Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What products do you use to manage identity propagation in your environment?

For example, Joe gets hired at the company. HR inputs Joe's profile in the HR employee management application. A ticket is passed to IT to manually create Joe's Active Directory account, add a bunch of user groups for his job role. They will also manually create Joe's accounts in other disparate systems that don't authenticate with Active Directory. By the time Joe gets all his access, he's already wasted a week on company time twiddling his thumbs and surfing the webs.

Then one day, they found pr0n on Joe's PC, dated back to his first week on the job, and so they showed him the door. Now, all the same people have to repeat the work to undo Joe's access in all the systems he had access to.

The same process also repeats if someone changes job roles, such as to another department.

What I'm looking for is a tool designed for sysadmins to manage user accounts such that changes like these can be fully automated once they're changed in the master database (HR application, in this example).

I'm aware of Microsoft's ILM 2007, and its predecessor MIIS. I find these products poorly documented, entirely too difficult to manage, and I've found almost no support online.

What products might meet this criteria?

share

locked by HopelessN00b Dec 5 at 5:11

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as not constructive by voretaq7 Aug 25 '12 at 4:26

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers 4

up vote 2 down vote accepted

I work as a consultant doing Identity Management implementations.

There are a number of products out there. Oracle, Sun, IBM, Courion, Novell all make Identity Management products.

It always looks like an easy idea at the time, and each vendor makes it seem easy, but the back end business processes make it much harder than it ought to be. I.e. There is no such thing as a default install. Every body requires some silly customizations.

As for MS ILM, they have delayed ILM 2 till some time in 2010 now, and the version I did training on back in December was pretty darn weak at the time.

I primarily use Novell Identity Manager for customers, and we find it very effective. Others who do Oracle or Sun products usually feel and say the same thing.

You should identify what connected systems you want to link. (I.e. What is your HR program? Active Directory, and anything else? Any other systems store Identity?) Then with a list of the systems you want to connect you can look at products to see how well they handle them.

share
    
Excellent comment. Due to the varying requirements of systems I've written more than a few scripts and processes to sync these independent systems up with the enterprise LDAP/AD solution and propogate additions and deletions. –  bot403 Apr 8 '11 at 14:14

Wikipedia entry on Novell Identity Manager has several suggestions. http://en.wikipedia.org/wiki/Novell_Identity_Manager

share

I know there are many IM products out there, but I can only spare my experience. I've been implementing Oracle's IM solutions, including Oracle Internet Directory, Oracle Single Sign On and so forth. These products are well integrated with MS Active Directory and of course they work well with Oracle's products and other 3rd party products, via special interfaces and APIs. The HR application we used was Oracle HR (part of Oracle Apps suite), so propagation of information was rather simple. Also, using some custom built code, the IM was integrated to the SharePoint portal.

share

Another good one is Hitachi ID Identity Manager. Hitachi ID is not a "platform vendor" so the integrations span lots of systems, without risk of "of course, it works better with our directory/database/app server/etc."

Identity synchronization is one of the use cases that works particularly well (read: limited scripting required).

I do work for them.

share
1  
Hitachi bought M-Tech, and I used their P-Synch product, and I am a bit so-so on it. There are a number of things I do not like about its approach. Never tried the ID-Synch product. Having said that, P-Synch had a pretty unique feature if using Lotus Notes, which is now part of Notes 8.5 (IDVault) for handling ID files. –  geoffc Apr 8 '11 at 17:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.