Provisioning and Workflow
Chapter 1: Introduction to the Provisioning and Workflow Paper
On This Page
Executive SummaryToday's large organizations often have complex and poorly designed processes for provisioning systems with information for computer network users. For example, in some organizations, it can take up to two weeks before new information workers can access e-mail and the applications that they need for their jobs. The manual, task-intensive processes that are typically involved in identity provisioning add overhead, delay employee productivity, and often lead to a network environment that is not secure. This paper discusses how to provision identities automatically into multiple directories and identity stores in a heterogeneous environment. It also discusses managing security and e-mail group memberships, and describes a workflow process that can extend automated processes. You can use the information in this paper to enable the automated administration of user identities and reduce costs while you increase the availability and security of information resources. This paper also provides detailed configuration tasks that you can use to achieve these results by using Microsoft® Identity Integration Server 2003, Enterprise Edition with Service Pack 1 (MIIS 2003 with SP1). This paper is part of the Microsoft Identity and Access Management Series. The Business ChallengeOrganizations store identity information in numerous repositories, or data stores. Using a product that includes metadirectory functionality allows you to synchronize existing data so that it is consistent across these stores. The Identity Aggregation and Synchronization paper, which is part of this series, describes this synchronization capability in detail. The provisioning challenge is to use technology to automate the addition of new identities to these stores. Deprovisioning, which refers to processes that remove and disable accounts at the end of an identity object’s life cycle, is closely related to this challenge. Your environment might require workflow processes to provide discretionary input to provisioning tasks. For example, in cases that involve security-oriented or special-purpose requirements. The manual administration of provisioning tasks is slow and typically does not enforce policies for access and authorization in a consistent manner. Without reliable, automated processes it will often not be practical even to attempt to implement all desirable policies. The business challenges that relate to provisioning include how to:
The Business BenefitsThe business benefits that organizations can achieve through efficient, largely automated administrative processes for provisioning and deprovisioning based on reliable technologies include:
Who Should Read This PaperThe intended audience for this paper includes system architects, IT professionals, managers, technical decision makers, and consultants involved in identity life cycle management efforts. Reader PrerequisitesThis paper assumes that readers have a moderate knowledge of the identity and access management concepts and technologies described in the Fundamental Concepts paper in this series. To implement any of the solutions in this paper, readers should understand the infrastructure described and implemented in the Platform and Infrastructure paper in this series. In addition, implementing the solutions in this paper requires the following prerequisites:
To properly understand the solution, it is also helpful to know Microsoft Visual C#® and Visual Basic® .NET, as well as MIIS 2003 with SP1. FeedbackPlease direct questions and comments about this guide to secwish@microsoft.com. Paper OverviewThis paper explains how you can design, plan, build, and operate provisioning and workflow solutions by using the following technologies:
ScenariosIn addition to a general discussion of provisioning and workflow approaches, this paper also provides detailed prescriptive guidance on implementing solutions based on three typical scenarios for Contoso Pharmaceuticals, a fictitious organization. HR-Driven ProvisioningIn this scenario, synchronizing identity information is only part of the required solution for Contoso. In addition to enabling a comprehensive view of its users, the company needs a provisioning solution. Data that resides in Contoso's mySAP ERP Human Capital Management system (SAP HR system) drives this solution to initiate automated provisioning operations. This scenario describes how Contoso implements automated full-time employee account provisioning using MIIS 2003 with SP1. Tools and TemplatesYou can use a set of configuration files, source code, scripts, and other data files to quickly and effectively implement the solution for this scenario. Group ManagementIn this scenario, Contoso manages the following groups in its environment:
Historically, Contoso has found it difficult to both place users in the appropriate groups during the provisioning process, and manage groups as users change roles, positions, and locations during their careers. This situation has led to user frustration, increased help desk call volume, and inappropriate access granted to some users. This scenario describes how Contoso implements automated group management in its environment by using a group management application. Tools and TemplatesA sample Group Management Web application is provided in this scenario. The application can provide a solution for simple cases, and you can extend it for more complex ones. Contoso developed this tool to provide the following additional functionality:
Self-Service ProvisioningIn this scenario, although the Contoso SAP HR system is considered the authoritative source for full-time employees, department managers hire contractors on a case-by-case basis. Because there is not an authoritative data source to drive fully-automated provisioning for contractors, Contoso requires managers to use a separate mechanism to request contractor accounts. To provide adequate security and safeguards for accounts, members of the IT administrators group must approve all such provisioning requests.This scenario describes how Contoso implements a Web application to provision contractor accounts. The application includes simple workflow capability. Tools and TemplatesThe sample workflow-driven provisioning application provides the following functionality:
Useful configuration and other data files are also provided in this scenario. Chapter ArrangementChapters 3 through 7 in this paper provide design and implementation details for the following three scenarios:
This paper includes the following seven chapters: This chapter provides an executive summary, introduces the business challenges and benefits, suggests the recommended audience for the paper, lists reader prerequisites, and provides an overview of the chapters and scenarios in the paper. Chapter 2: Approaches to Provisioning and Workflow This chapter builds on the information provided in the Fundamental Concepts and Identity Aggregation and Synchronization papers in this series. It discusses approaches to provisioning, group management, and workflow. Chapter 3: Issues and Requirements This chapter defines the background, technology, security issues, and requirements for the HR-Driven Provisioning, Group Management, and Self-Service Provisioning scenarios. Contoso Pharmaceuticals, a fictitious organization, is used to illustrate the scenarios. Chapter 4: Designing the Solution This chapter highlights the key elements of the solution for each scenario; introduces the concepts, prerequisites, and architecture; and discusses how the proposed solution addresses the initial requirements. Chapter 5: Implementing the Solution This chapter builds on the infrastructure described in the Platform and Infrastructure and Identity Aggregation and Synchronization papers in this series to provide implementation details for the scenarios discussed in this paper. It also includes step-by-step configuration instructions. Chapter 6: Testing the Solution This chapter describes how to validate the implemented solution, including some troubleshooting steps to overcome common implementation challenges. Chapter 7: Operational Considerations This chapter discusses ongoing operational activities that must occur to ensure the continued success of the solution for each scenario.
|
In This Article
|
