Self Service Workflow
ID-Synch®'s workflow automation engine streamlines the process of requesting and authorizing the creation of new accounts, as well as other security changes such as add/remove group membership, change attribute value, rename or move user, delete or deactivate user and so on.
The ID-Synch workflow engine uses secure web input (HTTPS) and prompts authorizers for input using e-mail (normally SMTP).
The workflow automation engine works as follows:
- Request input:
- Users can authenticate to the system and make change requests.
- Change requests are formulated as changes to user profiles -- the requester's or another user's (the recipient).
- Change requests may be to change data attributes, add new accounts, add or remove group memberships, enable accounts or disable accounts. In other words, changes are formulated as changes to user profiles, in relation to the recipient user's current state.
- Plug-in programs can limit or alter requests -- for example by limiting who can submit a request, by limiting what requesters can ask for, by validating or filling in fields in a request, or by assigning a login ID to new users.
- Requests may be for changes to user attributes or to add or remove single login accounts, collections of privileges (roles) or physical objects (e.g., tokens, building access badges, etc.).
- Request routing:
- Requests are automatically routed to appropriate authorizers, which are selected based on the identity of the requester and based on the roles and templates requested.
- All authorizers are prompted to respond concurrently. Authorizers may delegate alternates in their absence.
- In most cases, a response is only required from a subset of the authorizers -- for example, any one of three people can approve access to a system.
- Authorizers are notified by e-mail that their input is required. They click on a URL embedded in the e-mail to respond.
- Authorizers may be prompted to respond repeatedly if no response is received within a defined period. Requests that are pending response for too long may be escalated to new authorizers or to a call tracking system.
- Authorization:
- Authorizers review requests using a web form, over a secure connection (HTTPS).
- Executing approved requests:
- Once adequate authorization has been collected, ID-Synch can automatically create login IDs, update existing IDs or request action from system administrators and others using e-mail and call tracking system integration.
The ID-Synch workflow system can integrate with a variety of existing infrastructure:
- Change requests may be submitted by other systems -- for example,
home-grown or vertical market workflow systems -- using
a well defined SOAP service.
- Change requests may be submitted by the ID-Synch
automated administration system, which in turn draws
data from both systems of records and managed target
systems.
- User-entered change requests are validated by plug-in programs,
which can draw on code validation tables in existing databases
(e.g., using SQL) and on user attributes and organization chart data in
existing directories (e.g., using LDAP).
- Authorizers for new change requests
can be selected by a plug-in program and for
example can be drawn from the organization chart in an existing LDAP
directory.
- Appropriate business users (normally managers and system owners)
are asked to authorize change requests, by e-mail.
- Problems -- such as failure by authorizers to respond to requests -- can be escalated to help desk ticketing systems (e.g., Remedy, Peregrine).