System and method for artifact management and representation in identity management systems and uses of same, including representation of effective access and application of identity management policies
Systems and methods for embodiments of identity management systems and data models used by identity management systems are disclosed. Embodiments of the identity management systems and associated data models as disclosed herein may associate identities with their respective entitlements, while preserving the hierarchy imposed by the source system from which those identities or entitlement were derived, including the hierarchical structure that resulted in the (direct or effective) assignment of such an entitlement, along with the hierarchical nature of the digital assets to which those entitlements pertain. Using embodiments of the disclosed data model embodiments of identity management systems may implement tasks, processes or policies that take advantage of the ability to easily navigate between an identity and its respective entitlements, the management structures that resulted in the entitlement being assigned or the hierarchical relationships between the digital assets corresponding to those entitlements.
1. An identity management system, comprising:
a processor;
a non-transitory computer-readable storage medium, including computer instructions for:
obtaining a separation of duties policy; and
evaluating the separation of duties policy against a particular user using an identity management data structure at the identity management system, the identity management data structure representing the particular user, a first entitlement for a first digital asset within a distributed enterprise computing environment, and a second digital asset within the distributed enterprise computing environment, wherein the first entitlement is directly assigned to the particular user and the second entitlement is indirectly assigned to the particular user through a first management structure maintained by a source system whereby the particular user is granted the second entitlement by virtue of the particular user's assignment to the first management structure by the source system,
wherein:
the identity management data structure represents the particular user, the first entitlement, and the second entitlement such that the first entitlement for the first digital asset and the second entitlement for the second digital asset are a single level removed from the identity management data structure representing the particular user,
the first entitlement for the first digital asset is directly linked to the identity management data structure representing the particular user, wherein the first entitlement for the first digital asset is assigned to the particular user,
the second entitlement for the second digital asset is directly linked to the identity management data structure representing the particular user, wherein the second entitlement for the second digital asset is assigned to the particular user, and
the second entitlement includes a first inheritance attribute, wherein the value of the first inheritance attribute is an identifier of the first management structure maintained by the source system to which the particular user is assigned by the source system and through which the particular user is granted the second entitlement to the second digital asset.
2. The identity management system of claim 1 , wherein the instructions are further for allowing or denying the particular user a third digital asset identified in the separation of duties policy based on the evaluation of the separation of duties policy.
3. The identity management system of claim 2 , wherein the third digital asset is the first digital asset or the second digital asset.
4. The identity management system of claim 2 , wherein the third digital asset is a third entitlement.
5. The identity management system of claim 1 , wherein the evaluation of the separation of duties policy comprises applying the separation of duties policy to the representation of the first entitlement in the identity management data structure and the representation of the second entitlement in the identity management data structure.
6. The identity management system of claim 1 , wherein the identity management data structure includes a hierarchical link linking a third entitlement for a third digital asset to the second entitlement and indicating the third digital asset is a child of the second digital asset.
7. The identity management system of claim 6 , wherein the third entitlement includes a second inheritance attribute, wherein the value of the second inheritance attribute is the identifier of the first management structure maintained by the source system to which the particular user is assigned by the source system and through which the particular user is granted the second entitlement to the second digital asset.
8. A non-transitory computer-readable storage medium, including computer instructions for:
obtaining a separation of duties policy; and
evaluating the separation of duties policy against a particular user using an identity management data structure at the identity management system, the identity management data structure representing the particular user, a first entitlement for a first digital asset within a distributed enterprise computing environment, and a second digital asset within the distributed enterprise computing environment, wherein the first entitlement is directly assigned to the particular user and the second entitlement is indirectly assigned to the particular user through a first management structure maintained by a source system whereby the particular user is granted the second entitlement by virtue of the particular user's assignment to the first management structure by the source system,
wherein:
the identity management data structure represents the particular user, the first entitlement, and the second entitlement such that the first entitlement for the first digital asset and the second entitlement for the second digital asset are a single level removed from the identity management data structure representing the user,
the first entitlement for the first digital asset is directly linked to the identity management data structure representing the particular user, wherein the first entitlement for the first digital asset is assigned to the particular user,
the second entitlement for the second digital asset is directly linked to the identity management data structure representing the particular user, wherein the second entitlement for the second digital asset is assigned to the particular user, and
the second entitlement includes a first inheritance attribute, wherein the value of the first inheritance attribute is an identifier of the first management structure maintained by the source system to which the particular user is assigned by the source system and through which the particular user is granted the second entitlement to the second digital asset.
9. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions are further for allowing or denying the particular user a third digital asset identified in the separation of duties policy based on the evaluation of the separation of duties policy.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the third digital asset is the first digital asset or the second digital asset.
11. The non-transitory computer-readable storage medium of claim 9 , wherein the third digital asset is a third entitlement.
12. The non-transitory computer-readable storage medium of claim 8 , wherein the evaluation of the separation of duties policy comprises applying the separation of duties policy to the representation of the first entitlement in the identity management data structure and the representation of the second entitlement in the identity management data structure.
13. The non-transitory computer-readable storage medium of claim 8 , wherein the identity management data structure includes a hierarchical link linking a third entitlement for a third digital asset to the second entitlement and indicating the third digital asset is a child of the second digital asset.
14. The non-transitory computer-readable storage medium of claim 8 , wherein the third entitlement includes a second inheritance attribute, wherein the value of the second inheritance attribute is the identifier of the first management structure maintained by the source system to which the particular user is assigned by the source system and through which the particular user is granted the second entitlement to the second digital asset.
15. A method, comprising:
obtaining a separation of duties policy; and
evaluating the separation of duties policy against a particular user using an identity management data structure at the identity management system, the identity management data structure representing the particular user, a first entitlement for a first digital asset within a distributed enterprise computing environment, and a second digital asset within the distributed enterprise computing environment, wherein the first entitlement is directly assigned to the particular user and the second entitlement is indirectly assigned to the particular user through a first management structure maintained by a source system whereby the particular user is granted the second entitlement by virtue of the particular user's assignment to the first management structure by the source system,
wherein:
the identity management data structure represents the particular user, the first entitlement, and the second entitlement such that the first entitlement for the first digital asset and the second entitlement for the second digital asset are a single level removed from the identity management data structure representing the particular user,
the first entitlement for the first digital asset is directly linked to the identity management data structure representing the particular user, wherein the first entitlement for the first digital asset is assigned to the particular user,
the second entitlement for the second digital asset is directly linked to the identity management data structure representing the particular user, wherein the second entitlement for the second digital asset is assigned to the particular user, and
the second entitlement includes a first inheritance attribute, wherein the value of the first inheritance attribute is an identifier of the first management structure maintained by the source system to which the particular user is assigned by the source system and through which the particular user is granted the second entitlement to the second digital asset.
16. The method of claim 15 , further comprising allowing or denying the particular user a third digital asset identified in the separation of duties policy based on the evaluation of the separation of duties policy.
17. The method of claim 16 , wherein the third digital asset is the first digital asset or the second digital asset.
18. The method of claim 16 , wherein the third digital asset is a third entitlement.
19. The method of claim 15 , wherein the evaluation of the separation of duties policy comprises applying the separation of duties policy to the representation of the first entitlement in the identity management data structure and the representation of the second entitlement in the identity management data structure.
20. The method of claim 15 , wherein the identity management data structure includes a hierarchical link linking a third entitlement for a third digital asset to the second entitlement and indicating the third digital asset is a child of the second digital asset.
21. The method of claim 15 , wherein the third entitlement includes a second inheritance attribute, wherein the value of the second inheritance attribute is the identifier of the first management structure maintained by the source system to which the particular user is assigned by the source system and through which the particular user is granted the second entitlement to the second digital asset.