Identity Management

1) IGA objectives and responsibilities

IGA - manages who has what access, why, how much and how to prove it.
Objectives: minimum rights (Least Privilege), absence of "orphaned" access, SoD control, regulatory provability (GDPR/ISO/AML/PCI, if applicable), quick granting/revocation of rights.

• Staff: staff, contractors, temporary.
• B2B/vendors/affiliates: external users/integrations.
• Service/bot accounts: API/integration, machines.
• High risk: admins, payments, AML/KYC, DPO, DevOps/SRE.
• (Op.) CIAM: players - in a separate system; integration roles and boundaries are fixed in IGA.

2) Architecture and sources of truth

Authoritative source: HRIS/HR system (for personnel) + vendor register (for external).
IdP/SSO: OIDC/SAML, groups ↔ roles (SCIM).
IGA core: entitlement catalog, SoD rules, workflow requests, re-certification campaigns, reports.
Provisioning: connectors to target systems (admin panels, DWH/BI, KYC/AML, PSP, Git/CI, Jira/Confluence, cloud, K8s).
Identity Warehouse/metadata: aggregation of attributes (department, role, region, trust level, employee type).
PAM/JIT: For privileged sessions and short-term raises.

3) JML - Identity Life Cycle

Joiner (onboarding)

Creating an account from HRIS → assigning birthright roles (SSO, mail, basic tools).
Domain roles by position/command/location/tenant; primary SoD check.
MFA/WebAuthn, password manager, training.

Mover

Automatic revision of rights when changing position/project/location; removal of old roles (no accumulation).
SoD revaluation, update of ABAC attributes (region/tenant), JIT templates.

Leaver (offboarding)

Blocking SSO ≤ 15 minutes, revoking tokens/API keys, closing sessions, revoking access to DWH/admins, transferring ownership of artifacts, deleting/archiving by policy.

4) Rights directory and role model

Entitlement Catalog: normalized rights (CRUD/operations/exports/admin), owner, risk level, system, SoD conflicts, default PII masking.

• Core: `employee_basic`, `viewer_internal`.
• Доменные: `payments_ops`, `aml_officer`, `kyc_operator`, `fraud_analyst`, `vip_manager`, `bi_analyst`.
• System: 'devops _ admin', 'dba _ admin', 'read _ only _ prod'.
• Privileged (JIT/PAM): 'prod _ db _ jit _ editor', 'break _ glass _ admin'.
• Roles as code: YAML/JSON in the repository + CI validators + CAB changelog.

yaml role: payments_ops@EEA description: "EEA payment transactions"
entitlements:
- FIN:APPROVE_WITHDRAWAL
- FIN:VIEW_TX_MASKED constraints:
region: EEA data_class: <= Confidential sod_conflicts:
- FRAUD:RULE_ADMIN masking: default owner: head_of_payments

5) Access and approval requests (workflow)

IDM/ITSM portal: requisition with 'purpose', term (TTL), systems/roles.

• Low risk: auto-approval by domain owner.
• High risk/PII/money: owner + Security/Compliance (+ DPO at PII unmask).
• JIT for elevation (15-120 min), automatic recall, full session recording (PAM).
• SoD check synchronously, blocks conflicting combinations.

6) SoD and ABAC at IGA

SoD rules: incompatible role/right pairs (e.g. 'payments _ ops' ↔ 'fraud _ rule _ admin').
ABAC attributes: environment (prod/stage), region/tenant, device (MDM), time/shift, device risk, KYC level, 'purpose'.
Unmask policies: 'pii _ unmask' JIT only + confirm + audit fields.

7) Re-certification and campaigns

Quarterly reviews: Owners confirm employee/vendor access.
Event campaigns: in case of reorganization, change of system owner, product withdrawal.
Auto-recall of "hanging" rights (unused> 30/60 days).

8) Vendors and external identities (B2B)

Separate B2B tenant, named accounts, minimal API scopes, allow-list IP, time windows.
DPA/SLA: roles, journals, retention, geography, incidents, sub-processors.
Offboarding: key recall, confirmation of deletion, closing act.

9) Service/bot accounts and secrets

IGA registration with owner/purpose/term, no-login; authentication via mTLS/OIDC client-creds/signed webhooks.
Keys in the secret manager; rotation by schedule/event; call log.

10) Logs, audit and reporting

Обязательные события: `ACCOUNT_PROVISION/DEPROVISION`, `ROLE_ASSIGN/REVOKE/UPDATE`, `ACCESS_REQUEST/APPROVE/DENY`, `JIT_GRANT`, `BREAK_GLASS`, `SOD_BLOCK`, `RECERT_START/END`, `EXPORT_DATA`, `PII_UNMASK`.

WORM copy, hash chains, packet signature, 'ts _ utc '/' trace _ id '/' actor _ id '/' purpose'.
Reports: re-certification coverage, SoD violations, orphaned accesses, SLA JML, JIT statistics.

11) Metrics (KPI/KRI)

Time-to-Provision (Joiner): median ≤ 2 hours (key systems).
Time-to-Deprovision (Leaver): ≤ 15 min (SSO/critical), ≤ 4 h (secondary).
SoD Violations: = 0 (attempts - auto-block).
Recertification Completion: 100% on time.
Orphaned Accounts: = 0; Dormant Access Cleanup ≥ 98%/24 ч.
JIT Rate: ≥ 80% of elevations - JIT.
Masked Reads Ratio: ≥ 95% of calls to PII are masked.

12) SOP (procedures)

12. 1 Create role/modify rights directory

1. Inquiry of the owner of the domain → formalization of tasks → mapping on entitlements → the SoD-check → the pilot → CAB → release (YAML) → the announcement.

12. 2 Access request

1. Request with 'purpose '/TTL → SoD/ABAC check → route of approvals → issuance (often masked-read) → logging → revision date.

12. 3 Offboarding

1. Event from HRIS/Portal → SSO Block/Sessions → Group/Role/Key Recall → Ownership Transfer → Report.

12. 4 Re-certification

1. Start → dunning campaign → escalate overdue → auto-recall unconfirmed rights → report.

13) Policy examples (snippets)

13. 1 Birthright и SoD

yaml birthright:
roles:
- employee_basic
- viewer_internal sod:
conflicts:
- [payments_ops, fraud_rule_admin]
- [kyc_operator, support_agent]

13. 2 JIT Rules

yaml jit:
roles:
- prod_db_jit_editor
- pii_unmasker ttl_minutes: 30 approvals:
- owner
- security session_recording: required

13. 3 Re-certification campaign

yaml recertification:
frequency: quarterly scope: [payments_ops, aml_officer, devops_admin]
auto_revoke_unused_days: 60

14) Safety and compliance

GDPR/Privacy: Need-to-Know, masking, DSAR compatibility, PII audit.
AML/KYC: roles for trained only; journal of decisions, retension of logs.
ISO/ISMS: IGA policy mandatory; annual audits, test exercises.
PCI (if applicable): payment zone segregation; separate keys and hosting.

15) IGA (fast playbook) incidents

Access detected without 'purpose '/SoD violation → role/account blocking, incident opening, retro audit of actions, DPO/Compliance notification, CAPA (role/policy/training edits).
Compromising the account → revoking sessions/tokens, changing secrets, analyzing logs, notifying if necessary.

16) Checklists

Before granting access

• Specified'purpose' and TTL
• SoD/jurisdictions/data class verified
• Masking/ABAC enabled
• Approvals Received (Owner/Security)
• Logs and revision date recorded

Quarterly

• 100% Role Re-Certification
• Auto-revoke unused rights
• Verification of B2B/vendor accounts
• Service account key rotation

17) Implementation Roadmap

Weeks 1-2: inventory of systems, HRIS/IdP connection, basic birthright roles, rights directory, SoD matrix.
Weeks 3-4: SCIM provisioning, application portal, JIT/PAM, YAML role repository, first re-certification campaigns.
Month 2: connector expansion (KYC/AML/PSP/DWH), ABAC attributes (region/MDM/time), reporting and KRIs.
Month 3 +: automation of SoD analyzes, role mining/recommendations, UEBA signals, regular exercises and vendor audits.

TL; DR

Effective IGA = HRIS→IdP→IGA - yadro→provizhening, roles/rights as code, JML with fast offboarding, SoD + ABAC, JIT/PAM for privileges, re-certification and rigorous auditing. The result is fewer risks and costs, faster access, higher compliance and transparency.