Hello team,
New version 7.1 is supposed to have implemented new feature - AD Containers (not sure about the naming). Instead of creating AD based applications and separate account data collectors, AD groups will only be assigned to containers. We’re considering using this option, but I was not able to find any additional information related to this topic.
Can you please direct me where I can find some documentation regarding this?
Thank you,
Martin
I am not sure of such feature in 7.1
We have always implemented a design of using a single directory to collect all AD accounts and groups and then have multi-app collectors to collect these groups into individual application (AD based).
The key here is to have an attribute that contains the group to application mapping or a manual mapping of group to application.
With this there is no more having multiple AD ADCs with difficult to manage query filters.
I inherited the IGL system from a former colleague. We're currently operating on version 6.9, but are in the process of standing up new v7.1 environments (not doing an in-place upgrade). In v6.9 we have separate AD ADCs for every application (as was referred to in Pradeep's post), but received feedback from RSA that this wasn't the best approach, so we're trying to transition to a multi-app entitlement collector model instead. We followed the documents created by Jamie Pryor and posted in the "Application Onboarding Recommended Practices" page to get the custom 'Group' attribute (called "Application Name") created and are associating applications with groups. This is all working fine and we can run the multi-app collector successfully. What I'm struggling with is how to properly configure the Review Definition for both a 'User Review' and an 'Account Access and Ownership' review (we create both for every Application) to pull the data collected in the multi-app collector when generating these reviews. We use the 'Account Access and Ownership' review for non-human (system and service) accounts that are members of the AD groups associated with the application. Can anyone provide some direction or point me to a document that describes this clearly? More specifically, I'm focusing on the "Contents" tab for both types of reviews and the "Account Selection" tab of the 'Account Access and Ownership' review.
Steve,
We had the same issue the proposed solution with a custom field works sort off. But it results in ownership issues. For reviews we solved that with including the custom field in the contend filters of the review.
For NPA account we have a query that select all account that are member of a group with a label that is referring to an application that we labeld with the classification ISAE.
(accounts.id in groups (groups."Application Name - Groups" in (SELECT Name FROM avuser.T_APPLICATIONS T WHERE T.Classification LIKE '%ISAE%')))
For User access reviews we do something similar
groups.id in apps (apps.Classification like '%LAC%')
or groups."Application Name - Groups" in (SELECT Name FROM avuser.T_APPLICATIONS
WHERE CLASSIFICATION like '%LAC%')
This kind of works for the reviews but we keep having issue with approval workflow where we want the groups to be approved by the owner of the application instead of the owner not the directory.
That is why we are moving away from it. in favor of the use of multiapp collectors. the unfortunately multiapp collectors come with it’s own problems and limitations.
Our current conclusion is that both the multiapp collector and the custom groups don’t bring you what you need and are not well thought out. We are in the process of writing enhancement ideas for the multiapp collector.
Hi Pradeep,
It might be 7.1.1 release having this feature. One of RSA members presented this to us but I can't find any documentation for that. Collected AD groups should contain one additional attribute that will assign them to a container, so we don't have to use additional collectors.
Hey,
the documention on this approach as mentioned above, can be found here:
Hey,
the documention on this approach as mentioned above, can be found here:
RSA Identity Governance & Lifecycle Recommended Practices