With IAM projects you need great site knowledge and you need great product knowledge. As the consultant I bring the product knowledge, but I’m completely dependent on the customer to supply the site knowledge. This doesn’t always go as easily as it sounds. The customer’s assumptions and misunderstandings about FIM may lead them to leaving out (or not bothering to find out) vital information. And without information, I can’t design an appropriate solution.
Here are some of the things that need to be well understood:
What are the official policies for dealing with all aspects of user account lifecycle?
These should include written policies for:
- Exactly who gets an account in the target system?
- How are access permissions and application roles assigned?
- What can/can’t be changed on existing accounts?
- When should access be revoked?
- How is deprovisioning handled?
Where is the data coming from?
FIM is data-driven. While it can manipulate data it can’t conjure it out of thin air – it has to come from somewhere. So we need to understand:
- What is the authoritative source for each individual object type and each individual attribute to be managed in the target system?
- Is the source data in a format we can use?
- Does the source data link to identities in a way we can import? Eg., a list of locations is all very well, but I need to know who is at each location. And I have to be able to join on the who.
This is a difficult question to answer. FIM works best with a fully identified and fully joined connector space, where its rules are allowed to apply equally to new and pre-existing identities. Joining and clean-up of identity data has to be done.
While the only way you can really work out how long it will take to do the joins is to do the joins, I do offer this general rule of thumb:
- Up to 80% of accounts will join pretty easily,
- Another 10-15% will join on weaker rules with a manual verification,
- the last 5-10% will be very difficult and various people will have to be involved.
Depending on the number of identities you have to deal with this can be anything from a couple of days to a couple of months work!
Got something to add? Disagree? Comments are open!