Removing Applications from Identity Cube Post Access Revocation

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello Experts,

Is there a way to automatically remove applications from the Identity Cube once the associated access has been revoked or the identity becomes inactive?

Thanks,

Mahesh

2

What application types you have that has this requirement. You can add filters that apply to account aggregation for specific connectors like Delimited, AD , LDAP, JDBC etc. The filter can have condition to only aggregate account if they have the associated access.

3

Mostly for Active Directory Source Related Applications.

-Mahesh

4

How did you integrate these apps? Is it using some logiplex connectors or based on roles or just plain LDAP based integrations?

Suggestions might vary based on this.

5

Application – I am referring to the source applications defined within the access model.

6

Aggregations are ideally supposed to show you true picture what accounts and access is present in the application. Hence, even if we delete these links temporarily with manual / API based intervention, they will reappear during the next aggregation.

One use-case that you can accomplish is:

  • Delete the accounts with the help of provisioning on the target systems when identity becomes inactive.
  • During the next aggregation, such accounts shall not appear on the identity.

Another use-case that you can accomplish is:

  • You may not want to delete the account while deprovisioning access when identity becomes inactive.
  • However, you can set some flag or identify some way in which you can filter these accounts.
  • In your source configuration, you can add a connector level filter or an aggregation filter to filter out those accounts from aggregation using the flag or identification that you have setup while disabling the account.
  • By doing this, your integration does not aggregate the account, and identity shall not have that account linked.

Note:

Only exception to this is that there is a flag which disables such deletion of account entries on the source. If you have it turned on, it will not delete the account entry on the source during aggregation even if you have actually deleted this account in target system.

If you are looking for something entirely different, please let me know.