how to govern and maintain compliance using open source ......oracle hcm 3. ldap apachecon na, miami...

How to Govern and Maintain Compliance Using Open Source

Identity Management Components

May 17, 2017

ApacheCon NA, Miami

Introductions

ApacheCon NA, Miami 2017

2

• Katarina Valalikova – @KValalikova

– [email protected]

• Shawn McKinney – @shawnmckinney


Session Objective

Learn about identity governance and demo common use cases w/ open source infrastructure.


3

Session Agenda


4

• Terminology

• Benefits • Scenarios • Solution

• Demo

• Questions

Image from: HTTP://EVENTS.LINUXFOUNDATION.ORG/EVENTS/APACHECON-NORTH-AMERICA

Terminology


5

Terminology


6

Terminology


7

Terminology


8

Terminology


9

Terminology


10

What can possibly go wrong here?

1. Too many accounts 2. Too few accounts 3. Don’t know many accounts


What can possibly go wrong here?

1. Improper account retention policies 2. Violation of principle of least privileges 3. Sharing credentials instead of accounts

4. No account approval process. 5. Non-determinant assignments 6. Violation of privacy.


In other words, we need

1. Access certification

2. Approvals 3. Notifications 4. Escalation

5. Deputy

6. ….


What is Identity Governance?

• Combines with IAM functions to meet audit and compliance obligations.


Gartner says:


• Policy-based centralized orchestration of user identity management and access control.

• Helps support enterprise IT security and regulatory compliance.

• Margaret Rouse, WhatIs.com


WhatIs calls it:


• High-level business processes, business rules, policies, organizational structures

• Combines with low-level identity management processes like data synchronization, system integration, data formats, data transformation, network protocols

• Radovan Semancik, wiki.evolveum.com


Radovan says:

Role Based Access Control


18

RBAC and Policy Rules


19

• Constraints • Actions • Situations

Identity Management and Governance


20

Architectural Overview


Requires • Java version 8

• Java servlet container

• Relational database

Uses • Spring Framework

– component wiring

• Apache Wicket – user interface

• ConnId – common connectors


(any)



IdM services, security and User-account

mappings

resource and account

management

Common data model, libs and low-level utils

data storage and task management

User interface

components

high-level components

don’t connect with low-level components

1

3

2

4

5

Demo


Resource / Connectors at Play

1. Google Apps 2. Oracle HCM

3. LDAP


Demo Environment

Google Apps

connector

HCM connector (peoplesoft)

Open

26


Use Cases

• UC 1 – Onboarding New Identity, Account activation

• UC2 – Role assignment • UC3 – Self service

• UC4 – Deputy

• UC5 – Account Certification / Recertification •


27

UC 1 Onboarding new Identity

1. User is imported from HCM

2. Activation link is sent to the user 3. User activate his account 4. Basic roles are assigned to the user after

activation


28

UC 2 Role assignment

1. Manager assigns roles to onboarded user 2. Manager selects conflicting roles 3. Roles are not assigned because of SoD

violation


29

UC 3 Self service

1. User selects roles he needs to have assigned

2. Request is send to approval 3. Approval starts


30

UC 3 Self service


2. Request is send to approval 3. Approval starts 4. Approval from manager is needed


31

UC 3 Self service



5. Approval from security officer is needed


32

UC 3 Self service




6. Approval from application owner is needed


33

UC 3 Self service 1. User selects roles he needs to have assigned



6. Approval from application owner is needed

7. App owner is on the vacation – escalation


34

UC 4 Deputy

1. Manager is going on vacation

2. Manager delegates his work


35

UC 5 Access certification

1. New campaign for access certification starts

2. Manager decides which accounts are legal


36

Benefits of Governance Controls

• Advanced role lifecycle management • Audit and reporting interfaces • Enhanced regulatory compliance

• Improved business responsiveness • Privileged account management • Self-service interfaces


37

Governance simply • Notifications • Recertification

• (Multi-level) approvals • Escalation

• Delegation

• Deputy

• Role lifecycle

• Audit trail ... ApacheCon NA, Miami 2017

38

Questions


39

Contact


40

• Katarina Valalikova – @KValalikova


• Shawn McKinney – @shawnmckinney


how to govern and maintain compliance using open source ......oracle hcm 3. ldap apachecon na, miami...

Documents