Questions:
-
What is my access ?
-
Do I have access to the application A ? Why ?
-
I need access to the application A ? What roles should I request ?
IGA Use Cases
| This page is a stub, it is a work in progress. |
Business use cases and "user stories" for Identity Governance and Administration. The purpose of this document is to guide design activities by providing a list all the practical use cases for inspiration. We do not claim that our implementation will support all of those use cases.
This list is not complete. It is expected that it will be continually updated.
Actors
IGA information is consumed by different actors. Starting with end-users, through technical engineers and finishing by business and security managers.
The IGA information must be available to all of them in the form they need.
1. End-user
Typical interaction of end user is self-service - end user needs to request new access, modify his profile and review the access he has already.
End-user needs the access to be described in business form.
Information provided
-
Individual information of my access (roles and applications assigned to me)
-
View of user’s profile and its modification (optional).
-
Credential management
-
Possibility to add new access (request a role) and remo
He needs to see individual objects. No specific dashboards or reports are needed for the end-user.
Only global view should be the role catalog.
Form of information: business level (roles and applications)
1.1. Use cases: End-user
TODO
2. Business Manager
Business manager is any person in an organization being responsible for / or technically managing the access of their team. Additionally, to end user, the business manager need also to anser
Form of information: business level (roles and applications)
TODO
2.1. Use cases: Business Manager
TODO
3. Application engineer
Aplikacny inzineir potrebuje
3.1. Use cases: Application engineer
TODO
4. IGA Administrator
TODO
4.1. Use cases: IGA Administrator
TODO
5. Role Manager
TODO
6. Use cases: Role Manager
TODO
7. Security officer
TODO
8. Use cases: Security officer
9. OLD TEXT
Old text below.
10. Access request use cases
This chapter describes use cases pre assignment management by end users using self-service UI.
It does not cover assignment management performed by IDM administrators in administration interface - these operations are performed instantly and does not generate access request and approvals.
Request new access
-
End user requests new access for himself
-
End user requests new access for somebody else
Modify existing access
-
End user needs to update parameters of the access for himself
-
End user needs to update parameters of the access for somebody else
Remove access
-
End user wants to remove access for himself
-
End user want to request access removal for somebody else
Other use cases
-
Approver needs to approve/reject one request
-
Approver needs to approve/reject multiple requests at once
-
End user wants to see request approval and processing history.
-
Requestor wants to know why the request is not processed yet
| <Use case name> | |
|---|---|
Actor: <Requestor> |
Described in <xref::TODO> |
Motivation and details: |
|
Reports
Reports are described in Access request process monitoring.
11. Automatic role assignment use cases (policies)
TODO
12. Role engineering use cases
New role
-
creation of an application role
-
creation of a business role
-
deployment of a new application and creation of new roles for it
Role modification
-
modification of business parameters of the role
-
modification of provisioning parameters of the role (role recompute required)
-
modification of lis of roles assigned in the business role
Role decommissioning
-
decommissioning of a role
-
decommissioning of an application
13. Access certification use cases
Process management by end user
TODO