This use case describes how credentials are created for different type of users for example internal and external users. 

IGA Admin can manage and add new rules for different user types. 

This use case is used when IGA Accounts are created, and if Customer is using IGA Enterprise package, also privilege accounts are created by using IGA Set Account Information datacard.

New user is founded to IGA solution and user has unique ID's, credentials for accessing Customers applications are delivered to correct users, and needed parties are informed. 

When user information is updated, needed parties are informed. 

1. New user information is received via integration to the Customers source system or via Efecte Self-Service Portal
   
   
   • When workflow starts creating new user, needed information is validated from the IGA Set Account Information datacard
     
      
   • IGA Admin opens IGA Set Account Information view, chooses "New" and fulfill needed information
     
      
   • General Information
     • Name and description are used for IGA Admins to be able differentiate rules
       
        
     • Directory is chosen if Customer has several directory's as provisioning targets
       
        
     • Account type: Normal, Physical Access Account***, Privilege Account***, Service Account* Other*** 
       
        
     • User type indicates attribute from the users, which is used for defining which users with that attribute are created based on these rules and settings. 
       
        
   • Birth rights
     • Which IGA Entitlements are automatically added to the new user
       
       
       • Provisioning type needs to be automatic for these entitlements
         
          
     • Which IGA Business Roles are automatically added to the new user
       
       
       • Provisioning type needs to be automatic to all IGA Entitlements and sub-roles added to the business role
         
          
     • If there are IGA Automated rules, which applies to the new user, birth rights are overwritten based on the automated rule
       
        
   • Email Settings
     • Email rule contains ready options for which attributes are used when users email address is created
       
       
       • First name.Last name
       • Last name.First name
       • Spoken name. Last name
       • Last name.Spoken name
         
          
     • Email domain
       
       
       • There can be several email addresses with different domain created for the new user, but address is performed with same email rule
         
          
       • Prefix or suffix added to the email address (for example EXT-prefix for external users)
         
          
       • Users with same name rules
         
         
         • Character used in the email address for users with same name
           
            
         • If email address is updated for both of the users with same name and does the process need IGA Admins manual interruption (for example if the other user needs to be informed before name change is provisioned)
           
            
   • Account Settings
     
     • Needed data content changes based on selected target system
       
       
       • AD: sAMAccountName, cn, displayName, userPrincipalName, DN
         
          
       • Azure AD: userPrincipalName
         
          
       • OpenLDAP: cn
         
          
   • Password Settings
     • Password length 
       
        
     • Allowed or denied letters in the password
       
        
     • First time password receiver
       
       
       • Manager
         
          
       • Email to the users email (requires that email address is in IGA solution and email settings are configured)
         
          
       • Text message to the users phone number (requires that phone numbers are in IGA solution and Customer is using SMS gateway service)
         
          
       • None, password is not delivered
         
          
   • Validation
     • Maximum validation (days), if there is none validation added, users account will be active for time being
       
        
     • How many days ahead renewal request is send to Self-Service Portal for Managers approval
       
       
       • IGA solution automatically suggests new validation based on the IGA Set Account Information datacards maximum validation days
         
          
       • Manager can only approve or decline suggested validation
         
          
     • How many days ahead second renewal reminder is send to Manager (email notification)
       
        
     • Email license removal after (days), when employment end date occurs, when email related licenses are removed
       
        
     • Other Entitlement removal after (days), when employment end date occurs, when IGA Entitlements are removed from the IGA Account 
       
        
     • IGA Account removal after (days), when employment end date occurs, when IGA Account(s) is removed from the directories 
       
        
     • Move IGA Account after (days), when employment end date occurs, when IGA Account is moved to another OU (applies in AD and in OpenLDAP)
       
        
     • Approval level (same ones that IGA Entitlement has)
       • If approval is required, Approvers needs to be defined
         
          
   • Communication
     • Email content for each receiver
       
       
       • Basic: Information without sensitive data (Customer needs to define email content)
         
          
       • Secure: Information with sensitive data (Customer needs to define email content)
         
          
     • How many days ahead information is send for all receivers, when new user is created or departing user information is received
       
       
       • If there is none days added, information is send when start or end date occurs
         
          
       • Also if account validation has been continued via Self-Service Portal, email notifications are sent
         
          
     • Receivers:
        
       • Email addresses where information about the new user creation is send
         
          
       • Support groups where ticket about the new user creation in send
         
          
       • Email addresses where information about departing user is send
         
          
       • Support groups where ticket about information regarding departing users is send
         
          
       • Email addresses where information about user update is send
         
          
2. IGA Admin updates existing IGA Set Account Information
   
   
   • IGA Admin opens existing datacard by choosing "Edit all" from the IGA Set Account Information view
     
      
   • IGA Admin can update all information, expect unique ID created for the rule (Efecte ID)
     
      
   • IGA Admin can inactivate datacard, which means that emails are send if user information is updated, but settings does not apply to new users
     
      
   • IGA Admin can remove existing IGA Set Account Information datacard by choosing status as Inactive
     
     
     • If datacard is inactive, it does not start any provisioning, but users matching removed user type are not able to have credentials and emails regarding departing or updated users are not send. 

User's IGA Accounts are now created based on settings made in the IGA Set Account Information.

This operating chain applies, if Customer has IGA Enterprise package and use cases for Managing and requesting privilege accesses are implemented.

1. IGA Admin opens IGA Set Account Information view and selects new (datacard)
   
   
   • IGA Admin fulfills General and Directory Information
     
     
     • Name and description
       
        
     • Target system (directory or application)
       
        
   • IGA Admin can now choose if privilege account is created, by choosing Account type as "Privilege account" 
     
     
     • IGA Admin chooses Privilege account type (list is shown based on Account type)
       
       
       • ADDomain Admin
         • This can be for example Domain Administrator
           
            
       • ADAdmin other
         • This can be for example OU Administrator
           
            
       • Azure ADAdmin
         • This can be for example Owner in Azure AD
           
            
       • Azure ADAdmin other
         • This can be for example User Access Administrator in Azure AD
           
            
       • OpenLDAP Admin
         • This can be for example OpenLDAP Administrator
           
            
       • Application Admin
         • This can be any of the applications Admin users, which IGA solution has been integrated
           
            
     • Language rule
       
        
   • Account settings
     
     
     • Account name
       
       
       • Use users existing ID
         • Employee Number
         • SamAccountName
         • UPN
         • IGA ID
           
            
       • Use new format
         • Check needed attributes from operating chain for accounts (CN, cn, UPN, SAN etc.)
           
            
     • Optional prefix
       
        
     • Optional suffix
       
        
   • Communication (check operating chain for accounts)
     
      
   • Password settings (check operating chain for accounts)
     
      
   • Validation
     
     
     • Maximum validation days becomes mandatory when privilege account is created
       
        
2. If "Request Privilege Account" service is used from the Self-Service Portal, users IGA Account for privilege accesses is created based on these settings. 
   
    
3. IGA Access Right Records are created and audit details are saved. 

This operating chain applies, if Customer has IGA Enterprise package and use cases for Managing and requesting physical accesses are implemented.

1. IGA Admin opens IGA Set Account Information view and selects new (datacard)
   
   
   • IGA Admin fulfills General and Directory or Application Information
     
     
     • Name and description
       
        
     • Target system (directory or application)
       
        
   • IGA Admin can now choose if physical account is created, by choosing Account type as "Physical account" and fulfills required information
     
     
     • Language rule
       
        
     • Account settings
       
        
     • Account name
       
       
       • Use users existing ID
         • Employee Number
         • SamAccountName
         • Email
         • IGA ID
           
            
     • Optional prefix
       
        
     • Optional suffix
       
        
   • Communication (check operating chain for accounts)
     
      
   • First time PIN code settings
     
     
     • Random
       
       
       • Add amount of numbers or characters
         
          
     • Fixed
       • Add fixed PIN code (this is not recommended)
         
         
          
2. If "Physical Access Service" is used from the Self-Service Portal, users IGA Account for physical accesses is created based on these settings. 
   
    
3. IGA Access Right Records are created and auditing details are saved.

When user is created according to IGA Set Account Information or account information is read from the directory (via Efecte Provisioning Engine) or application (via integration, limitations can appear if integration or target system does not allow all functions) IGA Admin can manage IGA Account datacard and perform following actions (from IGA Admin actions class)

 

1. IGA Admin opens IGA Account datacard and chooses from IGA Admin Actions (class) which type of action needs to be performed
   
   
   • Sync account, this action will sync information between IGA Account and user account (located in the directory). IGA Account will be updated with information located in the directory. 
     
     
     • If HR integration is implemented, information located in the directory is overwritten during next data read
       
        
   • Account action's Reset password will change users password in the directory
     
     
     • IGA Admin fulfills new password field
       
        
     • IGA Admin chooses if password needs to be changed during next login
       
        
   • Account action's Unlock account, if user has entered wrong password too many times, account can be unlocked without password change
     
      
2. IGA Admin can also add new IGA Entitlements to the IGA Account by IGA Service request
   
   
   • IGA solution creates group membership connection and creates also approval request to users manager and approval needs to happen in Self-Service Portal during the next 24 hours. 
     
     
     • If approval is not received, IGA solution removes IGA Entitlement and informs for example organizations CISO via email and removes IGA Entitlement from the IGA Account
       
        
     • If connection is made to privilege accesses***, email notification is sent immediately. 
       
        
3. IGA Admin saves changes and provisioning is started
   
    
4. IGA Access Right Records are created and auditing details are saved

Service account is technical account in directory, which is not related to any identity, but instead it is owned by user(s). 
 

1. Service Accounts are read from the directory to IGA Account datacards
   
   
   • IGA Account type is set to Service Account
     
     
     • If Customer has added owner information to the account, it can be read to IGA Account datacards owner attribute
       
        
     • If Customer has added application information to the account, it can be read to IGA Account datacards application attribute
       
        
2. IGA Admin can add Owner information, by opening the IGA Service request datacard
   
    
3. Service Accounts are included in user off-boarding, so that owner information can be updated when employment has ended. 
   
    
4. IGA Access Right Records are created and auditing details are saved

Basic: First name, spoken name, last name, email address, username, organizational information, title, start date, end date, Manager name

Secure: Basic email content + Social Security number

Auditing details are saved

IGA Access Right Record datacards are created when new user is created and when user information for departing users is updated.

IGA Access Right Record is created when IGA Admin Action is performed.