Access Reconciliation

Identity and Access Management (IAM) reconciliation is an important security process that ensures the accuracy, completeness, and validity of user access rights and privileges in a given system. It involves verifying access rights are assigned to the right users, and consistent with their roles, responsibilities, and the principle of least privilege.

By monitoring and comparing user accounts against authoritative sources such as directories, databases, or logs, IAM reconciliation helps to detect discrepancies which can be addressed quickly to prevent potential security threats. 

Data synchronization for IAM ensures consistent and up-to-date user identity and access information across diverse systems, applications, and directories within an organization.

This process streamlines the management of user data, enhances security, and supports seamless access control in complex IT environments.

Every synchronization happens based on two keys:

• Recon Key
• Unique Field Key

These two keys are required for application onboarding, as well as the syncing process.

The Recon Key is directly related to the reconciliation feature in IDHub, and is a critical part when entering data into the spreadsheet.

For example: if the user name is the Recon Key, then the user name should match exactly on the spreadsheet, compared to what is in IDHub.

Reconciliation Process

• IDHub identifies whether the application is Trusted or Not-Trusted
  • Trusted Application: used to pull user information into IDHub
  • Non-Trusted Application: used to pull only account and entitlement related information into IDHub
• Account matching is done by the Unique Field Key
• User matching is done by the Recon Key
• When Accounts are matched:
  • Each account attribute goes through Attribute Based Access Control (ABAC) and based on sync direction account attributes are updated in IDHub
  • Each entitlement present in the target system is replaced with what is present in IDHub user account
• When account is not found in target system:
  • Account goes into stale check process and waits for the account to become stale
  • Once account is stale it is deleted from IDHub
• Thresholds:
  • Deletions of accounts are prevented by threshold configurations in applications
  • Once crossed the sync process is stopped to avoid accidental deletions

Attribute-based synchronization is a unique feature used to sync data within IDHub and connected applications.

If there are any attribute data discrepancies found between the two, this feature allows organizations to determine whether IDHub or the application will override the alternate data.

Multiple syncing options are available upon configuration:

• IDHub to App
• App to IDHub
• Bi-directional Sync
• No Synchronization

Any attribute difference will be automatically synced, according to the configuration applied.

The process for reconciliation or synchronization of data from target system to IDHub is called App Synchronization. It can be done in two ways:

• Manual Synchronization - This can be initiated upon request by administrators of IDHub
• Sync Schedules - This can be setup while application onboarding using IDHub wizard.

In IDHub, reconciling disconnected applications is done manually.

Admins will upload a delimited text file, allowing for quick processing of accounts, which can be used during the Certification process.

The synchronization process via a file upload allows the system to recognize the application so that IDHub can verify the access to resources update the access  information accordingly.

This allows admins to easily identify access issues and make updates according to access management policies.