Chapter 24 — Identity and access management: methods I | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Identity and access management: methods I

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Joiner, mover, leaver"]
  N2["24.2 Provisioning connectors"]
  N3["24.3 Service desk verification"]
  N4["24.4 Exceptions"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Joiner, mover, leaver"]
  N2["24.2 Provisioning connectors"]
  N3["24.3 Service desk verification"]
  N4["24.4 Exceptions"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Joiner, mover, leaver]
    |
    v
[24.2 Provisioning connectors]
    |
    v
[24.3 Service desk verification]
    |
    v
[24.4 Exceptions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) design joiner, mover and leaver processes; (2) design provisioning connectors; (3) plan secure service desk verification.

24.1 Joiner, mover, leaver

The lifecycle starts in HR. When HR records a new starter, a feed creates the identity, assigns roles from the job and sends provisioning requests to connected applications. When HR records a job change, the mover process adds the new role's access and schedules removal of the old after a short overlap. When HR records a leaver, every account is disabled at the end date and deleted after a retention period. Sana designs each flow with its triggers, steps, owners and timings, so nothing depends on someone remembering to send an email.

24.2 Provisioning connectors

Connectors carry lifecycle changes from the identity system to applications. Modern cloud services often support the SCIM protocol, defined in RFC 7644, which offers a standard way to create, update and disable users. Older applications need custom connectors or scripted exports and imports. Sana classifies each application by connector type and designs error handling: every failed operation is logged, retried and, if still failing, raised to the identity team. A connector that fails silently would undo the whole leaver requirement, so failures must always be visible.

24.3 Service desk verification

The service desk is a frequent attack target, because a caller who convinces an agent can get a reset or new authenticator. Sana designs a verification procedure: callers are verified through a method not controlled by the caller, such as a call-back to a number in HR records or a video check against the staff photo, and resets for administrators require a second agent's approval. NIST SP 800-63B-4 treats recovery as part of authenticator management. Agents are trained, and every reset is logged for review.

24.4 Exceptions

Some access does not fit roles: a project member who needs a system for three months, or a contractor supporting one application. Sana designs an exception process: the request names the entitlement, the reason, the approver and an expiry date. Exceptions are visible on the identity, reviewed in access reviews and removed automatically when they expire, with a reminder sent to the approver beforehand. Without expiry dates, exceptions become permanent and gradually recreate the excess access the role model was meant to remove.

Worked example

Sana's lifecycle design has three HR-triggered flows, classifies 140 applications into SCIM, directory-synced, custom and manual connectors, and defines call-back or video verification for desk resets.

Synthetic case. Flows, classifications and procedures are synthetic.

Errors and limits

A connector that fails silently undoes the leaver requirement without anyone noticing.

Exercises

EX070 — SCIM role. What does SCIM (RFC 7644) provide? Rubric: 3 = standard way to create, update and disable users;; 2 = provisioning standard;; 1 = sign-in;; 0 = none.
EX071 — Desk verification method. Name one caller verification method Sana designs. Rubric: 3 = call-back to HR number or video check against photo;; 2 = call-back;; 1 = security question;; 0 = none.
EX072 — Exception expiry. What happens when an exception reaches its expiry date? Rubric: 3 = removed automatically after approver reminder;; 2 = removed;; 1 = kept;; 0 = none.

Synthesis

HR-triggered lifecycle flows, visible connector errors, verified desk procedures and expiring exceptions make access follow employment.

Continue studying — chapter 24 of 50

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →