Қолданушыларға тиісті қолжетімділікті қамтамасыз ету жүйелері

Technical and Policy systems to give users appropriate access

Identity management (IdM), also known as identity and access management (IAM or IdAM), is a framework of policies and technologies to ensure that the right users (that are part of the ecosystem connected to or within an enterprise) have the appropriate access to technology resources. IdM systems fall under the overarching umbrellas of IT security and data management. Identity and access management systems not only identify, authenticate, and control access for individuals who will be utilizing IT resources but also the hardware and applications employees need to access. IdM addresses the need to ensure appropriate access to resources across increasingly heterogeneous technology environments and to meet increasingly rigorous compliance requirements. The terms "identity management" (IdM) and "identity and access management" are used interchangeably in the area of identity access management. Identity management systems, products, applications and platforms manage identifying and ancillary data about entities that include individuals, computer related hardware, and software applications. IdM covers issues such as how users gain an identity, the roles, and sometimes the permissions that identity grants, the protection of that identity, and the technologies supporting that protection (e. g., network protocols, digital certificates, passwords, etc. ).

Identity management (ID management) – or identity and access management (IAM) – is the organizational and technical processes for first registering and authorizing access rights in the configuration phase, and then in the operation phase for identifying, authenticating and controlling individuals or groups of people to have access to applications, systems or networks based on previously authorized access rights. Identity management (IdM) is the task of controlling information about users on computers. Such information includes information that authenticates the identity of a user, and information that describes data and actions they are authorized to access and/or perform. It also includes the management of descriptive information about the user and how and by whom that information can be accessed and modified. In addition to users, managed entities typically include hardware and network resources and even applications. The diagram below shows the relationship between the configuration and operation phases of IAM, as well as the distinction between identity management and access management. Access control is the enforcement of access rights defined as part of access authorization. Digital identity is an entity's online presence, encompassing personal identifying information (PII) and ancillary information. See OECD and NIST guidelines on protecting PII. It can be interpreted as the codification of identity names and attributes of a physical instance in a way that facilitates processing.

User access enables users to assume a specific digital identity across applications, which enables access controls to be assigned and evaluated against this identity. The use of a single identity for a given user across multiple systems eases tasks for administrators and users. It simplifies access monitoring and verification and allows the organizations to minimize excessive privileges granted to one user. User access can be tracked from initiation to termination of user access. When organizations deploy an identity management process or system, their motivation is normally not primarily to manage a set of identities, but rather to grant appropriate access rights to those entities via their identities. In other words, access management is normally the motivation for identity management and the two sets of processes are consequently closely related.

Organizations continue to add services for both internal users and by customers. Many such services require identity management to properly provide these services. Increasingly, identity management has been partitioned from application functions so that a single identity can serve many or even all of an organization's activities.

Identity federation comprises one or more systems that share user access and allow users to log in based on authenticating against one of the systems participating in the federation. This trust between several systems is often known as "Circle of Trust". In this setup, one system acts as the Identity Provider (IdP) and other system(s) acts as Service Provider (SP). When a user needs to access some service controlled by SP, they first authenticate against the IdP. Upon successful authentication, the IdP sends a secure "assertion" to the Service Provider. "SAML assertions, specified using a markup language intended for describing security assertions, can be used by a verifier to make a statement to a relying party about the identity of a claimant. SAML assertions may optionally be digitally signed."

The most popular reference implementations of the SAML specifications are Shibboleth and Simple SAML. php. Both of these languages also provide Single Sign on (SSO) capabilities.

In addition to creation, deletion, modification of user identity data either assisted or self service, identity management controls ancillary entity data for use by applications, such as contact information or location. Authentication: Verification that an entity is who/what it claims to be using a password, biometrics such as a fingerprint, or distinctive behavior such as a gesture pattern on a touchscreen. Authorization: Managing authorization information that defines what operations an entity can perform in the context of a specific application. For example, one user might be authorized to enter a sales order, while a different user is authorized to approve the credit request for that order. Roles: Roles are groups of operations and/or other roles. Users are granted roles often related to a particular job or job function. Roles are granted authorizations, effectively authorizing all users which have been granted the role. For example, a user administrator role might be authorized to reset a user's password, while a system administrator role might have the ability to assign a user to a specific server. Delegation: Delegation allows local administrators or supervisors to perform system modifications without a global administrator or for one user to allow another to perform actions on their behalf. For example, a user could delegate the right to manage office related information. Interchange: The SAML protocol is a prominent means used to exchange identity information between two identity domains. OpenID Connect is another such protocol.

Putting personal information onto computer networks necessarily raises privacy concerns. Absent proper protections, the data may be used to implement a surveillance society. Social web and online social networking services make heavy use of identity management. Helping users decide how to manage access to their personal information has become an issue of broad concern.

Identity theft happens when thieves gain access to identity information – such as the personal details needed to get access to a bank account.

Research related to the management of identity covers disciplines such as technology, social sciences, humanities and the law. Decentralized identity management is identity management based on decentralized identifiers (DIDs).

Within the Seventh Research Framework Programme of the European Union from 2007 to 2013, several new projects related to Identity Management started. The PICOS Project investigates and develops a state of the art platform for providing trust, privacy and identity management in mobile communities. PrimeLife develops concepts and technologies to help individuals to protect autonomy and retain control over personal information, irrespective of activities. SWIFT focuses on extending identity functions and federation to the network while addressing usability and privacy concerns and leverages identity technology as a key to integrate service and transport infrastructures for the benefit of users and the providers.

Ongoing projects include Future of Identity in the Information Society (FIDIS), GUIDE, and PRIME.

In each organization there is normally a role or department that is responsible for managing the schema of digital identities of their staff and their own objects, which are represented by object identities or object identifiers (OID). The organizational policies and processes and procedures related to the oversight of identity management are sometimes referred to as Identity Governance and Administration (IGA). Commercial software tools exist to help automate and simplify such organizational level identity management functions. How effectively and appropriately such tools are used falls within scope of broader governance, risk management, and compliance regimes. Since 2016 Identity and Access Management professionals have their own professional organization, IDPro. In 2018 the committee initiated the publication of An Annotated Bibliography, listing a number of important publications, books, presentations and videos.

Identity management systems, products, applications, and platforms are commercial Identity management solutions implemented for enterprises and organizations. Technologies, services, and terms related to identity management include Microsoft Windows active directory, service providers, identity providers, Web services, access control, digital identities, password managers, single sign on, security tokens, security token services (STS), workflows, OpenID, WS Security, WS Trust, SAML 2.0, OAuth, and RBAC.

In general, electronic IdM can be said to cover the management of any form of digital identities. The focus on identity management goes back to the development of directories, such as X.500, where a namespace serves to hold named objects that represent real life "identified" entities, such as countries, organizations, applications, subscribers or devices. The X.509 ITU T standard defined certificates carried identity attributes as two directory names: the certificate subject and the certificate issuer. X.509 certificates and PKI systems operate to prove the online "identity" of a subject. Therefore, in IT terms, one can consider identity management as the management of information (as held in a directory) that represents items identified in real life (e. g. users, organizations, devices, services, etc.). The design of such systems requires explicit information and identity engineering tasks. The evolution of identity management follows the progression of Internet technology closely. In the environment of static web pages and static portals of the early 1990s, corporations investigated the delivery of informative web content such as the "white pages" of employees. Subsequently, as the information changed (due to employee turnover, provisioning and de provisioning), the ability to perform self service and help desk updates more efficiently morphed into what became known as Identity Management today.