IGA Capabilities Summary
| Capability | Function | Description | Capability in midPoint 4.8 (current) | Capability in midPoint 5.0 (planned) | Eventual midPoint ambition | Average capability in industry* | Best capability in industry* |
|---|---|---|---|---|---|---|---|
| Identity Lifecycle Management | Identity lifecycle state model | Maintenance of identity state (candidate, active, archived), management of state transitions (on-boarding, off-boarding), handling user registration, profile maintenance and data erasure. | |||||
| Maintenance of identity attributes | Maintenance of identity model, schema and structure of identity attributes. | ||||||
| Identifier management | Assignment of identifiers to identities, validation of the identifiers, maintenance of uniqueness constraints. | ||||||
| Credential management | Management of passwords and other credentials, cryptographic keys, biometric information and so on. | ||||||
| Support for diverse identity types | Supporting both person and non-person identities, allowing several identity types with separate lifecycles and policies. | ||||||
| Organizational structure | Maintenance of information regarding organizational units and their structure. Managing assignment of identities in the organizational units. | ||||||
| Personas | Support for alternative identities of a person or other entity. Maintenance of relationship between personas representing the same entity. | ||||||
| Entitlement Management | Entitlement lifecycle management | Creation, modification and deletion of entitlements (such as groups). | |||||
| Maintenance of entitlement associations | Maintenance of relation between user accounts and entitlements, such as maintenance of group membership. Interpretation of association attributes (e.g. group membership attributes). | ||||||
| Fulfillment | Identity resource management | Maintenance of connection parameters and connector code for interaction with source/target systems. Inventory of identity resources and connectors, maintenance of state and schema. Identity schema discovery. | |||||
| Communication with remote systems | Execution of create/read/update/delete (CRUD) operations in remote systems (identity resources). Implementation of communication protocols, adaptation of protocol differences, data type conversion. Execution of additional operations (e.g. provisioning scripts). Simulation of capabilities that remote systems do not support. | ||||||
| Handling of fulfilment failures | Detection, interpretation and handling of communication and configuration errors, communication security violations and similar failures. Managing operation retries, delayed operations and similar corner cases. | ||||||
| Identity state tracking | Tracking identity attributes, e.g. caching the attributes in the database of IGA system. Tracking of identity status, including identities that do not exist in identity resources (e.g. accounts that were not created yet or deleted recently). | ||||||
| Management of manual fulfillment operations | Managing the process of manual fulfillment, initiating manual operations, tracking operation state, communication with ITSM systems. Handling operation feedback (e.g. in case of semi-manual fulfillment). | ||||||
| Synchronization | Data feed management | Management of (inbound) data feeds from source systems to IGA platform. Real-time or almost-real-time detection and processing of changes. Handling of multiple data sources, making sure that information is properly merged. | |||||
| Reconciliation | Comparing real state of things (in source/target systems) with the data and policies in IGA platform. Checks that fulfillment works (especially manual fulfilment), detection of account existence, attribute value checks, entitlement checks. Support for reconciliation of diverse identity types (users, applications, orgs, roles). | ||||||
| Data consistency management | Maintenance of data (eventual) consistency. Detection of discovered data inconsistencies, discovered by various methods (data feed, reconciliation, opportunistic discovery). Reaction to discovered inconsistencies, with an aim to correct them. | ||||||
| Identity correlation | Detection of data structures (accounts, entitlements) that represent the same identity. Execution of correlation rules or queries, probabilistic correlation and so on. | ||||||
| Orphan detection | Detection of accounts (and other data) without an owner or equivalent responsible entity. Reaction to such situations, usually leading to establishing an owner or deletion/disable of the account. | ||||||
| Policy and Role Management | Role-based policies | Policy definition based on roles, such as role-based access control (RBAC) mechanism. | |||||
| Role structure | Organization of roles for easier access and definition. Using mechanisms such as role hierarchies, role catalogs, policy-driven RBAC, and metaroles. | ||||||
| Role modeling and governance | Creation and efficient maintenance of role definitions. Management of role lifecycle, role ownership, role model versioning and curation, review and approval process. |
Roles are very powerful and dynamic, going far beyond traditional RBAC. Role definition wizards. Effect of role definition change can be simulated before it is applied. Role mining functionality.
While there are wizards for simple role definitions, definition of complex and policy-driven roles is still quite technical. Roles are maintained individually, no concept of role model.
|
|||||
| Segregation of Duties | Policy prohibiting dangerous combination of privileges. | ||||||
| Automatic role assignment | Automatic assignment and unassignment or roles, usually using a set of rules. | ||||||
| Deputy management | Ad-hoc delegation of rights from user to user, usually for a short period of time. | ||||||
| Access Request | Access request user interface | User interface for common users, allowing to compose a request, usually containing roles. User interface often follow electronic shopping (shopping cart) paradigm, organizing available roles in categories, user-friendly role search, request policy validation, and so on. Support for request state tracking after request submission. Requesting unassignment of roles. | |||||
| Management of approval schemes | Definition of approval schemes, definition of approval levels/stages, approver groups for each level/stage, optional approval levels/stages and so. Definition of schemes per role type or group, scheme variations for sensitive roles, risk-based approval schemes and so on. | ||||||
| Execution of approval processes | Execution of approval schemes: driving access request through approval levels/stages. Human interaction with approvers, presenting the request in human-friendly form to approvers. Handling of approver decisions (approve/deny), free-text communication (approver comments). Optional forwarding of requests to be processed by another person. | ||||||
| Maintenance of approval accountability record | Record of the access request and approval process for accountability (auditing) purposes. Recording the metadata (who has requested, who has approved, when and so on). | ||||||
| Immediate fulfillment of approved requests | Immediate creation of account, associating them with entitlements according to results of request and approval process. | ||||||
| Identity Workflow Automation | Remediation of policy violations | An action taken to remedy a policy violation, getting system back to the state of full policy compliance. The action follows up on a detection of policy violation. Remediation actions are often manual actions taken by a human user. | |||||
| Case management | Keeping a record of cases, specifying a problem that needs to be resolved, usually in an unstructured way. Cases are usually used to record policy violations, role definition problems, high-risk situation and so on. The case often assumes that there is no pre-defined algorithm or workflow pattern that could be used to resolve the problem. The solution is provided by the users, cooperating and communicating on the case. | ||||||
| Process management | Keeping track of _processes_, with an aim to resolve a specific problem in a structured way. The processes are usually based on human interaction (workflow). This approach assumes that there is a structured, pre-defined pattern of interaction of specific users that leads to problem resolution. | ||||||
| Escalation | Ability to re-assign a case or process step to a new assignee in case that the original assignee did not take action within a specified time. Escalation is often used to bring attention of managers and leaders to an issue that is not resolved within its usual time-frame. | ||||||
| Notifications | Ability to inform a user that a specific action has taken place. E-mail message informing user about new accounts or entitlements is perhaps the most common form. Yet the notifications may be implemented by a variety of ways. | ||||||
| Access Certification | Full certification campaign | Certification done on large scale. Certifying access of a large group of users, typically distributed among many certifiers. Campaigns are usually executed periodically, they have a limited time duration. | |||||
| Microcertification | Certification done on a very small scale. Typically certifying access of a single user, done by one or just a couple of certifiers. Microcertifications are usually triggered by identity lifecycle events (such as organizational change) or changes in risk landscape. | ||||||
| Certification of role definitions | Process to certify role definition, to make sure their definitions are still applicable. | ||||||
| Auditing | Recording audit trail | Recording identity-related operations and events. Recording business-level information in a structured data format. | |||||
| Basic audit trail access | User interface to access audit trail records, using simple queries and filtering. | ||||||
| Complex audit reporting | Advanced reporting, based on interpretation of audit records in context, correlating and computing values. Reports providing "time machine" functionality, computing values as they were in the past. Forensic reports and analytics. | ||||||
| Audit integration | Moving data to external systems, such as security information and event management (SIEM) systems, data warehouses, etc. Providing functions to export, pump or access audit record data by external systems. Documentation of data structures and formats. | ||||||
| Metadata maintenance | Setting and maintaining auditing-related metadata, such as dates of object creation and modification. Maintaining summarized and automatically-computed data. | ||||||
| Identity Analytics and Reporting | Customizable reports and visualizations | Reports, selecting and summarizing identity data. Customization of report structure and look. Structured machine-readable reports, aimed at post-processing. Dashboards, providing quick data overview. Visualization, presenting the data in interactive, human-friendly form. | |||||
| Risk assessment | Definition, maintenance and automatic evaluation of risk model based on identity data. Evaluation of overall risk levels, per-user risk levels, and risk-based analytics. | ||||||
| Risk-based triggers | Triggering events based on risk analysis, such as initiating remediation actions, microcertifications and notifications. Using risk information in processes, such as approval processes. | ||||||
| Anomaly detection | Detection of data that stand out from their surrounding (_outlier detection_), such as users that have different privileges than their colleagues. Detection of suspicious combination of privileges, such as detection of over-privileged users. | ||||||
| Compliance management | Organization of policies that represent compliance frameworks, evaluation of compliance levels, identification compliance violations. Monitoring progress of compliance (addressing policy violations). Partial enforcement of policies (enforcement modes), allowing gradual introduction of new policies. Evaluation and reporting of policy compliance. Initiating remediation of policy violations. | ||||||
| Simulation | Simple preview of an effect of change (number of changed objects). Large-scale simulations, estimating results of many changes on many objects (such as role model changes, re-organizations). Thresholds, stopping operation if number of changes is unusually high. Interactive "what if" analysis. | ||||||
| Role mining | Suggesting role definitions by analyzing similarities in attributes and entitlements. |
* Most IGA platforms in the industry are closed-source software. Almost all the platforms are jealously guarded. It is almost impossible to get unlimited access to evaluation versions, documentation, or even a demo of the platform. Most of the information published by the vendors is marketing in nature. There is very limited amount of available technical documentation. This makes it very difficult to make any reliable evaluation of vast majority of IGA platforms, even for experienced IGA experts. Therefore, please take the evaluation for what it really is: not much more than a wild guess.
Was this page helpful?
YES
NO
Thanks for your feedback