is very easy to setup, as replication is handled at the application layer. • Performance: Identity Manager uses a normalized, relational and indexed database back end. All access to the database is via stored procedures, which help to minimize communication overhead between the application and database. All Identity Manager code is native code, which provides a 2x to 10x performance advantage as compared to Java or .NET • Openness: Open standards are used for inbound integration (SOAP) and outbound communications (SOAP, SMTP, HTTP, etc.). • Flexibility: Both the Identity Manager user interface and all functionality can be customized to meet enterprise requirements. • Low TCO: Identity Manager is easy to set up and requires minimal ongoing administration. Figure 3 on Page 14 illustrates the Identity Manager network architecture: • Users normally access Identity Manager using HTTPS from a web browser. • Multiple Identity Manager servers may be load balanced using either an IP-level device (e.g., Cisco Local Director, F5 Big/IP) or simply using DNS round-robin distribution. • Users may call an IVR (interactive voice response) system with a telephone and be authenticated either using touch-tone input of personal information or using a voice print. Authenticated users may initiate a password reset. • Identity Manager connects to most target systems using their native APIs and protocols and thus requires no software to be installed locally on those systems.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

13

Enterprise Scale User Provisioning with Identity Manager

User

, nix , U 0, AD S/39 P, O DA 0 d e L S40 tiv or Na assw ge A p han Password c Synch Trigger Systems lid Va ate PW

IVR Server

VPN Server

Reverse Web Proxy

Hitachi ID Application Server(s)
SQL DB

Target Systems with local agent: OS/390, Unix, older RSA

d, ste ho ps ud ap Clo aaS S

Load Balancer

We

ice er v bS

s

Target Systems with remote agent: AD, SQL, SAP, Notes, etc

SQL DB

ails Em
SMTP or Notes Mail TCP/IP + AES Various Protocols Secure Native Protocol HTTPS

SQL/Oracle

& Incident up ok Management Lo System System of
Record

ts ke Tic

Firewall

ca Lo

etw lN

ork

Target Systems

g Tri

r ge
Firewall

Re
Proxy Server (if needed)

t mo

n Ce ta a eD

ter

Figure 3: Network architecture diagram • Local agents are provided and recommended for Unix servers and z/OS mainframes. Use of these agents improves transaction security, speed and concurrency. • A local agent is mandatory on RSA SecurID servers. • Where target systems are remote and communication with them is slow, insecure or both, a Identity Manager proxy server may be co-located with the target system in the remote location. In this case, servers in the main Identity Manager server cluster initiate fast, secure connections to the remote proxies, which decode these transactions and forward them to target systems locally, using native, slow and/or insecure protocols. • Identity Manager can look up and update user profile data in an existing system, including HR databases (ODBC), directories (LDAP) and meta-directories (e.g., WMI to Microsoft ILM). • Identity Manager can send e-mails to users asking them to register or to notify them of events impacting their profiles. Over 189 events can trigger e-mail notification. • Identity Manager can create tickets on most common incident management systems, either recording completed activity or requesting assistance (security events, user service follow-up, etc.). Over 189 events can trigger ticket generation. Binary integrations are available for 16 help desk applications and open integration is possible using mail, ODBC, SQL and web services.

5.2

Supported Target Platforms

Hitachi ID Identity Manager has built-in integration for many common types of systems, plus programmable agents that can be readily adapted to manage IDs and passwords on applications and hosted services.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

14

Enterprise Scale User Provisioning with Identity Manager

The supported platforms may be summarized as follows: Directories: Any LDAP, AD, NDS, eDirectory, NIS/NIS+. Unix: Linux, Solaris, AIX, HPUX, 24 more. ERP: JDE, Oracle eBiz, PeopleSoft, SAP R/3, Siebel, Business Objects. WebSSO: CA Siteminder, IBM TAM, Oracle AM, RSA Access Manager. Servers: Windows 2000, 2003, 2008, Samba, Novell, SharePoint. Mainframes: z/OS with RAC/F, ACF/2 or TopSecret. Collaboration: Lotus Notes, Exchange, GroupWise, BlackBerry ES. Help Desk: BMC Remedy, BMC SDE, HP Service Manager, CA Unicenter, Assyst, HEAT, Altiris, etc. Databases: Oracle, Sybase, SQL Server, DB2/UDB, ODBC. Midrange: iSeries (OS400), OpenVMS. Tokens, Smart Cards: RSA SecurID, SafeWord, RADIUS, ActivIdentity, Schlumberger. HDD Encryption: McAfee, CheckPoint.

Identity Manager includes a number of flexible connectors, each of which is used to script integration with a common protocol or mechanism. These connectors allow organizations to quickly and inexpensively integrate Identity Manager with custom and vertical market applications. The ability to quickly and inexpensively add integrations increases the value of the Identity Manager system as a whole. There are flexible connectors to script interaction with: API binding: Terminal emulation: • SSH • Telnet • TN3270, TN5250 • Simulated browser Web services: Back end integration: • SQL Injection • LDAP attributes Command-line:

• • • •

C, C++ Java, J2EE .NET COM, ActiveX • MQ Series

• SOAP • WebRPC • Pure HTTP(S)

• Windows • PowerShell • Unix/Linux

Organizations that wish to write a completely new connector to integrate with a custom or vertical market application may do so using whatever development environment they prefer (J2EE, .NET, Perl, etc.) and invoke it as either a command-line program or web service. If the organization develops their own integrations, an effort of between four hours and four days is typical. Alternately, Hitachi ID Systems offers fixed-cost custom integrations for a nominal fee. In most cases, Identity Manager does not require the installation of local agent software on target servers and applications. The only exceptions to this are two applications which do not publish a remote administration facility at all: RSA Authentication Manager servers and Entrust getAccess servers. Identity Manager also includes local agents that can be installed on Unix servers and z/OS mainframes.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

15

Enterprise Scale User Provisioning with Identity Manager

While users and passwords on these systems can be managed without a local agent – by emulating a terminal session over a Telnet, TN3270 or SSH protocol – such terminal connections are slower, less reliable and (except for SSH) less secure than a local agent. Ultimately, the organization must decide whether reduced change control or more secure, fast and reliable administration are more important on Unix and z/OS systems and therefore make a determination about whether local agents are desirable on these systems. In no case do the provided local agents interfere with the target system’s normal operation – the login process on each target system remains the same and no significant CPU or other load is placed on target systems.

5.3

Process Integration

Identity management is integral to an organization’s business processes, and Hitachi ID Identity Manager is designed to integrate with existing processes and systems: • Monitoring authoritative directories / rules-based user provisioning Identity Manager can monitor an existing system of reference, and create or delete accounts on target systems based on changes. This works with HR systems, LDAP directories or simple text file extracts. • Routing requests By default, change requests are routed based on the resources specified. For example, all requests for accounts payable access go to one or more authorizers attached to that account type. The list of authorizers required to approve a request may be adjusted based on other variables: – The identity of the requester (e.g., Executives submitting requests may not require approval; others may require approval by someone in their management chain.) – The identity of the recipient. – Other attributes of the request (location, department code, etc.). To maximize flexibility, the process of adjusting the list of authorizers is implemented with a plugin architecture. • Assigning new, standard login IDs Login IDs for new accounts can be assigned manually by a designated approver, or automatically by a plugin program that implements site-specific logic (for example, rules such as first initial + last name + unique digit). • Escalating requests for authority Identity Manager supports many features to ensure that requests for authorization are satisfied quickly: – Grouping authorizers, and only requiring approval from a subset of each group. – Temporarily delegating authority, so that authorizers can safely leave for holidays and other absences.
© 2011 Hitachi ID Systems, Inc. All rights reserved.

16

Enterprise Scale User Provisioning with Identity Manager

– Sending reminders to unresponsive authorizers. – Automatically escalating unfulfilled requests for approval. • Acting on behalf of existing processes Some organizations already have a working, automated process to submit, route and approve change requests. What these organizations require is automation to act on approved requests. Identity Manager exposes both a web service and library-level RPCs to enable existing workflow processes to trigger administration actions, such as creating new accounts and updating or deactivating existing ones, on target systems.

5.4

Scalability

Scalability in a combined system for user provisioning and password management is primarily determined by the password management component: • User provisioning is fairly uniform over time – change requests and administrative actions may take place on any day, at any hour. • In contrast, password management is very bursty. Most password changes happen at login time, in the morning. The largest spikes occur in the first work hour after a long weekend or holiday. • Password management is used multiple times per year by every user, unlike user provisioning which often has no UI (automation) and/or is used infrequently (e.g., just by managers when they hire/fire). Typical peak transaction rates for a 10,000 person organization are 10 events/hour for provisioning and 5,000 events/hour for password synchronization. Accordingly, the following discussion focuses on Hitachi ID Password Manager, since password management requires extreme scalability. Hitachi ID Identity Manager is built on the same scalable architecture. Password Manager has been deployed in very large organizations, including: • One password reset system supporting 750,000 users and another supporting more than 2,000,000 users (both Extranet-facing). • Internal corporate deployments with up to 300,000 users. • Users distributed over six continents (nobody in Antarctica). • A single Password Manager instance, running on a single server, managing passwords on over 3,200 stand-alone Unix systems. This level of scalability is a result of many features: • Built-in, real-time database replication between servers (WAN-friendly, encrypted).
© 2011 Hitachi ID Systems, Inc. All rights reserved.

17

Enterprise Scale User Provisioning with Identity Manager

• Explicit support for multi-master, load-balanced configurations with cooperation between replica servers. • Multi-threading operation of the UI components, service components and connectors. In addition, Identity Manager incorporates many features that, while not directly performance-related, are needed to operate in large, complex networks: • Compatibility with reverse web proxies, which can expose some or all of the Identity Manager UI to less-trusted network segments (e.g., DMZ). • An application proxy server, which allows Identity Manager to connect to target systems across firewalls. • Support for multiple languages (including Unicode) per running instance. • Auto-discovery of users and groups on integrated systems and applications.

5.5

Security

Hitachi ID Identity Manager strengthens security by: • Quickly and reliably removing access to all systems and applications when users leave an organization. • Finding and helping to clean up orphan and dormant accounts. • Assigning standardized access rights, using roles and rules, to new and transitioned users. • Enforcing policy regarding segregation of duties and identifying users who are already in violation. • Ensuring that changes to user entitlements are always authorized before they are completed. • Asking business stake-holders to periodically review user entitlements and either certify or remove them, as appropriate. • Reducing the number and scope of administrator-level accounts needed to manage user access to systems and applications. • Providing readily accessible audit data regarding current and historical security entitlements, including who requested and approved every change. Identity Manager is designed to be secure. It is protected using a multi-layered security architecture, which includes running on a hardened OS, using file system ACLs, providing strong application-level user authentication, filtering user inputs, encrypting sensitive data, enforcing application-level ACLs and storing log data indefinitely. Identity Manager never requires plaintext passwords to be stored in configuration files or scripts and does not store plaintext passwords anywhere. Identity Manager does not ship with a default administrator password – one must be typed in at installation time. These security measures are illustrated in Figure 4.
© 2011 Hitachi ID Systems, Inc. All rights reserved.

18

Enterprise Scale User Provisioning with Identity Manager

Input, output filtering Application-level ACL Server-local session state Random session/page keys. Locked down. No Asp, COM, DDE, etc., Current SPs. Hardened at current patch levels; most services disabled. Installed in a physically secure facility. Alarmed and monitored.

CGI User Interfaces Application Web Server Operating System Services Hardware All traffic in/out is encrypted. File system Networking Identity Cache Hitachi ID Services Input, output filtering Application-level ACL Caller authentication Encrypted I/O. Sensitive data encrypted or hashed.

CPU

Storage

NICs

Figure 4: Network architecture security diagram

5.6

Rapid Deployment

Hitachi ID Systems solutions are optimized for rapid deployment – this is a core design principle across all products in the Hitachi ID Management Suite. Features such as a dynamic workflow, an architecture which does not depend on role engineering, auto-discovery of users on target systems and self-service login ID reconciliation are all designed to eliminate costly deployment steps and minimize ongoing administration. Hitachi ID Identity Manager is designed for rapid deployment: • Built-in forms, policies, reports All request forms, access control rules, approval processes and many reports are built into Identity Manager, so do not have to be manually configured for each customer. • Powerful, built-in authorization engine A change authorization engine is built into Identity Manager. Rather than requiring customers to draw diagrams for each business process, it automatically manages change authorization. Important (but complex) features such as parallel invitations to multiple authorizers, approval by N of M people, reminders, escalation and delegation are simply built in and need not be configured by customers. Using a single, dynamic, parametric authorization engine, organizations can focus on the key questions: – Is the change request syntactically correct and appropriate in its business context? – Whose authority is required before the request can be implemented? This approach eliminates the need to define hundreds of flow-charts for various kinds of change requests. • No requirement for role engineering Identity Manager works without a formal model of user privileges, which may take years to develop. Automation can provision coarse-grained access for new users, and terminate all access for departed staff, without a detailed model of rights for each job code. Workflow addresses the need to provision users with more fine-grained privileges using a request/ap© 2011 Hitachi ID Systems, Inc. All rights reserved.

19

Enterprise Scale User Provisioning with Identity Manager

proval/audit process, which requires very little work to setup. • Cloning model accounts Identity Manager creates new accounts by cloning existing ones, which have been identified by the Identity Manager administrator as “models.” This eliminates the need for Identity Manager administrators and platform administrators to collaborate in fully specifying the configuration of all new accounts.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

20

Enterprise Scale User Provisioning with Identity Manager

6

Return on Investment

Hitachi ID Identity Manager reduces the cost of managing users and security entitlements: • Auto-provisioning and auto-deactivation leverage data feeds from HR systems to eliminate routine, manual user setup and tear-down. • Self-service eliminates IT involvement in simple updates to user names, phone numbers and addresses. • Delegated administration moves the responsibility for requesting and approving common requests, such as for new application or folder access, to business users. • Identity synchronization means that corrections to user information can be made just once, on an authoritative system and are then automatically propagated to other applications. • Built-in reports make it easier to answer audit questions, such as “who had access to this system on this date?” or “who authorized this user to have this entitlement?”

© 2011 Hitachi ID Systems, Inc. All rights reserved.

21

Enterprise Scale User Provisioning with Identity Manager

7

Summary

Efficient and reliable user provisioning yields better productivity for users, reduced administration overhead, and better security. Hitachi ID Identity Manager allows organizations to streamline their user provisioning, access management and termination processes through: • Identity synchronization: Detect changes to personal data, such as phone numbers or department codes, on one system and automatically make matching changes on other systems for the same user. • Auto-provisioning: Detect new user records on a system of record (such as HR) and automatically provision those users with appropriate access on other systems and applications. • Auto-deactivation: Detect deleted or deactivated users on an authoritative system and automatically deactivate those users on all other systems and applications. • Self-service requests: Enable users to update their own profiles (e.g., new home phone number) and to request new entitlements (e.g., access to an application or share). • Delegated administration: Enable managers, application owners and other stake-holders to modify users and entitlements within their scope of authority. • Authorization workflow: Validate all proposed changes, regardless of their origin and invite business stake-holders to approve them before they are applied to integrated systems and applications. • Consolidated reporting: Provide data about what users have what entitlements, what accounts are dormant or orphaned, change history, etc. across multiple systems and applications. Identity Manager is designed to be scalable, secure and easy to deploy.

© 2011 Hitachi ID Systems, Inc. All rights reserved.

22

Enterprise Scale User Provisioning with Hitachi ID Identity Manager

APPENDICES

© 2011 Hitachi ID Systems, Inc. All rights reserved.

23

Enterprise Scale User Provisioning with Identity Manager

A

Management Suite Overview

The Hitachi ID Management Suite is a complete identity and access management solution that enables organizations to more securely and efficiently manage the user lifecycle across enterprise applications and systems. The Management Suite combines the power of Hitachi ID Systems flagship technologies, Hitachi ID Identity Manager for user provisioning and Hitachi ID Password Manager for password management with more targeted products including Hitachi ID Group Manager to manage user access rights, Hitachi ID Access Certifier to review user rights and clean up stale privileges and Hitachi ID Privileged Access Manager to secure access to privileged accounts. The Management Suite creates real business value by increasing productivity for users, reducing IT overhead, strengthening network security and providing internal controls to support compliance with privacy protection and corporate governance regulations. The Management Suite is designed as identity and access management middleware, in the sense that it presents a uniform user interface and a consolidated set of business processes to manage user objects, identity attributes, security rights and authentication factors across multiple systems and platforms. This is illustrated in Figure 5. Figure 5: Management Suite Overview: Identity Middleware
Users Hitachi ID Management Suite Business processes
Synch./Propagation Request/Authorization Delegated Administration Consolidated Reporting

Target Systems User Objects
Attributes Passwords Privileges

Related Objects
Home Directories Mail Boxes PKI Certs.

Employees, contractors, customers, and partners

The Management Suite includes several functional identity and access management modules: • Identity Manager – User provisioning, RBAC, SoD and access certification. – – – – – Automated propagation of changes to user profiles, from systems of record to target systems. Workflow, to validate, authorize and log all security change requests. Automated, self-service and policy-driven user and entitlement management. Federated user administration, through a SOAP API to a user provisioning fulfillment engine. Consolidated access reporting.

Identity Manager includes the following modules, at no extra charge: – Access Certifier – Periodic review and cleanup of security entitlements. * Delegated audits of user entitlements, with certification by individual managers and application owners, roll-up of results to top management and cleanup of rejected security rights. – Group Manager – Self service management of security group membership. * Self-service and delegated management of user membership in Active Directory groups. – Hitachi ID Org Manager – Delegated constuction and maintenance of Orgchart data.
© 2011 Hitachi ID Systems, Inc. All rights reserved.

24

Enterprise Scale User Provisioning with Identity Manager

* Self-service construction and maintenance of data about lines of reporting in an organization. • Password Manager – Self service management of passwords, PINs and encryption keys. – Password synchronization. – Self-service and assisted password reset. – Enrollment and management of other authentication factors, including security questions, hardware tokens, biometric samples and PKI certificates. Password Manager includes the following modules, at no extra charge: – Hitachi ID Login Manager – Automated application logins. * Automatically sign users into systems and applications. * Eliminate the need to build and maintain a credential repository, using a combination of password synchronization and artificial intelligence. – Hitachi ID Telephone Password Manager – Telephone self service for passwords and tokens. * Turn-key telephony-enabled password reset, including account unlock and RSA SecurID token management. * Numeric challenge/response or voice print authentication. * Support for multiple languages. • Privileged Access Manager – Control and audit access to privileged accounts. – Periodically randomize privileged passwords. – Ensure that IT staff access to privileged accounts is authenticated, authorized and logged. • Group Manager is also available as a stand-alone product, as well as a component of Identity Manager. The relationships between the Management Suite components is illustrated in Figure 6 on Page 26.

500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com
File: /pub/wp/documents/white/idsynch/ids-white-9.tex Date: June 7, 2006

www.Hitachi-ID.com

Enterprise Scale User Provisioning with Identity Manager

Figure 6: Components of the Management Suite

500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: sales@Hitachi-ID.com
File: /pub/wp/documents/white/idsynch/ids-white-9.tex Date: June 7, 2006

www.Hitachi-ID.com

Sign up to vote on this title
UsefulNot useful