IT Service Catalog Group: Identity and Access Management (IAM)-Everything Report ** DRAFT **

Transcription

1 IT Service Catalog Group: Identity and Access Management (IAM)-Everything Report ** DRAFT ** ACCESS MANAGEMENT Group Management Services providing the ability to administer access management controls. Group search. Fully define services when Access Mgmt. project kicks off in Priviledge Management Authorization services for directory and privledges University Service Providers I AUTHENTICATION Fully define services when Access Mgmt. project kicks off Break down--into services. Authentication Services "Services providing the ability to validate the identity of user; the user is who he/she says they are. Typically, this is accomplished through a username/user ID and password pair. e.g. Single SignOn, 2nd Factor, Federated Authentication, University Service Providers I CONSULTING Business Identity Integration e.g. Consulting with the Undergraduate Admissions Office on the integration of identity provisioning into their application process. Stakeholder offices I IDENTITY ASSURANCE Page 1 of 10

2 Identity Assurance Profile Admin Services providing the ability to manage person identity information that is tied specifically to the confidence in the credential. We need more clarification on this service? Who will have this ability? What can they update? IDENTITY SELF-SERVICE Credenital Linking Service providing the ability for a person to enable the linking of multiple credentials to a person's identity. e.g. Facebook connect, OpenID connect, departmental active directory Identity Privacy Service providing the ability for a person to choose what e.g. Student would identity information they make available for display internally have the ability to hide (PSU) and externally. the display of name, phone and address from the Penn State public directory. Page 2 of 10

3 Password Reset Service providing the ability for a person to reset their password. e.g. If student successfully answer's their identity security questions, they would be provided the opportunity to set a new password. Dec Profile Update - Which unit (AIT or IAM) will be the owner of this service? Short term vs. long term. - Include process for answering security questions and resetting password. - Should we call this service ""Forgot Your Password""?" Dec Service providing the ability for a person to update their profile information. e.g. Student would have the ability to update their profile information (for the profile data that does not require proofing). - Includes functionality for maintaining history of changes. - The PSU ID# and Photo fields are ""view"" only (user unable to change)." Page 3 of 10

4 Recover IAM ID Service providing the ability for a person to recover their IAM ID. We need to futher define this process in detail. Dec Inactive I - Which unit (AIT or IAM) will be the owner of this service? Short term vs. long term. Relationship Linking Service providing the ability for a person to establish a relationship with another person in the Central Person Registry. e.g.the ability for a person to link a person (eg. Family member) to their IAM ID. Security Information Service provding the ability for a person to maintain their e.g The ability for a security questions and security answers. user to maintain their security answers and questions. Dec Which unit (AIT or IAM) will be the owner of this service? Short term vs. long term. Services Admin - Self Service Service providing the ability for a person to view the status of???? services that have been provisioned. e.g Functions for a person to view expiration dates, view approvals (workflow) and submit requests for services like , PASS, 2nd factor authentication. Page 4 of 10

5 PERSON ADMIN Auditing and Reporting Service that provides an authorized staff the ability to filter and view system logs. e.g. Security personnel needing to resolve security incidents. (Internal and External - auditors), SOS. IAM Administrators, Auditors, SOS Business Rule Admin Service that provides authorized staff the ability to maintain e.g. IAM administrators access to rules, manage rule version and update rule data. will utilize this tool to manage IAM business rules IAM Administrators CPR Value list Service that provides an authorized staff the ability to e.g. Data such as maintain the CPR controlled vocabulary. Address types, affiliations, phone types, country codes IAM Administrators ID Card Web Service provided to authorized RA for the management e.g. F&B will call the of ID+ card data within the CPR. web service from their application when updating ID+ related data including photos. Finance and Business F&B will provide their own UI for managing ID+ data Page 5 of 10

6 Match, Merge and Reassign utility Dec Service that provides authorized staff the ability to compare identity records and make merge and re-assignment decisions. e.g. Authorized RAA will use this tool to merge and re-assign 1 or more identity records. The find person function will allow them to search the CPR for persons Password Reset Service that provides authorized staff the ability to reset a e.g. Authorized staff persons password if sufficient person identity information can will reset a user's be validated. password during a phone call with user. Staff member will request information from user for proofing. 1-time password will be passed to user over phone (with "password reset" confirmation delivered to address of record). Help Desk Staff, Accounts Office Dec Page 6 of 10

7 Person Record Management Dec Service that provides authorized staff the ability to create, update, archive, and view identity records. e.g. Authorize staff could create an identity with this utility, archice/de-activate an identity, view or unarchive/activitate IAM Administrators, Help Desk Staff, Photo Display Service that provides authorized staff (eg. Police Services) the e.g. A student is missing ability to search for a person and return their biographical and a Police officer information including photo. needs to access their photo. Police Services, SOS Registry History Service that provides authorized staff the ability to locate a e.g. An IAM data element and return the record history. administrator has been requested to return the history on the name changes associated with an identity. IAM Administrators Service Admin Service for Service Provisioners to manage their notifications from the CPR (eg. That are tied to IAM) Application Service Provisioners RA ADMIN Page 7 of 10

8 ID card maintenance Service that provides a Registration Authority Agent (RAA) the ability to maintain ID card information. e.g. ID+ card office would maintain ID+ card data and photo information via this service. Will this be an Iam Online user interface or ID+ office? Identity Proofing Service that provides an RAA the ability to record identity e.g. The RAA for the ID+ proofing events. Office would use this service to proof students during FTCAP process. Registration Authority Agent Authorization Service that provides Chief Registration Authority Agent (CRAA) the ability to authorize within their domain. Include functions for assigning rights, training certification and access revocation. REGISTRY ADMIN Page 8 of 10

9 Service Provisioner Admin Service that provides authorized Service Provisioniers the ability to manage their CPR notification messages. e.g. To receive a notification when a persons name changes the Service Provisioners would have registered for the name change message. Active I REPORTING We'll need a workflow process for authorizing Service Provisioners. Target completion is before start of BII. Data Views Service that provides authorized staff varying data views to CPR data. Data views will need to be defined by Registration Authorities. Registration Authorities I Is this an ITS Business Intelligence service? SERVICE PROVISIONING Identity Provisioning Service that provides an authorized RA the ability to create an identity in the CPR. e.g UAO, Grad School, Outreach (DestinyOne), Hershey, are examples of RA's that would integrate this "selfasserting identity"service into their application process. Registration Authority Dec TRAINING Page 9 of 10

10 Registration Authority Training and Certification Service that provides training and certification for Registration Authority Agents. e.g. Each RAA will need to complete a training and certification process before they will be enabled access to IAM provided RA services. I Page 10 of 10