6th European Conference - Academic Conferences

Maria Semmelrock-Picej et al.
3. Application case identity federations
3.1 User requirements
Prior to the introduction of the Identity Management System (IDMS) in 2005, access information on
file shares, computers and accounts was distributed to several systems like Active Directory, SunOne
and other applications. Those systems worked independently and there was no mechanism available
to guarantee consistent data (e.g. departments, cost center, phone numbers and names of persons),
based on the delivery from designated master systems, throughout the different systems deployed in
the company. Thus, helpdesk support was required frequently.
Therefore Infineon introduced the IDMS to have a mechanism at hand to collect data from different
master systems, combining the necessary data to digital identities and distribute and enforce this
identity information consequently throughout different directory services and applications. In order to
improve the IDMS and to save the ROI, an automatic user provisioning system and RBAC has to be
set up in a next step.
The major function of provisioning is once a new identity enters the IDMS from the global HR system,
an automatic workflow is triggered to its manager based on certain attributes (like location and
manager information). The respective manager chooses the respective roles for the new employee
and dependent on the request the necessary access to resources (accounts, groups, group
memberships) is set by the IDMS (mostly no human interaction is necessary anymore). Thus, during
the life cycle of the identity roles are added and removed and once an employee leaves the company
access to his resources will be disabled completely. The last case is also called de-provisioning. A
basic approach for provisioning (without a portal- and workflow solution) was developed and
implemented at Infineon in 2007. The results are shown in (Obiltschnig 2007).
Another issue which cannot be tackled exclusively by a centrally-organized IDMS is the collaboration
with external partners. This topic has been deeply researched for more than two decades. Already
started in the mid of the 1980s, research in this area is still ongoing. Wellknown and representative
terms used for enterprise collaboration (alliances) are Virtual Organizations (Skyrme 2007),
Networked Organizations (Lipnack and Stamps 1994) and Collaborative Innovation Networks [GL06].
The so-called Virtual Team represents another well-known expression on the micro-level (Lipnack
and Stamps 1997).
A common sense of the mentioned concepts can be summarized by the following aspects (Lipnack
and Stamps 1997):
Independent people and groups act as independent nodes in a network,
Are linked across conventional boundaries (e.g. departments and geographies)
And work together for a common purpose.
A collaboration has multiple leaders, lots of voluntary links and interacting levels,
Is based on mutual responsibility, i.e. there is no hierarchical management structure but the
involved individuals act as equal partners,
And teams are readjusted or disbanded as needed.
A successful collaboration requires the fulfillment of the following principles (Skyrme 2007):
Each partner must contribute some distinctive added value for the corporation.
Members must develop high degree of mutual trust and understanding. Thus, similar groups or
even the same people will work together again and again.
Projects or whole services should be the focus of the cooperation.
In the run-up of a collaboration one has to define general rules of engagement in terms of inputs
to the cooperation and rewards expected, though the momentum is lost if these are too formalized
too soon.
Members of the cooperation should recognize the need for coordination roles and either commit
time to develop and nurture these roles or pay one of the members to undertake the coordination
roles on behalf of them.
244