System and method for artifact management and representation in identity management systems and uses of same, including representation of effective access and application of identity management policies
Systems and methods for embodiments of identity management systems and data models used by identity management systems are disclosed. Embodiments of the identity management systems and associated data models as disclosed herein may associate identities with their respective entitlements, while preserving the hierarchy imposed by the source system from which those identities or entitlement were derived, including the hierarchical structure that resulted in the (direct or effective) assignment of such an entitlement, along with the hierarchical nature of the digital assets to which those entitlements pertain. Using embodiments of the disclosed data model embodiments of identity management systems may implement tasks, processes or policies that take advantage of the ability to easily navigate between an identity and its respective entitlements, the management structures that resulted in the entitlement being assigned or the hierarchical relationships between the digital assets corresponding to those entitlements.
1. An identity management system, comprising:
a processor;
a non-transitory computer-readable storage medium, including computer instructions for:
an indexing service for:
obtaining identity management data from one or more source systems in a distributed enterprise computing environment, the identity management data comprising data on a set of identity management artifacts utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine a first entitlement for a first digital asset of the source system and a second entitlement for a second digital asset of the source system, wherein the first entitlement is directly assigned to a user and the second entitlement is indirectly assigned to a user through a first management structure maintained by the source system whereby the user is granted the second entitlement by virtue of the user's assignment to the first management structure by the source system; and
representing the user, the first entitlement for the first digital asset, and the second entitlement for the second digital asset in a data model at the identity management system, wherein the data model includes:
an identity cube representing the user, the first entitlement for the first digital asset, and the second entitlement for the second digital asset such that the first entitlement for the first digital asset and the second entitlement for the second digital asset are a single level removed from the identity cube representing the user wherein,
the first entitlement for the first digital asset is directly linked to the identity cube representing the user,
the second entitlement for the second digital asset is directly linked to the identity cube representing the user, and
the second entitlement includes a first inheritance attribute, wherein the value of the first inheritance attribute is an identifier of the first management structure maintained by the source system to which the user is assigned by the source system and through which the user is granted the second entitlement to the second digital asset.
2. The identity management system of claim 1 , wherein evaluating the identity management data comprises determining a third entitlement for a third digital asset of the source system and the third digital asset is a child of the second digital asset, and
the data model includes a hierarchical link linking the third entitlement to the second entitlement and indicating the third digital asset is a child of the second digital asset.
3. The identity management system of claim 2 , wherein the third entitlement includes a second inheritance attribute, wherein the value of the second inheritance attribute is the identifier of the first management structure maintained by the source system to which the user is assigned by the source system and through which the user is granted the second entitlement to the second digital asset.
4. The identity management system of claim 3 , wherein the second digital asset is a folder and the third digital asset is a subfolder of the folder.
5. The identity management system of claim 4 , wherein the source system is an Active Directory system.
6. The identity management system of claim 5 , wherein the first management structure is a group.
7. A non-transitory computer readable medium, comprising instructions for:
obtaining identity management data from one or more source systems in a distributed enterprise computing environment, the identity management data comprising data on a set of identity management artifacts utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine a first entitlement for a first digital asset of the source system and a second entitlement for a second digital asset of the source system, wherein the first entitlement is directly assigned to a user and the second entitlement is indirectly assigned to a user through a first management structure maintained by the source system whereby the user is granted the second entitlement by virtue of the user's assignment to the first management structure by the source system; and
representing the user, the first entitlement for the first digital asset, and the second entitlement for the second digital asset in a data model, wherein the data model includes:
an identity cube representing the user, the first entitlement for the first digital asset, and the second entitlement for the second digital asset such that the first entitlement for the first digital asset and the second entitlement for the second digital asset are a single level removed from the identity cube representing the user, wherein
the first entitlement for the first digital asset is directly linked to the identity cube representing the user,
the second entitlement for the second digital asset is directly linked to the identity cube representing the user, and
the second entitlement includes a first inheritance attribute, wherein the value of the first inheritance attribute is an identifier of the first management structure maintained by the source system to which the user is assigned by the source system and through which the user is granted the second entitlement to the second digital asset.
8. The non-transitory computer readable medium of claim 7 , wherein evaluating the identity management data comprises determining a third entitlement for a third digital asset of the source system and the third digital asset is a child of the second digital asset, and
the data model includes a hierarchical link linking the third entitlement to the second entitlement and indicating the third digital asset is a child of the second digital asset.
9. The non-transitory computer readable medium of claim 8 , wherein the third entitlement includes a second inheritance attribute, wherein the value of the second inheritance attribute is the identifier of the first management structure maintained by the source system to which the user is assigned by the source system and through which the user is granted the second entitlement to the second digital asset.
10. The non-transitory computer readable medium of claim 9 , wherein the second digital asset is a folder and the third digital asset is a subfolder of the folder.
11. The non-transitory computer readable medium of claim 10 , wherein the source system is an Active Directory system.
12. The non-transitory computer readable medium of claim 11 , wherein the first management structure is a group.
13. A method for representing identity management data, comprising:
obtaining identity management data from one or more source systems in a distributed enterprise computing environment, the identity management data comprising data on a set of identity management artifacts utilized in identity management in the distributed enterprise computing environment;
evaluating the identity management data to determine a first entitlement for a first digital asset of the source system and a second entitlement for a second digital asset of the source system, wherein the first entitlement is directly assigned to a user and the second entitlement is indirectly assigned to a user through a first management structure maintained by the source system whereby the user is granted the second entitlement by virtue of the user's assignment to the first management structure by the source system; and
representing the user, the first entitlement for the first digital asset, and the second entitlement for the second digital asset in a data model, wherein the data model includes:
an identity cube representing the user, the first entitlement for the first digital asset, and the second entitlement for the second digital asset such that the first entitlement for the first digital asset and the second entitlement for the second digital asset are a single level removed from the identity cube representing the user, wherein,
the first entitlement for the first digital asset is directly linked to the identity cube representing the user,
the second entitlement for the second digital asset is directly linked to the identity cube representing the user, and
the second entitlement includes a first inheritance attribute, wherein the value of the first inheritance attribute is an identifier of the first management structure maintained by the source system to which the user is assigned by the source system and through which the user is granted the second entitlement to the second digital asset.
14. The method of claim 13 , wherein evaluating the identity management data comprises determining a third entitlement for a third digital asset of the source system and the third digital asset is a child of the second digital asset, and
the data model includes a hierarchical link linking the third entitlement to the second entitlement and indicating the third digital asset is a child of the second digital asset.
15. The method of claim 14 , wherein the third entitlement includes a second inheritance attribute, wherein the value of the second inheritance attribute is the identifier of the first management structure maintained by the source system to which the user is assigned by the source system and through which the user is granted the second entitlement to the second digital asset.
16. The method of claim 15 , wherein the second digital asset is a folder and the third digital asset is a subfolder of the folder.
17. The method of claim 16 , wherein the source system is an Active Directory system.
18. The method of claim 17 , wherein the first management structure is a group.