Has anyone configured IGL to auto-provision file shares collected through Stealthbits Data Resource Collector? The file shares map to AD groups and we have an AFX connector to the AD already configured. Just wondering how IGL behaves out-of-the-box when an access request is set up to request the file shares?
It would also be interesting to understand how does IGL provision access if there isn't any one-to-one mapping between a file share and an AD group.
As far as I know, the StealthBits integration we have does not include provisioning (and personally I'm not sure if StealthBits does any sort of provisioning or not).
Regardless of what type of mapping you have, IGL will behave according to how the request looks like. If the request is trying to add the Data Resource to the user, then it will call the fulfilment workflow mapped to the Data Resource Set (whether that is using AFX or Manual Fulfilment). IGL will only add the user to a group if the request itself is trying to add the user to the group.
In cases where access to data resources is regulated through groups (which I guess is the recommended practice), then you to make sure no one requests a resource directly but instead requests the group which grants access to that resource. You can use multiple tricks to do that:
I've been thinking about this on a theoretical level and only have a concept of a solution, but it may help you.
If you consider directories as resources and read/write/execute as actions you can use an EDC instead of DAG. This would allow you to use "Add/Remove entitlement to user/group" which you could setup in an SSH-connector that connects to a windows server. This, in turn, allows you to use your regular requests workflow to grant/revoke access to directories.
For now, this is only a concept I've been thinking of and do not know how it would interact with Stealthbits.
You can use the out of the box functions to call approval workflow, the problem is around giving access via group membership.
From the help document in the tool this seems like the expectation however the only way I can find to get the group with access to the file share is using T_AV_EXPLODEDUSERENTITLEMENTS.
In addition when mapping the Resource Action when using the database Collectors you can’t see the Actions in the UI without making a change request and after running collections Who has Access will have a massive table with every Account, Group and User without any segregation at all.
Thought I would make some recommendations instead of just leaving it.
I am sorry that no one replied to your post. I don't know enough about this feature to advise you. It sounds like you are already on the right track by provisioning access through AD Groups but I don't understand all the implications.