What would CzechIdM be without automation? Synchronization, i.e. data flow from source systems to the identity manager, is essential for every identity manager. In CzechIdM you can synchronize the following types of entities:
Synchronization is fully audited and supports multiple synchronizations for every entity. Synchronization can be started on demand, or as planned scheduled task.
Another essential data flow in almost all IdM deployments is provisioning. This involves data flow from IdM to managed systems. All entities that support synchronization can also be pushed to end systems via provisioning. Our robust provisioning implementation brings the following benefits:
CzechIdM provides complete audit history of all entities in CzechIdM. The major audit features are:
CzechIdM represents user's privilege in managed system as a role. From the CzechIdM point of view, there is no difference: the user has specific right in a managed system, is a member of a group of users (AD/LDAP) or has an account with basic access. All of that is represented by one CzechIdM entity - ROLE.
This paradigm is really effective and easy to understand. It allows IdM to apply general rules for roles management and distribution like automatic roles, roles requests approval, synchronization and provisioning.
With CzechIdM you can automate role assignment process. You can link roles to organization structure (tree structure) in:
If you link a role with the user's working position, this operation is subject to approval. Once an authorized person has approved the operation, from that time on all users placed in the working position get the role without approvement.
This also means they get the role without delay. This is essential if you require a new user (e.g. employee) to get access to managed systems on the very first working day.
Of course, the reverse process works the same way. When a user leaves their working position they lose their roles/access to systems immediately.
CzechIdM provides web interface for convenient work of users and administrators.
Users benefit from using CzechIdM especially in following classes of tasks:
CzechIdM provides a wide variety of identity management features in its GUI. Most important ones are:
RESTful API is the preferred communication API for CzechIdM. All application services are available via this API. It means that even the application frontend uses it for communicating with a backend. This approach has many advantages:
See more in (online CzechIDM RESTful API doc).
CzechIdM contains standardized lifecycle processes management for identities.
Default processes which provide basic automatic management of identities are as follows:
All processes are implemented as long running tasks and operated by workflows. Thus:
In addition to these processes, it is worth mentioning that
of identity to work position (organization structure) is also supported in CzechIdM. It is managed by the automatic roles feature.
The implementation of standard processes can be enhanced, and new processes can be added to CzechIdM as well. More details about HR processes in CzechIdM can be found in Identity lifecycle processes of Administrator's guide.
An identity manager is usually the central system in the company's systems hierarchy. So it should be easy to deploy the IdM system into existing IT environment with minimal changes to the current environment.
When communicating with other systems, CzechIdM uses their native API. This approach has a massive benefit in that there is usually no need to alter the systems. All you need to do is to choose the right connector from our many supported connectors. If there is no connector available for your system yet, we can develop a new one.
CzechIdM manages various systems like LDAP, MS AD, databases, Unix-like systems, file servers, HR systems, Helpdesk, Windows servers, MS Exchange, postfix, and many others.
CzechIdM is a robust identity manager and can deal with difficult organizational structures.
Imagine a situation when a company or organization, e.g. hospital, consists of five smaller regional hospitals or other detached workplaces with some elements of autonomy. Then there are, in fact, 5 organizations that have to be managed by CzechIdM, but it is desirable that users from one regional hospital are managed by their dedicated administrator within CzechIdM, who of course cannot manage users from other hospitals.
CzechIdM comes with the REALM paradigm. It can synchronize organizational structure from HR system(s), and it keeps them separate in 5 trees (like in our stated case above). Each tree then represents the organizational structure of one hospital. As a result, the mechanism of roles permissions can be used to grant access for administrators to only a specified tree and the users placed within it.
CzechIdM offers several means of users' authentication. Users can authenticate locally or against some remote system. CzechIdM in its basic modules supports authentication against:
The architecture of CzechIdM is prepared for adding other authentication methods just be implementing their protocol.
Out of the box, CzechIdM supports HTTP basic authentication as an authentication method for SSO. We can make CzechIdM to authenticate agains MS AD (kerberos) using SSO.
CzechIdM is heavily modular. It means that the whole application - frontend and backend alike - is divided into modules. Some are really essential like CORE, ACC and IC and, in fact, constitutes the application itself.
Modularity brings many pluses:
Also, CzechIdM offers optional modules which include REG, OPENAM, PWD-RESET, CA.
CzechIdM is a powerful system for identity management. There are many ways of creating an identity, for instance through Synchronization or via REST API. However, those are more or less automatic ways of identity import.
Sometimes it is desirable to let the users register for themselves, say if you use CzechIdM for external contractors account management, or company customers accounts management. The user registration module enables the self-registration of the user with optional validation steps - email validation, entrusting user approval. The module consists of GUI module - registration form and backend module - logic and notifications.
Read more on how to setup and use the module in administrator's guide.
Users can authenticate themselves in CzechIdM with their login and password. The password is, of course, a secret information. It happens sometimes that user does not remember the password and cannot log in to CzechIdM. The pwd-reset module provides GUI form that is available via a link from CzechIdM login page and users can use it to initialize the lost password reset process. The module handles the complete lost password process:
Read more about the module setup and usage.
OpenAM authentication and SSO module offer the integration with OpenAM - centralized access manager. The integration serves for:
Read more about the module setup and usage.
The module provides a set of tools to work with certificates:
The module is dependent on particular CA implementation (try out CAW). It uses a set of drivers to communicate with CA.
The System for Cross-domain Identity Management (SCIM) specification is designed to make managing user identities in applications and services easier. SCIM - the open API based on REST for managing identities, by defining a schema for representing users and groups for all the necessary CRUD operations.
CzechIDM Scim module exposes interface by the SCIM 2.0 specification. Read more about SCIM model, operations and endpoints.
Read more about the module.