How to Govern and Maintain Compliance Using Open Source Identity Management Components. May 17, 2017 ApacheCon NA, Miami

Transcription

1 How to Govern and Maintain Compliance Using Open Source Identity Management Components May 17, 2017 ApacheCon NA, Miami

2 Introductions 2 Katarina k.valalikova@evolveum.com Shawn smckinney@symas.com

3 Session Objective 3 Learn about identity governance and demo common use cases w/ open source infrastructure.

4 Session Agenda 4 Terminology Benefits Scenarios Solution Demo Questions Image from:

5 Terminology 5

6 Terminology 6

7 Terminology 7

8 Terminology 8

9 Terminology 9

10 Terminology 10

11 What can possibly go wrong here? 1. Too many accounts 2. Too few accounts 3. Don t know many accounts

12 What can possibly go wrong here? 1. Improper account retention policies 2. Violation of principle of least privileges 3. Sharing credentials instead of accounts 4. No account approval process. 5. Non-determinant assignments 6. Violation of privacy.

13 In other words, we need 1. Access certification 2. Approvals 3. Notifications 4. Escalation 5. Deputy 6..

14 What is Identity Governance? Gartner says: Combines with IAM functions to meet audit and compliance obligations.

15 What is Identity Governance? WhatIs calls it: Policy-based centralized orchestration of user identity management and access control. Helps support enterprise IT security and regulatory compliance. Margaret Rouse, WhatIs.com

16 What is Identity Governance? Radovan says: High-level business processes, business rules, policies, organizational structures Combines with low-level identity management processes like data synchronization, system integration, data formats, data transformation, network protocols Radovan Semancik, wiki.evolveum.com

17 What is Identity Governance?

18 Role Based Access Control 18

19 RBAC and Policy Rules 19 Constraints Actions Situations

20 Identity Management and 20 Governance

21 Architectural Overview

22 Architectural Overview Requires Java version 8 Java servlet container Relational database (any) Uses Spring Framework component wiring Apache Wicket user interface ConnId common connectors

23 Architectural Overview User interface components high-level components don t connect with low-level components 1 2 IdM services, security and User-account mappings resource and account management data storage and task management Common data model, libs and low-level utils

24 Demo

25 Resource / Connectors at Play 1. Google Apps 2. Oracle HCM 3. LDAP

26 Demo Environment 26 HCM connector (peoplesoft) Google Apps connector Open

27 Use Cases 27 UC 1 Onboarding New Identity, Account activation UC2 Role assignment UC3 Self service UC4 Deputy UC5 Account Certification / Recertification

28 UC 1 Onboarding new Identity User is imported from HCM 2. Activation link is sent to the user 3. User activate his account 4. Basic roles are assigned to the user after activation

29 UC 2 Role assignment Manager assigns roles to onboarded user 2. Manager selects conflicting roles 3. Roles are not assigned because of SoD violation

30 UC 3 Self service User selects roles he needs to have assigned 2. Request is send to approval 3. Approval starts

31 UC 3 Self service User selects roles he needs to have assigned 2. Request is send to approval 3. Approval starts 4. Approval from manager is needed

32 UC 3 Self service User selects roles he needs to have assigned 2. Request is send to approval 3. Approval starts 4. Approval from manager is needed 5. Approval from security officer is needed

33 UC 3 Self service User selects roles he needs to have assigned 2. Request is send to approval 3. Approval starts 4. Approval from manager is needed 5. Approval from security officer is needed 6. Approval from application owner is needed

34 UC 3 Self service 1. User selects roles he needs to have assigned 2. Request is send to approval 3. Approval starts 4. Approval from manager is needed 5. Approval from security officer is needed 6. Approval from application owner is needed 7. App owner is on the vacation escalation 34

35 UC 4 Deputy Manager is going on vacation 2. Manager delegates his work

36 UC 5 Access certification New campaign for access certification starts 2. Manager decides which accounts are legal

37 Benefits of Governance Controls 37 Advanced role lifecycle management Audit and reporting interfaces Enhanced regulatory compliance Improved business responsiveness Privileged account management Self-service interfaces

38 Governance simply Notifications Recertification (Multi-level) approvals Escalation Delegation Deputy Role lifecycle Audit trail... 38

39 Questions 39

40 Contact 40 Katarina Shawn