up vote 2 down vote favorite
1
share [g+] share [fb]

I'm wondering if anyone is providing a solid solution for creating New Network User Account Request forms, and attaching workflows to them to automate account creation?

I'm currently investigating a number of options, but am surprised that such a ubiquitous task hasn't been solved a dozen times over and thoroughly documented. Or at least isn't integrated into current off-the-shelf change management and ticketing systems.

Ideally, I'd like for our current ticketing system, ServiceDesk+ to present a standard 'New User' form to department heads, which they can fill in with the required new user details. This triggers a workflow that submits the request as a ticket that can be reviewed and actioned. Actioning the ticket triggers a workflow that creates a user in AD with the details provided, and notifies the department head upon completion.

All told, a pretty standard requirement that I'm sure most organizations have. What are other people doing to accomplish this?

Edit: I should add, I'm more looking for "supported" methods. As is, I've submitted a number of scripted solutions, none of which have met with manager approval.

link|improve this question
What do you mean by "supported" methods? You want a commercial product? Your company doesn't want you spending time putting something homegrown into production? – mfinni Jan 11 '11 at 6:53
Current management theory here is that in-house solutions can't come with guaranteed support due to staff turnover (even thorough documentation isn't enough, apparently), which violates some policy regarding approved software vendors. So I'm stuck between a rock and a hard place. I'm being told my solutions are cheap but unacceptable, while large IDM systems are acceptable but over-featured for our needs. – Trevor Jan 11 '11 at 7:40
2  
Hmm... It seems that management wants to have their cake and eat it too. – joeqwerty Jan 11 '11 at 11:36
Management might not need this, as well. Just because something looks like it would be fun to implement and use, doesn't mean there's a good case for ROI. How often do you need a complex workflow for new accounts? You can often, as I said, just copy existing users (or make templates and copy them.) Maybe management doesn't want, or see the value of, having a 'new account request' go through 4 stages of workflow. How many additional systems need to be touched when you make a new account, besides AD? – mfinni Jan 11 '11 at 11:57
feedback

2 Answers

up vote 1 down vote accepted

If your management wants to spend money on this, buy the product from the same vendor that makes your helpdesk software.

http://www.manageengine.com/products/ad-manager/active-directory-workflow.html

link|improve this answer
The the end result of the workflow described here is exactly what I'm talking about. Shame it's just one aspect of a much larger tool that would be pricey and most likely largely underutilized in this environment. Still.. the change management and AD reporting software currently in use here -could- do with replacing, so.. – Trevor Jan 11 '11 at 7:32
1  
You may grow into the other capabilities of the product once you see what else it can do. In my opinion, this is as close as you're going to get. In addition, don't throw the baby out with the bathwater. You're going to disregard this product (that does what you need) because it has too many other features? – joeqwerty Jan 11 '11 at 11:40
feedback
up vote 1 down vote

The main reason you don't find these off the shelf are for two big reasons:

  1. The process changes dramatically from org to org, so identifying commonalities and handling customization is very complex.
  2. Because of #1 such packages usually are integrated into an overall Identity Management System. These are not cheap.

The 'new account' process is a combination of business rules (approval-routing for getting permission to post a job, approval-routing to approve a hire, approval-routing to start account-creation), and IT rules (procedures and checkoffs for creating and provisioning the accounts). For some organizations creating accounts is as simple as:

  1. User shows up for first day of work.
  2. Manager calls Helpdesk.
  3. Helpdesk creates account manually.
  4. User starts being productive.

Where in ours, thanks to our IDM system, creating accounts is:

  1. HR creates the personnel record
  2. HR flags the account as 'Active'
  3. User goes through a quick 'account activate' web-page and starts being productive.

Unfortunately, full on Identity Management solutions tend to be highly complex once fully deployed, and that's largely due to business rules. Business rules are unique per business, so the IDM solutions by definition are frameworks upon which you build a solution. They're not off-the-shelf solutions that you can drop in place and away you go, at least not without changing business process to match the technology.

In our case, the process from desire to hire to HR clicking the magic go-button is handled through an electronic document process with digital signatures. This is completely independent of our Helpdesk software. The approvals that have to be gained during the whole life-cycle of a job posting up to hire:

  • Approval from division, departmental, and University President to post the job
  • Approval from division, departmental, and University President to propose an offer
  • Approval from ... to accept a new hire
  • Notice from hiring manager to activate accounts

All of the above is simple routing of digital paper that is seen and signed by many people. Once it gets to HR, it enters the IDM system and things are automated. New person shows up on their first day, are guided through the 5 minute account-activate process, and they have all the accounts they need for their job right then.

link|improve this answer
My question is more in regards to the existence of packages to address the needs of the (surely) hundreds of thousands of much smaller business who's current system involves the IT guy receiving an email from Debbie saying there's a new guy starting Monday, can you make him a network login thingy? Which is then done by hand. Or organizations like my own who are currently using cobbled together Infopath forms on intranets that generate emails and kick off VB scripts, when they actually work. I'm amazed such a basic and universal need doesnt have even cheap, but supported, fix. – Trevor Jan 11 '11 at 6:46
And that is why you haven't found any generic workflow tools for this. A standalone product would have to have integration points for any/every ticketing system, and IDM. And would probably cost money. The solution that most of the companies out there end up writing themselves are probably very specific to that company, with their tools and processes, and probably not even documented very well internally, let alone released to the public. – mfinni Jan 11 '11 at 6:47
2  
Heh - you edited your comment while I was writing mine. Like you said, the smallest companies don't even need what you're asking for. They take a ticket (or maybe just an email) and someone just uses the built-in AD tools and often copies an existing user. Anything more complex would take time to implement, test, and maintain, for very little benefit. Slightly larger companies that write one themselves have no interest in releasing it to the public, let alone making it generic enough for someone else to use/extend. – mfinni Jan 11 '11 at 6:49
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.