22.12.2012 Views

Front cover - IBM Redbooks

Front cover - IBM Redbooks

Front cover - IBM Redbooks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

8.4.1 Account provisioning<br />

348 Lotus Security Handbook<br />

Directory integration and synchronization can be used to support account<br />

provisioning. Account provisioning, from a directory perspective, means that the<br />

different system services can be enabled in some automated fashion for a given<br />

user. By automating the provisioning of accounts for common applications, the<br />

administrative resources required can be drastically reduced.<br />

In order to support automated provisioning, directory integration must support<br />

several requisite functions:<br />

Service<br />

A service is a logical collection of functions typically provided by a single<br />

application or set of integrated applications. For provisioning purposes, a service<br />

is synonymous with an application. An example is Notes e-mail.<br />

Account<br />

An account is the user’s service-specific details and assigned resources on the<br />

service. For example, an e-mail address with a corresponding mailbox to receive<br />

messages would be the user-specific resources required on an e-mail service.<br />

The service would need to recognize a predefined user credential to access the<br />

service, and it would need to define access controls on the service to allow the<br />

user to send and receive messages in their mailbox, yet deny access to their<br />

mailbox to other users of the e-mail service. The relationship between<br />

authentication and access control from an account perspective is:<br />

► The service supports the user authentication to access and use the functions<br />

provided by the service. Authentication means the act of verifying the<br />

authenticity of a user's credentials. Credentials could be a user ID and<br />

password, or a digital certificate.<br />

► The service provides access controls to the account resources and functions.<br />

The access control is the method used to assure that authenticated users can<br />

access only the information or functions they are entitled to access.<br />

The account is necessary because data specific to the user must be stored<br />

within the application. The types of data we are considering as part of the<br />

account are not stored in the Enterprise Directory service. Examples include<br />

e-mail mailboxes, “favorites” folders, and preferences or user options specific to<br />

a given application. We might store the location of a user’s mailbox in the<br />

directory, but the actual mailbox and its contents are stored within the<br />

application.<br />

Registration<br />

Registration is the act or process of signing up a specific user for a service.<br />

Users can self-register for IDs, subscriptions, and so forth. Alternatively, an

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!