IdentityIQ Preview

Fundamentals of IdentityIQ Implementation

IdentityIQ Preview
Overview
• IdentityIQ business purpose
• IdentityIQ technical overview
• IdentityIQ functional elements
• Implementation Strategies

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 2

Why Identity and Access Management?
Common Business Objectives
• Security and regulatory compliance
• Review user access and eliminate unneeded access
• Enforce segregation of duties and other access policies
• Provision new access in compliance with standards
• Deactivate access quickly when users leave the organization
• Business service
• Provision required access quickly
• Provide control to the business
• Managing passwords
• Access change requests
• IT efficiency
• Lower IT support call volume
• Increase the amount of administration automation

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 3

 SailPoint IdentityIQ

Business need
Access Access Automated Password Policy
Certification Request Provisioning Management Management

Business model
Policy Role Workflow Identity Risk
Reporting
Model Model Engine Warehouse Model

Business data Users • Applications • Data

INTEGRATION FRAMEWORK
Connectors APIs Plugins

Business applications IT infrastructure

Cloud On-prem 3rd party
apps apps Integrations
Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 4
SailPoint IdentityIQ
Compliance Manager Lifecycle Manager
• Business Friendly Access Governance • Business Friendly Access Provisioning
• Confirming and enforcing least access • Provisioning within bounds of
across all applications • Providing and enforcing least access
• Modeling and enforcing business and • Business and IT policies
IT policies • Automating provisioning
• Auditing user’s access and the controls • Providing control to the business
around that access • Managing passwords
• Enforcing compliance • Access change requests

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 5

IdentityIQ Technical
Overview

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 6

IdentityIQ Process – Reading Data
Entitlement
Catalog
App1 App2
________ ________
________ ________
________ ________
________ • Identity Attributes
• Application
Accounts
• Entitlements
Identity

Aggregation
IdentityIQ
Source
Applications

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 7

IdentityIQ Process – Business Modeling
Entitlement • Policies
Catalog • Risk
App1 App2 Modeling • Roles
________ ________
________ ________
________ ________
________ • Identity Attributes
Roles • Application
Accounts
Role1 Role2 • Entitlements
________ ________
________ ________
________ Identity
________
________
________

Aggregation
IdentityIQ
Source
Applications

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 8

IdentityIQ Governance Process
• Certification
Entitlement Detection • Policies
Catalog • Risk
App1 App2 Modeling • Roles
________ ________
________ ________
________ ________
________ • Identity Attributes
Roles • Application
Accounts
Role1 Role2 • Entitlements/Roles
Entitlements
• Policy Violations
________ ________
________ ________
________ Identity
________ • Risk Assessment
________
________
Refresh
Aggregation Revoke
IdentityIQ
Source
Applications

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 9

IdentityIQ Provisioning Process
Entitlement • Policies
User Catalog • Risk
Requested
App1 App2 Modeling • Roles
Change ________ ________
________ ________
________ ________
________ • Identity Attributes
Roles • Application
Accounts
Role1 Role2 • Entitlements/Roles
• Policy Violations
________ ________
________ ________
________ Identity
________ • Risk Assessment
________
________
Refresh
Aggregation Provision
IdentityIQ
Source
Applications

Data
Change

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 10

Functions Needed to Meet Biz Purpose
Example Projects

Biz Purpose Certification Only Certification & Provisioning Only Certification &
Roles Provisioning
Function
Aggregation Required Required Required Required
Entitlements Required Required Required Required
Catalog
Certification Required Required Required
Policy Optional Optional Optional Optional
Risk Optional Optional Optional Optional
Roles Optional Required Recommended Recommended
LCM Request Required Required
LCM Events Recommended Recommended

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 11

Knowledge Check

Copyright ©© SailPoint
Copyright SailPoint Technologies,
Technologies, Inc.
Inc. 2017.
2017. All
All rights
rights reserved.
reserved. 12
Introduction to IdentityIQ
Functional Elements

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 13

Intro to IdentityIQ Functional Elements
• Tasks
• Business Processes (workflow)
• Rules

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 14

IdentityIQ Objects and Actors
Tasks and Business Processes
• All data is stored in IdentityIQ as objects
• Tasks are batch jobs that act on objects
• Tasks typically process data on a
schedule
Tasks Certifications
• Business processes act on objects in Roles
response to events or user requests
• Business processes typically interact Risk
with the user Business Model
Processes
Identities
Policies
Entitlement Application
Catalog Configurations

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 15

Example Task and Business Process

Tasks
Business
Process

Identity

Refresh
Aggregation Provisioning
IdentityIQ
Source
Applications

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 16

Tasks Tasks

• Many standard tasks

are pre-configured
• Many task templates are provided
• Implementation team
• Configures tasks
• Can develop tasks specific to your
environment
• System administrator
• Responsible for monitoring tasks Templates

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 17

IdentityIQ Maintenance Tasks
Required for IdentityIQ Functionality
• Four tasks are pre-scheduled

Task Purpose Default Schedule

Perform maintenance Keeps standard systems moving through Every 5 minutes

their phases

Check expired mitigations daily Scans for policy & certification exceptions Daily
that have expired

Check expired work items daily Scans for uncompleted work items that Daily
have expired

Perform Identity Request Checks for provisioning completeness Daily

Maintenance

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 18

Business Processes (Workflows)
• A sequence of steps to perform work triggered by system events or a user request
• Standard business processes are pre-defined in IdentityIQ
• Implementation team responsibilities
• Configure standard business processes
• Can develop business processes specific to your environment

LCM Provisioning Business Process

Interact with manager or
owner to obtain approval

Provision
the access

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 19

Incorporating Business Logic
BeanShell Rules
• Snippets of user code written to inject • Rule “hooks” provided throughout
business logic IdentityIQ
• Common uses Example Rule Location:
• Prepare data for aggregation
• Customize data during aggregation
• Define unique business policies
• Control certification behavior
• Provide values for drop-down menus
• Provide application provisioning logic
• …and many more!

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 20

Incorporating Business Logic
BeanShell Rules – Creation Options
• With IdentityIQ rule editor
• Create in IDE
• Import from XML file

• Stored as reusable objects

in the database

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 21

Implementation: Where
do you start?

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 22

Three Steps to Governance-based Provisioning

Step 1: Get Compliant

Step 2: Build Foundation
Understand current state
of access and establish Step 3: Manage Ongoing
a compliance baseline Define and implement Changes
governance model and
• Build Entitlement controls Configure business
Catalog processes, provisioning
• Establish responsibility • Define policy model channels and monitoring
• Perform critical • Define risk model
• Deploy request services
remediations • Implement roles
• Integrate fulfillment
• Define approvals procedures
• Establish oversight

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 23

Last Mile Neutral Provisioning
Start with Minimal Disruption
Business Processes Fulfillment Processes IT Resources

•Give new Service

employee access Provider

•Give new
employee access
•Give temporary Help Desk
access to contractor
•Give temporary
Email
access to contractor
•Review access
•Review access Automated
Provisioning
•Approve role change
•Approve role change
Paper process
•Remediate policy
violation
•Remediate policy IT Admin
violation Change

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 24

Last Mile Neutral Provisioning
Focus Automation on High Volume Fulfillment
Business Processes Fulfillment Processes IT Resources

•Give new Service

employee access Provider
•Give new
employee access Help Desk
•Give temporary
access to contractor
•Give temporary
access to contractor

•Review access
•Review access SailPoint
Automated
Provisioning
Provisioning
Engine
•Approve role change
•Approve role change
•Remediate policy
violation
•Remediate policy IT Admin
violation Change

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 25

Summary
• IdentityIQ purpose and components
• Business friendly access governance and provisioning
• Business problem is solved by IAM Solution modules
• Compliance Manager
• Lifecycle Manager
• Business policy, roles, risk are modeled in the Governance Platform
• Integration Modules leverage existing IT systems
• Technical overview
• IdentityIQ governance process
• IdentityIQ provisioning process
• Common concepts
• Tasks & workflows are the IdentityIQ actors
• Rules are snippets of user written code inserted at pre-defined locations
• 3-step getting started process

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 26

Knowledge Check

Copyright ©© SailPoint
Copyright SailPoint Technologies,
Technologies, Inc.
Inc. 2017.
2017. All
All rights
rights reserved.
reserved. 27
Product Architecture and Deployment
Fundamentals of IdentityIQ Implementation
Overview
Product Architecture and Deployment
• Product architecture overview
• Deployment strategy and environment management
• Deployment characteristics of IdentityIQ
• Task hosts and request hosts
• High end deployments (Redundancy)
• Deployment consideration for database

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 3

Product Architecture

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 4

IdentityIQ Product Components
Review

Access Access Automated Password Policy

Certification Request Provisioning Management Management

Policy Role Workflow Identity Risk

Reporting
Model Model Engine Warehouse Model

Users • Applications • Data

INTEGRATION FRAMEWORK
Connectors APIs Plugins

Cloud On-prem 3rd party

apps apps Integrations
Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 5
Detailed Architecture Overview
External Applications Web Browser Interface Target Systems
CSV FILE
JDBC
Active
– REST Directory/LDAP
IdentityIQ Application
– API – UI
– SCIM
Application Server

SAP
– Application Other applications
– Tasks Connectors 3rd Party
Identity Mgmt
– Workflows – Integration
Solutions
Modules
– Quartz Scheduler Service Desk
– Email Ticketing &
Change Mgmt
– Hibernate Mobile Device
Management
Systems
Database

IdentityIQ Database
Server

Email Server
– IdentityIQ Tables
(for notifications)
– Object Model
Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 6
Installation Components

• Java Runtime
• Application Server
• IdentityIQ Software running inside the Application Server
• Database Server

Sample IdentityIQ installation location (from the training VM):

/home/spadmin/tomcat/webapps/identityiq

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 7

System Choices
Supported Platforms • Browsers
• Application Servers • Firefox ESR
• Tomcat • Internet Explorer
• WebSphere • Google Chrome
• WebLogic
• JBoss • Safari
• Databases • Mobile Support
• MySQL • IOS
• Oracle • Android
• MS SQL Server
• DB2 • Windows Phone
• Java Platform • Native Browser Blackberry
• Sun, Oracle or IBM JDK
• Oracle JRockit JDK

• Deploy what you are most comfortable maintaining!!!!

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 8

Extension Levels

Extension Target Method Knowledge Needed

IdentityIQ Objects Configuration IdentityIQ
• Applications Java
• Identity attributes XML
• Rules
• Etcetera

Web Application Objects XHTML XHTML & JSF

CSS Web Design
Images

Java Compiled Code Java

• Custom tasks
• Custom connectors/integrations
• Workflow libraries
• Plug-ins

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 9

Extending IdentityIQ
Plugins
• Support easily adding new features
• Ease packaging, sharing, and managing of add-on functionality
• Enable implementers to provide standardized extensions
Data Access
Governance Service
API Management
DAG SM
Plugin Plugin

Privileged Governance, Risk

Account PAM GRC & Compliance
Mgmt. Plugin Plugin

Security Info & SIEM MDM Mobile Device

Event Mgmt. Plugin Plugin Management

DLP UBA
Plugin Plugin
Data Loss User
Prevention Behavior
Analysis

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 10

Knowledge Check

Copyright ©© SailPoint
Copyright SailPoint Technologies,
Technologies, Inc.
Inc. 2017.
2017. All
All rights
rights reserved.
reserved. 11
Deployment

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 12

Deployment Strategy
Best Practice
• Sandbox – Developer Environment
• Individual IdentityIQ system per developer
• Typically limited memory, disk space and running in a VM
• Load small amount of representative data
• Development – Unit Test Environment
• System for multiple developers to test code together
• Load small amount of representative data
• Staging –Test Environment
• User acceptance, functional testing, etc.
• Similar to production
• Can be used for performance and stress testing
• Production Environment
• Incorporates redundancy and failover

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 13

Deployment Strategy
Environment Management Best Practice

Sandbox Version Development

Staging / UAT Production
Developer 1 Control Integration

Build
Process
Sandbox
Developer 2
Deployment
WAR

Sandbox Build Development Staging / Test Production

Integration

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 14

Build Process
Services Standard Build (SSB)
• Created and used by SailPoint Professional Services
• Automates packaging and deployment of custom objects and code
• Supports token replacement – useful for dissimilar environments
• Build configuration for Apache Ant build tool
• Utilize directly or as a model for creating a build process

• SSB Process
• Export objects from sandbox into XML files
• Push XML files to version control system
• Use the build tool to build .war from the version control directory
• Release packaged war to additional environments

• Available on Compass
Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 15
Architecture
Simplest Model
Host 1

Application Server Database Server

IdentityIQ IdentityIQ
LOCALHOST Tables

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 16

Architecture
Processing and Storage Segregation
Host 1 Host 2

Application Server Database Server

IdentityIQ IdentityIQ
Tables

Application Server Tier Database Tier

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 17

Architecture
Application Server Availability / Redundancy
Host 1 Host 3
UI Hosts
Application Server 1 Database Server
Host 2
IdentityIQ IdentityIQ
Application Server 2
Tables
Load
Balancer IdentityIQ

• Session Affinity
(Sticky Sessions)

Host 3

Application Server 3
Batch Host
IdentityIQ

Application Server Tier Database Tier

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 18

Multi-host Deployments
UI versus Batch Hosts
• Batch hosts handle
• Workflows
• Tasks/reports
• Certification generation
• UI hosts handle user interactions
• Access Requests
• Performing Certifications
• Dynamic Analytics

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 19

Designating Batch/Task Hosts
• Controlled in the Task and the Request ServiceDefinition objects
• Default, hosts=global, tasks and requests can run on any server

<ServiceDefinition created="1388105905677" hosts="global"

id="ff80808143318eba0143318f360d00f7" name=“Task">
<Description>
Service definition for the Request processor service.
</Description>
</ServiceDefinition>

• Specify batch hosts in both objects

<ServiceDefinition created="1388105905701" hosts=“HostA,HostB"
id="ff80808143318eba0143318f362500f8" name="Request">

<ServiceDefinition created="1388105905677" hosts=“HostA,HostB"

id="ff80808143318eba0143318f360d00f7" name=“Task">

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 20

Architecture
Two-Tier Redundancy
Host 1 Host 3

Application Server 1 Database Server 1

IdentityIQ IdentityIQ Database

Tables Replication

Load
Balancer Host 2 Host 4

Application Server 2 Database Server 2

IdentityIQ IdentityIQ
Tables

Application Server Tier Database Tier

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 21

Other Architectures
Database Clustering
Host 4

Database Cluster
Member Server
IdentityIQ
Host 3 Tables

Database Cluster
Controller(s)

Host 5

Database Cluster
Member Server
IdentityIQ
Tables

Application Server Tier Database Tier

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 22

Deployment Database Considerations
• Network Proximity (latency) to the Database Server is extremely important for
IdentityIQ
User Browser/
Workstation Corporate LAN/WAN Data Center Database Server
LAN
IdentityIQ

Critical network performance zone

Less critical network performance zone
IIQ requires 3ms or less (0.3ms preferred) round-trip
On the corporate LAN/WAN only modern broadband latency between its application server and its
speeds (1mbs and faster) are required for user browsers Database Server.
sessions.
The application server and the database server
should be housed in the same data center on a GigE
or 10-GigE network.

Do not put DB Server across the WAN

Copyright © SailPoint Technologies, Inc. 2017. All rights reserved. 23

Knowledge Check

Copyright ©© SailPoint
Copyright SailPoint Technologies,
Technologies, Inc.
Inc. 2017.
2017. All
All rights
rights reserved.
reserved. 24