Manage entitlements
Manage entitlements
Manage entitlements use case is the most important use case for access right management (ARM) process, but also to all other IGA processes and use cases are relying on it. This use case is for admin users to be able to maintain, create / update and remove access rights from IGA solution and manage access right information and settings.
Basically, just implementing this use case customer is able to create manual type access rights, add additional access right information, and report current status for all access rights and users in their directory. When combining this use case to another use cases, like for example approvals, more settings becomes available.
Entitlement is one single access right group, which is for example read from the customers directory, it can be created manually or imported by using one-time imports. When you combine several entitlements, it becomes business role.
Use case description
This use case is for all IGA packages, but please notice that this use can can be expanded with other IGA packages use cases.
* User lifecycle management
** Governance
*** Automation & provisioning
**** Expanded access right management
|
Description |
Overview |
IGA solution is centralized point for user lifecycle and access right management, this use case describes how IGA Admin can manage entitlements. Entitlement is an item that reflex one access right, that can be managed automatically or manually. Information to entitlement can be read also from directories or applications (groups) and IGA Admin can add additional information, manage Self-Service information, and needed approval levels etc. |
Operators |
IGA solution |
Prerequisites |
Customer has pointed IGA admin role to at least one person, preferably to two persons. Admins are managed by adding users to Efecte_IGA_Admins Directory Group. |
Result |
Entitlement is created, updated, or inactivated. IGA Admin can manage entitlement information, relations, Self-Service information, approval levels and ownership's. |
| Operating chain for automatic provisioning type of entitlements |
|
| Operating chain for manual provisioning type of entitlements |
|
| Operating chain for combined provisioning type of entitlements |
|
| Reporting / auditing entitlements |
IGA solution contains ready-made views and dashboards for reporting and auditing information related to entitlements (access rights) and IGA admins can easily create / modify / save / delete more personal reports and/or share them with others. It is important to notice, that needed reports vary according to how long the IGA solution has been used, meaning that right after solution has taken into production use reporting is more focused to analyze current status of access rights and guides IGA admins to start publishing access rights into the request catalog in correct order etc.
When end-users start requesting access rights from Self-Service, also following views and dashboards becomes available,
Following reports become available when automation is added by using automated rules for granting accesses automatically to users based on their title, cost center or organizational unit information (check also each use case for more detailed information about reporting).
When governance processes related use cases are taken into use, following views and dashboards for reporting becomes available (check also each use case for more detailed information about reporting),
Extended access right management process brings even more ready-made views and dashboards for reporting,
|
| IGA admin actions |
IGA admin actions are tasks which customers future IGA admin needs to perform, maintain and monitor, either as a one time tasks right after Go-Live's or daily / weekly tasks after IGA solution has being used for a while. After Go-Live's
When users start requesting / removing access rights from Self-Service, IGA admin needs to follow-up and act in cases where manual interference in required.
|
Related datacards |
IGA Entitlement |
Delete
Expansion possibilities
Expansion possibilities are categorized in three category, but it is always important to validate if requested change has affect to the delivery schedule or work estimations.
| Category | Description |
|
Small (less than hour) |
Small changes does not usually affect to the delivery schedule or work estimations and these changes can be done also by IGA admins,
|
|
Medium (0,5 - 2 work days) |
Medium changes can be for example,
|
|
Large (more than 2 work days) |
Large changes usually takes longer time, since they require more detailed definition-, and testing work. For managing entitlements usually larger changes are new use cases which are expansions to the customers existing IGA solution
|
Relations & configuration instructions
Relations to other use cases,
Request & remove access rights - users are able to request entitlements from Self-Service
Approval & delegation - user are able to approve entitlement request and delegate approval responsibilities
Audits & reports - IGA admins can create / update / remove /share reports, views and dashboards, or use ready-made reports.
Manage IGA users - Accesses to IGA solution and Self-Service are managed as entitlements.
Manage applications - entitlements are always related to application, service, database etc.
Provisioning / de-provisioning - entitlements can be provisioned automatically, manually or by combining these two methods
Manage business roles - business roles can contain entitlements or sub-roles
Manage IGA accounts - entitlement is always related to users account
Manage request catalog - entitlements can be published to Self-Service for end users to be able request them
Manage user lifecycle, add new users, update user information and update departing user information - are use cases where entitlements are granted, updated and removed automatically based on changes in received user information, for example during user creation birth rights are granted automatically.
Manage data imports - entitlements can be imported using one-time imports
Manage automated rules - user can get entitlements automatically using attribute-based access controls (ABAC), role-based access controls (RBAC) and organizational-based access controls (OrBAC)
Re-certification - entitlements can be re-certificated, meaning that re-approval is sent to Self-Service for users review
Reconciliation - entitlement has group members which are not allowed, usually added straight to the directory
Manage toxic combinations - entitlements can create toxic combination which is prevented to be granted to users
Risk level calculation - users risk value is calculated based on related entitlement risk value
Lock user account - when users all accounts and access rights are immediately disabled, entitlements are removed or restored after incident has been solved
Manage privilege accesses - entitlement type is set to privilege
Manage physical accesses - entitlement type is set to physical
Manage entitlement lifecycle & create update entitlements - use cases for creating, updating and removing access right groups to/from directories or applications.
Relations to other data cards,
Data import
Person
Identity Storage*
IGA Admin Task
IGA Account
IGA Business Roles
IGA Service Request
IGA Request Catalog
IGA Re-certification
IGA Automated Rules**
IGA Toxic Combinations**
Notice!
Configuration instructions for expanded access right management related use cases, which are expanding entitlement management use case can be found under physical access right management and privilege access right management use cases.
1. Configuration instructions
- Configure scheduled-based provisioning task to read account data to IGA account data card and group data to IGA entitlement data card
- Configure related use cases according to their configuration instructions
1.1 Unit testing instructions
- Read groups from the customer directory and validate that data is read to correct attributes
- Create manual type entitlements
- Publish entitlements to Self-Service, but make sure that MyServices in Self-Service are configured according to related use cases
- Make sure all reports and dashboards are showing information correctly
- Check that IGA access right records are created correctly based on group membership connections
System and user approval testing instructions
In this chapter are described instructions and preparation tasks for testing manage entitlement use case.
Preparation tasks for both testing phases
1. Create 10 test groups into the directory for both testing phases (total 20 groups)
2. Create also test users 5 for each testing phase (total 10 users) and create couple group membership connections for validating that relations are also read correctly
3. Wait until scheduling has read the groups as entitlements, or run provisioning task manually to get group information immediately.
System testing
1. Read definition documentation and create needed customer specific test cases
2. Make sure all preparation tasks are completed (including tasks on customer responsibility)
3. Test also that provisioning task can be run manually
4. Check that attributes related to the groups are read into correct attributes to IGA entitlement data card
5. Check that group membership relations are shown correctly
6. Check that IGA access right records are created correctly based on existing group membership connections
7. Create categories for request catalog (check instructions from here)
8. Add user friendly name, description, application, approval level + approvers, and publish entitlements into Self-Service
9. Create manual type entitlements and publish them also into Self-Service
10. Validate from Self-Service that entitlements are showing correctly in request access right services
11. Validate from Self-Service that entitlements and group connections are showing correctly in remove access right services
12. Inactivate & remove entitlements with and without group membership connections
13. Check that views, dashboards and reports are showing correctly
User approval testing
1. Read definition documentation and create needed customer specific test cases
2. Make sure all preparation tasks are completed (including tasks on vendors responsibility)
3. Check that attributes related to the groups are read into correct attributes to IGA entitlement data card
4. Check that group membership connections are read correctly
5. Check that IGA access right records are created correctly based on existing group membership connections
6. Create categories for request catalog (check instructions from here)
7. Add user friendly name, description, application, approval level + approvers, and publish entitlements into Self-Service
8. Create manual type entitlements and publish them also into Self-Service
9. Validate from Self-Service that entitlements are showing correctly in request access right services
10. Validate from Self-Service that entitlements and group connections are showing correctly in remove access right services
11. Inactivate & remove entitlements with and without group membership connections
12. Check that views, dashboards and reports are showing correctly
Delete