A Different View of IdM Biz Process? Michael R Gettes Duke University Denver, June 2005

Duke Cough ahem Cough, Cough Gag… Cough Next slide please …………

The Problem (per Tom U of Memphis) Unclear process for lifecycle management of accounts & other IT resources –Seat of pants policy determination Inconsistent operational practices –Done differently by different people at different times Common business logic forced to reside in applications to determine eligibility –Eg. Is this user “currently a member of community”? –Inconsistent service levels for users results.

Not shown: transitions to prospective state from grace, limbo, slide, IDonly. Tom Barton’s Original U of Memphis States View of IdM …

Adding to the Problem … Gaining common understanding among Id Mgmt functional types Communication between Id Mgmt Functional and Id Mgmt Technical types How do Service Providers fit in? Knitting together other Business Processes with IdM Biz Process (communication and understanding) Hence, A Duke View…

ACTIVE or EXISTS Creation Condition Action Result Identity & Service/Provisioning States (functional view) Become Student Become Faculty Remove Student Services

ACTIVE or EXISTS Creation Condition Action Result DISABLEDGRACE Identity & Service/Provisioning States (functional view) Become Student Become Faculty Remove Student Services Terminated Staff

IDENTITYOBJECTIDENTITYOBJECT Condition Action Result Loop Over All Conditions Until No Actions Stable State For each ID Object … For good biz logic Order must not matter

ID Object #1 Old ID Object #1 New ID Object #2 Old ID Object #2 New ID Object #3 Old ID Object #3 New ID Object #4 Old ID Object #4 New Identity Management Business Logic Testing and Validation Now Possible