IGA reporting user-stories

Last modified 13 Feb 2023 13:44 +01:00
Table of Contents

The page is designed to be continually enhanced by new user stories.

1. IGA - big picture over roles

1.1. EPIC: See role model/role hierarchy statistics

EPIC

AS A Role manager or an IDM administrator I WANT TO see role model/role hierarchy statistics SO THAT I can see the big picture of size of the environment of roles and assignment rules and its modification dynamics.

1.1.1. Snapshot statistics

User story

AS a Role manager
I WANT TO see snapshot statistics for objects building role model
SO THAT I can understand the size and complexity of environment.

Acceptance criteria

GIVEN Configured Dashboard (with asynchronous widgets) OR report providing "snapshot statistics"
WHEN the Role manager opens the dashboard or the report,
THEN he can see information that can provide him overview, such as:

  • counts of roles, orgs, services - all split by archetype

  • counts of direct assignments of roles and services (by each archetype)

  • counts of autoassignment roles and orgs

Notes

This story can probably be implemented by configuration. Counting of assignment mappings in object templates may be more complex.

TODO: TEST, how the counting can be defined.

1.1.2. Update statistics

User story

AS a Role manager or IDM administrator
I WANT TO see update statistics of objects building role model for previous week or month
SO THAT I can understand what happened in the environment and whether things work as usual.

Acceptance criteria

GIVEN Configured Dashboard (with asynchronous widgets) OR report providing "update statistics" from audit data
WHEN the Role manager opens the dashboard or runs the report
THEN he can see such information that can provide him overview of what happened in previous time interval, such as:

  • counts of created, modified and deleted (deactivated) roles, orgs, services - all split by archetype

  • counts of new assignments / unassignments

  • counts of assignment rules modifications

  • counts of unsuccessful operations related to roles, orgs, services from previous week or month

Notes

The time interval could be defined as last day, last working day, last week…​ Should be done by audit reports.

1.1.3. Update history

User story

AS a Role manager or IDM administrator
I WANT TO be able to compare the update statistics for multiple (or series of) weeks or months
SO THAT I can identify and assess trends in data and environment

Acceptance criteria

There are 2 alternative solutions:

  1. GIVEN configured report providing update statistics AND results from its previous runs
    WHEN Role manager or IDM administrator imports the results to external tool and compare values from different time intervals (different runs of the report)
    THEN he can see trends in the modifications of role model and identify some exceptions or issues. This way he can answer question of what is happening in the environment and what are the trends.

  2. GIVEN configured report providing update statistics for multiple time intervals
    WHEN Role manager or IDM administrator open results of the report
    THEN he can see trends in the modification of role model and identify some exceptions or issues. This way he can answer question of what is happening in the environment and what are the trends.

Notes

1st solution requires analysis and comparison of multiple reports outside midPoint, but should be available already.

2nd solution requires unnecessary computation of historical data each run. Inefficient, but doesn’t require storing of data in external analytical tool.

1.2. EPIC: Understanding the role model

EPIC

AS a Role manager or IDM administrator I WANT TO understand the role model SO THAT I can understand the structure of roles and manage it better and easier.

1.2.1. Which roles create which objects on which resources

User story

AS a Role manager or IDM administrator
I WANT TO see which roles create which objects on which resources. And what types of objects. Both directly or indirectly.
SO THAT I can identify :

  • which roles are affecting which resources.

  • which resources are affected by assignment of specific high level (business) role to user

  • which roles are creating/modifying specific objects on specific resource

Acceptance criteria

GIVEN report with displaying induced roles and assigned metaroles and resources and constructions of objects on these elements WHEN the Role manager defines the level or set of roles, runs the report and imports the report result into analytical tool THEN he can:

  • see for each role all resources where the role (and roles induced in it) create or update objects

  • identify role and see all inducement chains ending with resource explaining all objects that the role is creating.

  • select specific resource and identify each inducement chain - to top level role of the report

Notes

MP should be able to provide such report.

1.2.2. Which objects on resources are modified by the role (top-down)

User story

AS an IDM administrator
I WANT TO know which objects are modified on which resources by assignment of specific role. (top-down)
SO THAT I can identify what everything will be affected when the role is assigned / unassinged to/from users.

Acceptance criteria

GIVEN role configured in midPoint. Role may contain application roles (and metaroles) on multiple levels.
WHEN IDM administrator opens the role in UI and switch to displaying all direct and indirect inducements.
THEN he can filter the results to resources and see all resources and objects that are created on these resources.

NOTES

  • Metaroles are assigned, not induced - so the metaroles should be somehow included in the tab, or displayed somehow else.

  • The question is valid to application and also to business role.

  • The story may be limited just to resource. Without specifying specific object.

1.2.3. Which roles modifies this object on resource (bottom-up)

User story

AS a Role manager or an IDM administrator
I WANT TO know which roles are modifying specific object on specific resource. (bottom-up)
SO THAT I can help users to identify what roles are needed for specific operations, OR I can decommision related roles when the object on the resource is being deleted.

Such information is needed for role manager for understanding the role model, but also for IDM administrator when configuring objects on some resource, or identifying what roles are needed for specific operations. E.g responding for an user request "I want to be assigned in the group XY in system Z - which role should I request ?"

Acceptance criteria

GIVEN roles and resources configured in midpoint UI
WHEN he performs specific AXIOM search or chooses an option in UI THEN midpoint can perform one-level or recursive search for all roles that relates to this specific object.

NOTES

  • One level (non-recursive) search may be enough for beginning.

  • The story may be limited just to resource. Without specifying specific object.

1.2.4. Which business roles relate to manual resources

User story

AS a Role manager
I WANT TO see which business roles relate to manual resources (their assignment generates manual operation)
SO THAT I can optimize processing of their assignment.

Acceptance criteria

GIVEN functionality implemented for story Which roles modifies this object on resource (bottom-up)
WHEN Role manager performs the request
THEN he can optimize the processes of their assignments by different operations, e.g.:

  • by requesting automation of identified application roles, or

  • by removing the manually assigned application roles from business roles, so that business roles can be assigned faster

1.2.5. Which roles provide access to which applications

User story

AS a Role manager
I WANT TO see which roles provide access to which applications or application components
SO THAT I can identify where the users will obtain access by different application or business roles.

Acceptance criteria

GIVEN report providing information of all induced application or application components
WHEN Role manager specify parameters and run such report and
THEN Role manager can identify set of roles providing access to specific set of applications. Directly in the report or using some analytical tool - if the filter was not defined in the report.

1.2.6. Where does this role provide access to (top-down)

User story

AS a Role manager, an IDM administrator or End user
I WANT TO see where does the specific role provide access to
SO THAT I can identify where the user will obtain access when he is assigned by this role.

Acceptance criteria

GIVEN roles and applications configures in midPoint
WHEN Role manager, IDM administrator or END user opens the specific role
THEN he can see directly in UI to which application(s) and/or application component(s) the role provides access to. (See induces services of specific archetypes)

NOTE

  • The information should be provided in business terminology to the End user. E.g. as access.

1.2.7. Which roles provide access to this application (bottom-up)

User story

AS an IDM Administrator or a Role manager
I WANT TO see which roles provide access to this application
SO THAT I can identify where the users will obtain access when he is the role is assigned.

Acceptance criteria

GIVEN report providing information of all induced application or application components
WHEN Role manager specify parameters and run such report and
THEN Role manager can identify set of roles providing access to specific set of applications. Directly in the report or using some analytical tool - if the filter was not defined in the report.

1.2.8. End user: Where does this role provide access to

User Story

AS a Business user
I WANT TO know where everywhere the specific role provides access
SO THAT I can assess whether this role helps me o get access I need.

Acceptance criteria

TODO: UI - in the role page.

1.2.9. End user: Which roles provide access to this application ?

User Story

AS a Business user
I WANT TO see the roles that provide access to the application
SO THAT I can choose from the list the role that can provide me the access I need.

Acceptance criteria

GIVEN WHEN THEN TODO

1.2.10. XXXX

User Story

AS a Role manager
I WANT TO know which roles providing access to which applications
SO THAT I can manage the structure of the roles.

Acceptance criteria

GIVEN WHEN THEN TODO

1.2.11. XXXX

User Story

AS a Role manager
I WANT TO know what are the rules for automatic assignment of the roles. By the rules I mean:

  • autoassignment rules

  • roles induced in ORGs

  • roles assigned automatically by mappings in object templates SO THAT I can identify which roles are assigned automatically to whom and when.

Acceptance criteria

GIVEN WHEN THEN TODO

1.2.12. XXXX

TODO

I WANT TO see "map of the environment" → structure of roles - which roles are assigned to which business roles - where do the application roles provide access to (to which applications and application components) - what objects on which resources are created/managed by assignment of these roles - how many roles are assigned to

SO THAT I can: - compare business roles - tell which roles "do nothing" (what does this mean?)

Acceptance criteria

GIVEN WHEN THEN TODO

1.3. EPIC

EPIC AS a Role manager I want to see how counts of requests, approvals and approval speed and exceptions SO THAT I can manage and optimize processes to be faster, more automated and easier.

1.4. EPIC

EPIC AS a Role manager I want to clean up the roles - remove roles that do nothing, identify roles not used - and identify what to do with them or identify roles without owner or with wrong owner.

1.5. EPIC

EPIC AS a Security manager
I WANT TO see TODO
SO THAT I can manage risk

  • which roles are assigned by these rules ?

  • I want to see the map of the environment

  • Role hierarchy report - full picture / partial picture § the report allows data analysis (provide answers to questions above)

  • Ideally: visual structure of the tree (from report ?)

1.5.1. Which roles do nothing

AS a Role manager or IDM administrator
I WANT TO see which roles do nothing SO THAT I can remove the roles that does not provision any relevant accounts or entitlements.

During historical configurations and reconfigurations some business roles may lost content and have zero or just one application role.

TODO: What does this mean exactly ?

1.6. EPIC

TODO → chcem mat lepsiu citatelnost auditu / user history /history of operations

1.6.1. XXX

As an <admin. audit user> I WANT TO see in audit view business summary of each audit record SO THAT I can easily identify which record means what.

Was this page helpful?
YES NO
Thanks for your feedback