SSIM

Secure Access Services/Self Service ID management
IT Delivery Europe :
Self Service ID Management
Manual Provisioning Workflow (MPW)
IBM Confidential | May, 2010
2008 IBM Corporation
Secure Access Services / Self Service Identity Management
Agenda
Process overview
Connection to MPW
Requesting a Customer Authorization
Requesting an Individual ID creation
Configuring the shared secret key
Approver activities
System administrator activities
Notification and Account details
Checking the status of a request
Other request and ID types
SAS SSIM Education package

IBM Confidential
2008
Process to request a manual action on ID
Log onto the PanIOT iTIM with Intranet userID and password
The user automatically gets a unique SAS userID
Perform these activities in this sequence

1. Customer Authorization
The customer authorization is required before any request on a group of
servers (group also named target). This is for confidentiality and privacy
reasons.
The Servers Group will only be available when customer authorization process
has been performed
2. Servers Group request
The selection of the servers is composed of two steps
Servers Group request
Fulfill of the request Ticket
several approvals for the servers group request depend on the target (1 to 3
levels of approval)
The Servers group request is possible only when the user add a customer
authorization.

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities

IBM Confidential
2008
Log onto the PanIOT iTIM for standard users with

Intranet userID and password
https://ssim.esni.ibm.com/

IBM Confidential
2008
When logged in successfully, the PanIOT iTIM

Home page is displayed

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities

IBM Confidential
2008
Finding a Customer
Go to Request Access page
Search in Customer_Authorization
WARNING : It is not a Customer_Validation
Enter a Search For or let it blank and then

Click on the Search button.
You obtain a list of available customers/Targets
Description = Name of
bluegroup for approval

IBM Confidential
2008
Selecting a Customer
The Customer_Authorization have the following Naming Convention for the Access Name:
Country Customer Platform Image Category
Description field allows showing name of bluegroup associated of approval workflow
Click on the Customer

you want
Click on the Request
Access button

IBM Confidential
2008
Selecting a Customer
Click on the Request Access button
The detail of the request is displayed
10

IBM Confidential
2008
Entering a Business need to complete the request

For submitting request, enter a Business Need Justification
Go to Request Business Need page
Details of the request is displayed
Use the scroll bar for displaying

all the details
The user will be notified of your action with an email, explaining what he has to do
11

IBM Confidential
2008
Entering a Business need to complete the request

Click on Provide information and fill in the Business need
Then click on OK to submit the request
Manage the servers of the client
The approvers will be notified of the action with an email, explaining what they have to do
12

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
13

IBM Confidential
2008
Process overview
The steps to complete a Server UserID
request:
1. Select the Servers Group (target)
[mandatory]
2. Select the requestee [only if different of
requester]
3. Fulfill the ticket [mandatory]
4. Select the intermediate code [only if the
request is for a shared ID]
14

IBM Confidential
2008
Finding a Servers Group

Search in Servers_Group (or:

Servers_Group_For_Other_Users)
Enter a Search For or let it blank and then
Click on the Search button
You obtain a list of Servers Group granted by
the Customer_Authorisation approved for
yourself
15

IBM Confidential
2008
Selecting a Servers Group

The Servers_Group have the following Naming Convention:
Country Customer Platform Image Category
Click on the Servers Group you want

16

IBM Confidential
2008
Chose a requestee for a request Servers group for others

If you are raising a request Servers Group for another user, then it is
mandatory to select the user.
Go to Select account/privilege requestee page
Details of the request are displayed

all the details
Click on Provide information to fill in the form

17

IBM Confidential
2008
Select the requestee
18

IBM Confidential
2008
Fulfill the request before every submission

After a Servers Group request, the fulfill of the request ticket is mandatory
Go to Fulfill your request ticket page

all the details

19

IBM Confidential
2008
Fulfill the request forms
There are 4 different request forms, linked to server groups platform
Windows, UNIX, Mainframe, iSeries
Generic
In the dropdown list Operation select Create Account
There are 6 possible operations
Create Account
Modify Account
Password Reset
Suspend Account
Restore Account
Delete Account
See the Other requests section for more details on the other operations
20

IBM Confidential
2008

WINDOWS form
1. The UserIDs is automatically
filled by the solution
2. Select The ID Type

3. Select the Operation
1
2
3
4. Select the Windows Privileges you need, click on the Search button, check
the privilege(s) you need and click on the OK button
5
5. Enter the name of the specific privilege you
need in the text box and click on the Add button
6. By default all the servers are selected, if you want only some servers you must delete
those you dont need. If the server you want isnt in the list you can add it by entering is name
in the textbox and click on the Add button
7
8
7. Enter your Special needs in

the textbox its not mandatory
8. Enter the Business

need in the textbox
21

IBM Confidential
2008

UNIX form

1
2
3
4
4. Select the UNIX Privileges you

need, click on the Search button,
check the privilege(s) you need and
click on the OK button
5. Enter the name of the

specific privilege you
need in the text box and
click on the Add button
6. Enter the name of the UNIX

Secondary Group you need in the
text box and click on the Add button
8
9
22

need in the textbox

IBM Confidential

7. By default all the servers are

selected, if you want only some
servers you must delete those you
dont need. If the server you want isnt
in the list you can add it by entering is
name in the textbox and click on the
Add button
2008

Mainframe form

1
2
3
4. Select the Mainframe Privileges you need, click on the Search button, check
the privilege(s) you need and click on the OK button
5
those you dont need. If the server you want isnt in the list you can add it by entering is
name in the textbox and click on the Add button
7
8


need in the textbox
23

IBM Confidential
2008

iSeries form
1
2
3
4
4. Select the Mainframe Privileges you need, click on the

Search button, check the privilege(s) you need and click on
the OK button
5
7
8
9
those you dont need. If the server you want isnt in the list you can add it by entering is
name in the textbox and click on the Add button
10

need in the textbox
24


IBM Confidential
8. Enter your Profile

name
7. Select the Command Line

Access:
2008

Generic form

1
2
3
4

5
5. By default all the servers are
selected, if you want only some
servers you must delete those you
dont need. If the server you want
isnt in the list you can add it by
entering is name in the textbox and
click on the Add button
6
7


need in the textbox
25

IBM Confidential
2008
Add an Intermediate Code for shared Ids (Service and Functional)

To complete a shared ID request, the intermediate code is mandatory
Go to Select the intermediate code page

26

IBM Confidential
2008
Select the Intermediate Code owner
Attention: if the Intermediate

Code owner has not been
previously Customer
Authorized for the target, the
request will automatically fail.
27

IBM Confidential
2008
Submit the request for approval

The request is now submitted to approval workflow
Note: The Shared Secret key is required for password retrieval. Please refer
to chapter Configuring a shared secret key for more details.
If your Shared Secret key is not configured when you or your manager submit
a request for you, you will receive an email notification. The shared secret
key can be set at any time.
28

IBM Confidential
2008
Shared Secret notification

Sample of email notification if you submitted a request before to
set shared secret key
29

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
30

IBM Confidential
2008
Updating user profile

On PanIOT iTIM home page, go on Change
Password :
The panel displayed has 4

sections:
1. The accounts
2. The MPW (iTIM)
password
3. Criteria for the
password to be
accepted
4. New password.
31

IBM Confidential
2008

Expand the Accounts section (#1) and choose the Shared Secret
Account
Add the new Shared Secret key in the password fields (#4)
You can review the criteria
for the new Shared Secret
Key to be accepted by
expanding section #3.
Submit the update by clicking on OK
32

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
33

IBM Confidential
2008
The Approver is notified when an approbation is required
34
When a Customer Authorization / Servers_Group request is submitted, an

approval workflow is started. A mail is sent to the approver(s).
Through the TaskID in first, or through the bluegroups memebership if

taskID is not configured or doesnt exist
Note : Some other approvers like the manager can receive an email for
approval
The mail contains:
Information on the requester and the request
The business need associated
A link to the approvers To Do List

which contains a list of tasks which have to be approved or rejected
Sender : SSIM_iTIMManager@fr.ibm.com
Subject:
For customer authorization : ITIM Notification Firstname Lastname (IBMID) has

submitted a "Customer_Authorization" request which requires your approval
For Server group request : SSIM-MPW Notification - Firstname Lastname has

submitted a "Create Account" request related to the target name" customer
which requires your approval.

IBM Confidential
2008
Sample 1 : email received for a customer authorization

request
35

IBM Confidential
2008
Sample 2 : email received for a server group request
36

IBM Confidential
2008
Action needed
37
Log onto the PanIOt iTIM with Intranet userID and password
A new part is visible Action Needed
Click on the Need you approval link to view the detail of the request

IBM Confidential
2008
The task which has to be approved is listed in the Action

needed and Approve and Review requests" List
Need your approval to ensure user need account creation
38

IBM Confidential
2008
Approver activities
The manager may approve or

reject the requests one by one
Select the appropriate
action (Approve or Reject)
Enter an explanation of
the choice and Click on OK
39

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
40

IBM Confidential
2008
The system administrator is notified when an action is

required
The system administrators could have 2 kinds of action to perform:
Account ID update
Account details / Password setting
R e v ie w
tic k e t
d e ta ils
U p d a te
s ta tu s
o f
tic k e t (s u c c e s s /
fa i l)
S e t ID , s e r v e r s ,
S e t
p a s s w o rd
R e s e t
p a s s w o r d
T y p e
o f
o p e ra tio n
A d d
A c c o u n t
p riv ile g e s,
p a s s w o rd .
O th e r
a c c o u n t
o p e r a t io n s
V a l i d a te
tic k e t
E n d
41

IBM Confidential
2008
Email notification for serverID update
42
The system administrators is first notified by email (taskID)

The mail contains:
Information on the requester and the request
The business need associated
A link to the To Do List
Subject:
Account ID update : SSIM-MPW Notification - Firstname Lastname has

submitted a Operation type" request related to the target name" customer
which requires your action.
Account setting : SSIM-MPW Notification - Firstname Lastname has submitted a

Operation type" request related to the target name" customer which requires a
password.

IBM Confidential
2008
Email notification for serverID update
43

IBM Confidential
2008
Email notification for Account setting
44

IBM Confidential
2008
Action needed : ServerID update

Note : After the execution of an action on servers the administrator must update the
WorkOrder and the request status
45
Log onto the PanIOT iTIM with Intranet userID and password
Click on the Manual action needed link to view the detail of the request

IBM Confidential
2008
System administrator activities on request ticket

Read the instruction detail
Update the status of the request
Proceed Request
Abort Request
Update reviewer comments field
No password here
Click OK. An email is sent to the

requestor with the status and the
comments of his request
A new workorder is assigned to
system administrator
46

IBM Confidential
2008
Action needed : Account setting

Note : As soon as Workorder Manual action is performed, a new Workorder is assigned
to the same Provisioner for completing the settings of the Account on to the ticket
Go back to PanIOT iTIM Home Page

Click on the Manual Actions Summary link to view the detail of the request
The detail of the workorder is displayed
47

IBM Confidential
2008
Account setting by the System Administrator

The detail of the workorder is displayed
Edit the details of the ticket:
Account ID
Servers
Privileges
Password
Note : Account Id, servers, privileges fields can be
edited in the case of create operation only.
Password field can be filled in the case of create
or password reset operation only
Validate the status of the request

Successful
Failure
Update reviewer comments field

Click OK. An email is sent to the
requestor with the information to
retrieve the password
48

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
49

IBM Confidential
2008
The Requester is notified when an action is executed
When the action requested is succeeded, the requester receives an email.

The requester could receive 3 kinds of notification:
Request status (performed, cancelled, etc..)
Request action (form to complete, business need to completed, shared secret to configure, etc..)
Password retrieval method
The mail contains information on the request
Subjects:
50
Customer authorization : ITIM Notification - The "Personal Privileges and Parameters" Request has been
Completed : Success
Account request to fill in : SSIM-MPW Notification - Your target name" request requires further informations to be
processed
Shared Secret key to set : SSIM-MPW Notification - Your " target name" request requires a valid "Shared Secret" to
be processed
Shared Secret key configured : ITIM Notification - The "Personal Privileges and Parameters" Request has been
Completed : Success
ServerID action completion: SSIM-MPW Notification - The "Create Account" request related to the " target name"
customer has completed.
Account creation : ITIM Notification - The "Access Add" Request has been Completed : Success
Password setting : The password related to the target name + ID account is available

IBM Confidential
2008
Example 1 : customer authorization approved
51

IBM Confidential
2008
Example 2 : Request to fill in
52

IBM Confidential
2008
Example 3 : Shared secret key to set
53

IBM Confidential
2008
Example 4 : Server ID request completion
54

IBM Confidential
2008
Retrieving its accounts password

The password is no more directly communicated by mail
The user has to follow password retrieval procedure
Shared secret key to set up
Email notification
Email is containing link to retrieval URL
User has to follow the link
Password retrieval
User connects on URL
User enters its shared secret key
Password is displayed
Note : As soon as user clicked on Done after retrieving its password, retrieval
URL becomes inactive
55

IBM Confidential
2008
Notification : Password retrieval
56

IBM Confidential
2008
Password retrieval method

Click on URL provided in email notification
Enter your shared secret key and click OK
Note : As soon as user clicked

on Done after retrieving its
password, retrieval URL
becomes inactive
Password is displayed
57

IBM Confidential
2008
Displaying Account information

Go to View Account page
A list containing all your existing accounts is displayed
Account type is named

MPW_Account
instead of
CSV_Writer_Service
in production environment.
58

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
59

IBM Confidential
2008

The status of the request is visible in the View my request page
60
In Process not yet approved or not yet done
Success request fully approved and executed
Rejected request rejected (by an approver or by an administrator)
Failed after the request timeout (14 days without any action)

IBM Confidential
2008
Details on request status

Go to View Request page
A list of your actions is visible
Select the request you want to see more detail
Request type definition
Customer_Authorisation = User Data Change

Servers_Group = Access Add
61

IBM Confidential
2008
Agenda
Process overview
Connection to MPW
Approver activities
62

IBM Confidential
2008
Other requests and IDs

6 kinds of request can be managed:
Create Account
Modify Account
Password Reset
Suspend Account
Restore Account
Delete Account
3 types of IDs can be managed:
Individual ID
Functional ID
Service ID
Procedure to follow is similar to Creation of account, independently of

request or ID type. The choice must be made in the associated dropdown list
63

IBM Confidential
2008
Ex : Resetting your password Step 1

You dont need anymore to call the help desk to reset your password.
The password can now be changed using the request of a manual action in the
PanIOT iTIM.
Step 1:
64
Search in Servers_Group
Enter a Search For or nothing and then Click on the Search button
You obtain a list of Servers Group
Click on the Servers Group you want

IBM Confidential
2008
Ex : Resetting your password Step 2

Step 2:
65
Go to Fulfill your request ticket page
In the dropdown list Operation select Password Reset
Fulfill the form
Click on the button OK

IBM Confidential
2008
Contacts & Links
MPW education & certification

As soon as you trained or self trained on MPW with education package,
you have to follow MPW education certification process
Please connect to the following URL to complete certification
URL : https://ssim-report.emea.ibm.com/MPW_education
User guides
Available on SSIM Lotus Community :

https://w3-connections.ibm.com/communities/service/html/communityview?
communityUuid=37bd8982-fc01-4450-b8d6-1a123de82ab0
67

IBM Confidential
2008
Web portal
PanIOT SSIM web portal:
http://ssim.emea.ibm.com/
PanIOT SSIM Wiki :
https://w3-connections.ibm.com/communities/service/h
tml/communityview?communityUuid=37bd8982-fc01-4450-b
8d6-1a123de82ab0
68

IBM Confidential
2008
End.

SSIM

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

SSIM

Hochgeladen von

Copyright:

Verfügbare Formate

Secure Access Services/Self Service ID management

IBM Confidential | May, 2010

2008 IBM Corporation

Secure Access Services / Self Service Identity Management

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Process to request a manual action on ID

Perform these activities in this sequence

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Log onto the PanIOT iTIM for standard users with

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

When logged in successfully, the PanIOT iTIM

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Enter a Search For or let it blank and then

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Click on the Customer

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Entering a Business need to complete the request

Details of the request is displayed

Use the scroll bar for displaying

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Entering a Business need to complete the request

Manage the servers of the client

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Finding a Servers Group

Search in Servers_Group (or:

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Selecting a Servers Group

Click on the Servers Group you want

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Chose a requestee for a request Servers group for others

Details of the request are displayed

Use the scroll bar for displaying

Click on Provide information to fill in the form

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Select the requestee

SAS SSIM Education package

Secure Access Services / Self Service Identity Management

Fulfill the request before every submission

Details of the request are displayed

Use the scroll bar for displaying

Click on Provide information to fill in the form

SAS SSIM Education package