Overview

This use case describes how users can activate privilege account and accesses (which user is pre-defined to be allowed to use) from the Self-Service Portal.

Operators

IGA solution
Self-Service Portal
User

Prerequisites

User needs to have privilege account and permissions to activate related IGA Entitlements (privilege accesses).

Manage Privilege Accesses use case and all related uses cases are implemented.

Result

User privilege account is enabled for temporary time of period, group memberships is provisioned automatically to the directory or application and after maximum validation days account is disabled and group membership connections are removed. 

User is able to sign in with the privilege account. 

Operating chain

1. User opens "Activate Privilege Accesses" service from the Self-Service Portal.
   
   
   • User chooses privilege account
     
     
     • If user has several privilege accounts user chooses from the list correct one. 
       
       
     • If User has only one privilege account it is already selected.
       
       
   • User chooses IGA Entitlements, which he / she needs to be activated 
     
     
     • On the list, user can only see IGA Entitlements, which are found from related IGA Account datacard, in Privilege permissions attribute (entitlements which are requested by using "Request Privilege Accesses" service from the Self-Service Portal
       
       
   • User selects reason
     
     
     • Incident, mandatory to fulfill ticket number
       
       
     • Change request, mandatory to fulfill justification and optional ticket number
       
       
     • Maintenance, mandatory to fulfill justification
       
       
     • Other, mandatory to fulfill justification
       
       
   • User can also change privilege accounts password (optional field)
     
     
   • User chooses submit 
     
     
2. IGA solution receives information and validates from users privilege IGA Account datacard, that user has permissions to activate these entitlements
   
   
   • If permission is not found, IGA solution sends information to the Self-Service Portal and closes the request
     
     
3. IGA solution starts provisioning process
   
   
   • Privilege account is enabled and group membership connection is provisioned to the directory or application
     
     
   • Privilege account is enabled only for allowed time period
     
     
     • This is defined in IGA Set Account Information datacard
       
       
4. IGA solution waits until response from the directory or application has received, closes the IGA Request and sends status information to Self-Service Portal 
   
   
5. User is able to use now privilege account and access only to those directories or applications, which IGA Entitlements user activated
   
   
6. IGA solution waits that maximum validation dates are exceeded
    
   • Users privilege account is disabled  
     
     
   • All group memberships are removed, but permission to use them are stored in the IGA Account datacard
     
     
7. IGA Access Right Records are created and audit details are saved.

Related datacards

IGA Identity Storage
IGA Account
IGA Set Account Information
Application

Self-Service Portal services

Activate Privilege Accesses