Hello team,
New version 7.1 is supposed to have implemented new feature - AD Containers (not sure about the naming). Instead of creating AD based applications and separate account data collectors, AD groups will only be assigned to containers. We’re considering using this option, but I was not able to find any additional information related to this topic.
Can you please direct me where I can find some documentation regarding this?
Thank you,
Martin
I am not sure of such feature in 7.1
We have always implemented a design of using a single directory to collect all AD accounts and groups and then have multi-app collectors to collect these groups into individual application (AD based).
The key here is to have an attribute that contains the group to application mapping or a manual mapping of group to application.
With this there is no more having multiple AD ADCs with difficult to manage query filters.
I inherited the IGL system from a former colleague. We're currently operating on version 6.9, but are in the process of standing up new v7.1 environments (not doing an in-place upgrade). In v6.9 we have separate AD ADCs for every application (as was referred to in Pradeep's post), but received feedback from RSA that this wasn't the best approach, so we're trying to transition to a multi-app entitlement collector model instead. We followed the documents created by Jamie Pryor and posted in the "Application Onboarding Recommended Practices" page to get the custom 'Group' attribute (called "Application Name") created and are associating applications with groups. This is all working fine and we can run the multi-app collector successfully. What I'm struggling with is how to properly configure the Review Definition for both a 'User Review' and an 'Account Access and Ownership' review (we create both for every Application) to pull the data collected in the multi-app collector when generating these reviews. We use the 'Account Access and Ownership' review for non-human (system and service) accounts that are members of the AD groups associated with the application. Can anyone provide some direction or point me to a document that describes this clearly? More specifically, I'm focusing on the "Contents" tab for both types of reviews and the "Account Selection" tab of the 'Account Access and Ownership' review.
Hi Pradeep,
It might be 7.1.1 release having this feature. One of RSA members presented this to us but I can't find any documentation for that. Collected AD groups should contain one additional attribute that will assign them to a container, so we don't have to use additional collectors.
Hey,
the documention on this approach as mentioned above, can be found here:
Hey,
the documention on this approach as mentioned above, can be found here:
RSA Identity Governance & Lifecycle Recommended Practices