Identity Management (IdM) je centralizovaná správa identit v IT systémech. Umožňuje správným osobám přístup ke správným zdrojům, ve správný čas, ze správných důvodů a s plnou evidencí. IT systémy jsou typicky heterogenní a jsou dostupné po interní síti. Správa je prováděna zásahem administrátora v IdM nebo automatizovanými procesy.
Jak naplánovat a úspěšně migrovat Identity Manager
Dosluhuje Vám současný identity management software? Platíte velké sumy za licence nebo vám jednoduše stávající řešení nevyhovuje?
Často se setkáváme s požadavkem migrace z jiného SW Identity Manageru. V následujícím článku se dozvíte postřehy z reálných migrací identity management SW. Co je to identity Management najdete zde.
Zadáním je tedy migrovat, jednoduchý upgrade nedává smysl. Jedná se o migraci na kompletně jiné technologie. Často je potřeba změnit i stávající procesy, které Identity Manager podporuje. Systémy, které je třeba spravovat se mění – upgradují, nahrazují nebo je potřeba spravovat další.
Jak úspěšně zvládnout migraci IdM? (aktualizace článku z roku 2016)
Jak se zbavit rutinních úkolů při správě IT systému automatizací Identity Managementu
“Nazdar Karle, Jarda, prosím tě, zejtra mi nastoupí ten brigádník. Potřebuju, aby měl všude přístup, dík“. Karel pak jde, do Active Directory založí nový účet. Přidělí mu emailovou schránku v MS Exchage. Vygeneruje heslo a pošle ho mailem Jardovi. Atributy účtu, případně AD skupiny nastaví dle svého nejlepšího vědomí a svědomí. I takhle může vypadat správa účtů (Identity Management) a do určité míry je i funkční, ale:
- Přijde audit a bude chtít vědět, na základě čeho dostal uživatel účet v AD? Kdo o to požádal a kde je o tom záznam? Existuje nějaká standardní matice práv pro zaměstnance?
- Proč má Karlův účet atributy, takové, jaké má?
- Kdo schválil jeho práva v AD?
- Jarda odchází, musíte řešit předání “know how” rutinních operací v IT systémech – založ účet, smaž, archivuj, blokuj schránku, obnov…
- Jak se předává heslo, kdo všechno ho měl v ruce?
Jde to i jinak.
CzechIdM 8.0 Hematite, towards the asynchronicity
We proudly introduce our new version of identity manager CzechIdM called Hematite. The new version comes with a huge improvement of the event processing, so we decided to raise the major version of our software even though the API of modules and thus the compatibility has not changed.
Of course, event processing is not the only feature we improved. We also added a new workflow that takes care of the automatic roles definition approvement. Moreover, we did a great job in localization. From now on, all task names can be localized into other languages than English, as the rest of the CzechIdM.
Continue reading
Brand New CSV Connector
Do you have HR system that exports data into CSV or XLS file? You can try our brand new CSVConnConnector and easily transfer data into CzechIdM! This connector was developed for easy synchronization of CSV files into our system. The connector is mostly for synchronization. Provisioning methods (update, create, delete) are implemented too but are not advised to be used now.
How to connect Microsoft Active Directory into CzechIdM
Since MS AD is the major directory service spread across the enterprise environment, connecting it to our identity manager CzechIdM is one of the most frequent task we come across. This text is a short tutorial of how to manage accounts of users in AD via an identity manager CzechIdM. It will guide you through all the steps from the connector setup to the system provisioning configuration.
Introduction
This tutorial will show you how to connect AD as target system for users (their accounts) from CzechIdM. We will use AD bundle connector from connId framework.
Before you start
First of all, you need to download the connector from Connid (e.g. Connid AD bundle 1.3.4 jar file). Then import the jar file into your application server library classpath. In case you installed CzechIdM into tomcat, then it can be placed there. If your CzechIdM is running, refresh web browser window (e.g. ctrl+F5).
New release CzechIdM 7.7.0 – Garnet is out
Here comes a new stable version of CzechIdM called Garnet. Big milestone feature is new automatic roles by attribute.
Automatic role by attribute
The role can be linked with value in attribute (value can be stored in Identity, Identity extended attribute, Contract and Contract extended attribute). That role is assigned to and removed from a user based on the value in the specific attribute. Recalculating of this automatic roles is done after saving identity, identity extended attribute attributes, contract and contract extended attribute attributes. All necessary attributes that defined automatic role by attribute are defined by agenda “Automatic role by attribute”.
Virtual systems in CzechIdM 7
Virtual systems is one of main section in CzechIdM. In CzechIdM you can have many connected systems. But not for all systems is necessary to be connected directly. For example system with a few users can be connected as virtual system, because connection to system like that will not be used that many times like on other systems, so you can save time and connect these systems like virtual systems.
Virtual system is not directly connected to CzechIdM and all changes have to be made manually by administrator. CzechIdM sends to administrator notification with precise information about create, update or delete account on virtually connected system. Administrator can see which lines has been changed and what was there before change and what will be there after change. And all these tasks are stored in ‘Archive’.
CzechIdM 7.6 – Forsterite is out
Here comes a new stable version of CzechIdM called Forsterine. Big milestone feature is new report module.
Forsterite (Mg2SiO4; commonly abbreviated as Fo) is the magnesium-rich end-member of the olivine solid solution series. It is isomorphous with the iron-rich end-member, fayalite.
Assets
Workflow – just another buzzword in identity management? No…
Workflow is a magic word almost like MAC, both has several meanings. Which meaning is the right one in case of workflow? What does it represent in the identity management context, you will find out in the article.