Front cover - IBM Redbooks

administrator or the user’s management may sign up services on the user’s
behalf. A third type of registration could be automatic and based on roles, where
the roles are functional, related to job level, job title, corporate hierarchy, and so
forth. The parameters required by the service (account details) must be provided
by the party or agent performing the registration, although some parameters may
be generated algorithmically based on directory attributes.
The service may provide for different levels of capabilities or functions within the
service, so registration may need to provide details regarding the desired
functions within the service.
Entitlement
Entitlement is the act of granting a user, with a specific set of credentials, access
to information or functions. A user must generally be entitled to use a service
before an account on the service can be set up. Alternatively, an account can be
set up without any access rights in anticipation of the entitlement, although this
sequence can result in resources being reserved but then never used and would
require some cleanup activities to remove the unused resources.
Automated provisioning
While it is possible to perform automated provisioning without a central master
directory, it will be limited to specific event-driven processes. For example, a new
employee added to the HR system can automatically be set up with an e-mail
account in Domino if a tool like Directory Integrator is being used. This type of
event-driven provisioning can quickly become complex if the account
entitlements are determined by multiple factors, such as job title, department,
location, and so forth. For example, if employees at a certain job title or level are
automatically to be given an Instant Messaging account, that can be automated.
But it does not provide a means to allow exceptions, and no way to make
changes to the policies for entitlements so they take effect on existing users. In
other words, for an existing user there is no “event” until some change is made in
the source directory for that user.
If the user’s entitlements are not explicitly stored in a central directory, the
entitlements must be inferred or assumed by examining directory data in multiple
systems. A central directory can maintain information regarding what systems or
services a user is permitted to use and configured to use, as well as user
attributes unique to each system. This offers the advantage of enabling the
administrator to see and manipulate all the different entitlements in a single place
for a given user. Not only does it provide a central point for entitlement
administration, but changes to entitlement policy can be applied to both new and
existing users. As with purely event-driven entitlement, the actual accounts for
each service can be automatically set up. Because of the advantages
Chapter 8. Directory strategies 349