A technical asset represents a specific application, information system, or technological unit that requires its own access permissions to function and communicate with its environment (other applications and systems). By itself, it is not a specific account; rather, it is the owner and umbrella element for so-called technical accounts (service accounts).

Examples:

• An integration platform (e.g., the IdM itself) needs to access various systems (AD, HR system, SAP, etc.).
• An HR portal needs to access AD to check which employees are active, and the payroll system to check remaining vacation balances.
• A monitoring tool requires access to the monitored systems.

The primary reason for registering technical assets is to ensure that every technical account within the organization has a clearly defined owner and does not remain anonymous. Therefore, we define two key human roles for each technical asset:

• Technical Asset Guarantor: A person from the business or management side who bears overall functional and compliance responsibility for the given asset. The Guarantor approves permissions for individual technical accounts under the given technical asset.
• Technical Asset Holder: A technical specialist who actually works with asset accounts in practice. In the IdM, the Holder securely retrieves passwords, configures them on target systems, and creates requests for roles that grant the permissions the technical account requires for its intended use.

Thanks to this Person → Technical Asset → Technical Accounts linkage, we can precisely audit at any time who is responsible for which technology and who manages its access rights, which is also crucial from a regulatory standpoint to ensure the organization's compliance with legislative requirements, such as the NIS2 Directive.

• Centralize management of technical accounts under logical asset groupings
• Enable role-based access control for asset-related operations
• Provide audit capabilities for compliance requirements
• Support notifications via NOTIFY event

┌──────────────────┐      ┌────────────────┐
│ TechnicalAccount │◄─ ─ ─│ TechnicalAsset │
└──────────────────┘      └────────────────┘
                                   │
                                   │      ┌─────────────────────────┐
                                   ├─────►│ TechnicalAssetGuarantor │◄────────┐
                                   │      └─────────────────────────┘         │     ┌─────────────┐
                                   │                                          ├─────│ IdmIdentity │
                                   │      ┌──────────────────────┐            │     └─────────────┘
                                   ├─────►│ TechnicalAssetHolder │◄───────────┘
                                   │      └──────────────────────┘
                                   │
                                   │      ┌─────────────────────────────┐
                                   ├─────►│ TechnicalAssetGuarantorRole │◄────┐
                                   │      └─────────────────────────────┘     │     ┌─────────┐
                                   │                                          ├─────│ IdmRole │
                                   │      ┌──────────────────────────┐        │     └─────────┘
                                   └─────►│ TechnicalAssetHolderRole │◄───────┘
                                          └──────────────────────────┘

The technical account has been extended with an optional attribute specifying which technical asset it belongs to. If a technical asset becomes disabled, the technical accounts belonging to it will become disabled as well. Note that this doesn't work in reverse - if a technical asset becomes enabled again, its technical accounts will stay disabled until set to enabled manually.

The overview of technical accounts can be accessed via the "Systems" and "Accounts" agendas in the main menu. The technical accounts in this agenda can be filtered by the technical asset they belong to, as well as by the rest of their properties.

When creating a technical account via the wizard, the first step allows you to select the technical asset to which the technical account belongs. By default, an administrator can create a technical account without selecting a technical asset, whereas all other users are required to fill it in. This behavior can be modified using two configuration properties:

1. idm.pub.tech.techAccountWizard.accountWithoutAssetForAdmin: Setting this to false enforces that even administrator must select a technical asset.
2. idm.pub.tech.techAccountWizard.accountWithoutAssetRoles: By populating this property with role UUIDs (multiple UUIDs can be comma-separated), users with any of these roles assigned will be allowed to create technical accounts without specifying a technical asset.

The primary entity representing a technical asset that can contain multiple technical accounts.

The zone attribute represents a security zone. It can be set on a TechnicalAsset and on an AccAccount (the target-system account owned by a technical account). When an asset declares a zone, IdM enforces that every account reachable from that asset carries the same zone. This prevents a technical account that belongs to a zoned asset from being provisioned into a differently zoned account.

The relation is: TechnicalAsset ← TechnicalAccount ← TechnicalAccountAccount → AccAccount. The zone declared on the asset is compared against the zone of the linked AccAccount.

When the rule is violated, the operation is rejected with a ResultCodeException using result code TECH_ASSET_ZONE_MISMATCH:

Technical asset zone [zoneA] does not match zone [zoneB] on account [account-uid].

The tier attribute on AccAccount is an informational, free-form value. It is not validated against the asset and imposes no constraint - it is used for classification and table display only.

Represents direct assignment of an identity as guarantor for a technical asset.

Represents the assignment of a role to a technical asset, where granting this role to a user designates them as a guarantor of that asset

Represents direct assignment of an identity as holder for a technical asset.

Represents the assignment of a role to a technical asset, where granting this role to a user designates them as a holder of that asset

The overview of technical assets can be accessed via the "Technical assets" agenda in the main menu.

The set and order of rendered columns in the technical asset table can be configured via the public configuration property idm.pub.app.show.technicalAsset.table.columns. Comma is used as a separator; the order of the rendered columns is preserved as configured.

# Rendered columns in the technical asset table agenda. Comma is used as separator.
# Order of rendered columns is preserved as configured.
# Available columns:
# - code - unique business identifier of the asset
# - name - asset name
# - description - asset description
# - guarantors - direct and role-based guarantors (truncated to 5)
# - holders - direct and role-based holders (truncated to 5)
# - validFrom - validity start date
# - validTill - validity end date
# - disabled - inactive flag
# - pam - PAM flag (hidden by default - add explicitly to show it)
idm.pub.app.show.technicalAsset.table.columns=code, name, description, guarantors, holders, validFrom, validTill, disabled

After clicking on the magnifying glass icon or the name of a technical asset in the technical asset table, the detail view of the given technical asset is displayed, with "Basic information" as the default sub-agenda. If the user has the Update permission for a technical asset, they can edit the fields.

To deactivate/activate a technical asset, the user needs the UPDATE permission. Otherwise the respective button won't be displayed.

The "Technical accounts" sub-agenda contains an overview of all technical accounts under the given technical asset.

This sub-agenda allows you to manage the direct guarantors of the technical asset, as well as guarantor roles, the assignment of which makes a user a guarantor.

This sub-agenda allows you to manage the direct holders of the technical asset, as well as holder roles, the assignment of which makes a user a holder.

This sub-agenda displays the audit log for the technical asset and its related entities.

The audit table has no bulk actions.

To simplify permission setup, the techAssetGuarantorRole and techAssetHolderRole roles have been created, which grant permissions to guarantors and holders of technical roles. These roles can either be nested under userRole or assigned directly to selected users. Default permission settings: