Overview

This use case describes how users can request privilege account from the Self-Service Portal.

Operators

IGA solution
Self-Service Portal
Manager
User
IGA Admin
IGA Owner

Prerequisites

IGA Set Account Information datacard needs to be fulfilled for privilege account creation and IGA solution has needed write permissions to the directory or application. 

Result

User privilege account is disabled during account creation and after the creation user can activate it in "Activate Privilege Accesses" service or use "Request Privilege Accesses" service for adding more groups to the account. 

Operating chain requesting account

1. User or Manager opens "Request Privilege Account" 
   
   
   • If user is requester, Manager needs to advocate request and possible Approvers needs to approve the request
     
     
   • If Manager is requester, there is no need for separate advocate, but possible Approvers needs to approve the request.
     
     
   • If Manager is the requester he or she chooses subordinate who needs privilege account
     
     
2. User or Manager chooses directory and creates datacard according to privilege account type's (there needs to be IGA Set Account Information datacard for each one of the privilege account type's). Types can be for example, 
   
   
   • ADDomain Admin
     • This can be for example Domain Administrator
       
       
   • ADAdmin other
     • This can be for example OU Administrator
       
       
   • Azure ADAdmin
     • This can be for example Owner in Azure AD
       
       
   • Azure ADAdmin other
     • This can be for example User Access Administrator in Azure AD
       
       
   • OpenLDAP Admin
     • This can be for example OpenLDAP Administrator
       
       
   • Application Admin
     • This can be any of the applications Admin users, which IGA solution has been integrated
       
       
3. User or Manager chooses (optional) start date and end date for privilege account validation
   
   
   • If dates are not chosen, IGA solution will create account immediately and end date will be validated from IGA Set Account Action datacard
     
     
4. User or Manager adds mandatory justification and chooses Next
   
   
5. On the next page user or Manager can request privilege access rights to be added to the account
   
   
   • User or Manager chooses application from the list
     
     
     • Only applications, which has privilege accesses (IGA Entitlement marked as privilege access) are shown in the list
       
       
   • User or Manager chooses needed privilege accesses from the list 
     
     
     • Only IGA Entitlements, which are marked as privilege accesses and are published to "Request Privilege Accesses" service
       
       
     • If User or Manager requests privilege accesses, and user does not have account for that directory or application, IGA solution will generate account according to request, but no additional privilege accesses are added
       
       
       • User or Manager can open "Request Privilege Accesses" service and choose correct entitlements
         
         
6. User or Manager submits the request
   
   
7. IGA solution creates IGA Service Request and starts provisioning process for creating new privilege account.
   
   
   • Privilege Account is always created as disabled (user needs to activate account from the Self-Service Portal service "Active Privilege Accesses", before it can be used)
     
     
8. IGA solution waits until response from the directory or application has received, closes the IGA Request and sends status information to Self-Service Portal
   
   
9. IGA Access Right Records are created and audit details are saved.

Related datacards

IGA Identity Storage
IGA Account
IGA Set Account Information
Application

Self-Service Portal services

Request Privilege Account