Majority, if not all customers of RSA Governance & Lifecycle use Active Directory (AD) as a way of managing who can access certain applications and what actions they can perform within the application.
Early phases of an RSA IGL project focus on visibility, and this typically includes the collection of all accounts, groups and group memberships from a primary AD domain. Although this data provides great insight in to the AD environment, it doesn’t quickly and clearly identify which AD managed applications users have access to.
This normally results in customers requesting a solution for on-boardng AD managed applications in to RSA IGL that must be:
- Easy to implement
- Uses out of the box functionality
- Easy and repeatable to on-board applications
- Does not duplicate data
- Works with all areas of IGL
- Visibility of access
- Reviews
- Access request
- AFX
The following document, created by RSA Professional Services, provides details on the out of the box components used to separate the AD managed applications so that they are displayed as individual applications, instead of AD groups within a directory. Once separated, these applications are clearly displayed against the user, within User Access Reviews and also Access Request where changes can be automatically fulfilled re-using existing connectors.
Active Directory (AD) Managed Applications
Although this solution covers the use of Access Request and AFX, it can be still be used without these to enhance visibility around the users access and during user access reviews.
