| Note |
|---|
Status: DraftWaiting for Approval |
| Info |
|---|
The described behaviour implies, that on you’re CoreOne Suite Instance the following configuration is enabled:
|
The CoreOne Suite offers different types of how you can create and manage Resourcesresources. In the beginning of implementing the CoreOne Suite, you have to decide, what type of Resources resources you would like to use. This article should help you to decide between Linked and Managed Resources. The behaviour of these resource types are pretty similiar in the different target systems we do support. We decided to focus in this article on the target system Active Directory as this is one of the most used target systems by our customers.
| Table of Contents | ||||
|---|---|---|---|---|
|
Theory
Resources in the CoreOne Suite are nothing else than a Group group in an Active Directory. Due to different Terminations terminations in all our supported target systems, we decided to use the termination “Resources”“resources”. Simple said: A Resource resource is a right you can assing assign to an Identity in a Target Systemtarget system. In an Active Directory it is a Group group (Resourceresource) where you add a user (Identityidentity) as member. This nesting results most commonly in a right.
Linked Resources
Linked Resources are the most used type of resources. With linked Resources
Pro’s & Con’s
Managed Resources
...
Linked Resources you’re using existing groups in your target system anf only map them in the CoreOne Admin UI as “Linked Resource” so you can use them to add members through the CoreOne Suite.
As the name already explains: You only link it. You can compare that with a shortcut (would be the Linked Resource) to a folder (AD-Group) on your desktop. If you delete the folder itself, the shortcut is still there. If you then click on the shortcut, it will thow you an error message. If you rename the shortcut, the name of the folder itself won’t be changed. If you delete the shortcut, the folder will still be there.
Pro’s
You can easily reuse your existing goups
Con’s
Can be irritating for power users to deprovision a linked resource
In the most cases the CoreOne Suite and the target system will diverge
Managed Resources
Managed Resources are the way to go, if you start with a target system from scratch. With Managed Resources, you will create a newly needed AD-Group directly within the CoreOne Suite. The CoreOne Suite will then create the needed AD-Group automatically and link them. You can define templates for the creation of new Managed Resources which will help you to propagate a naming concept for example.
With the CleanUp Task enabled, Managed Ressources make sure, the CoreOne Suite and the target system attributes of a Managed Resource/target system Group will converge. Like a Linked Ressource, it will also controll the memberships for all known entities but also controll attribute values of the Managed Resource itself.
For Example: Within the creation process of a Managed Resource you define the OU-Path (it also can be given by the template). If someone by accident moves the AD-Group directly in the target system into a new OU-Path, the CoreOne Suite will move back the AD-Group to it’s correct place. This also means: All defined attributes for creating a ressource you are only able to change them in the CoreOne Suite.
Pro’s
You can centralize the create process of AD-Groups into the CoreOne Suite. Your powe users can create them by theirself → Decentralization of dutie’s.
You can define templates for creating Resources
The CoreOne Suite and the target system will converg as long the CleanUp Task is running
Con’s
More efforts needed for taking over existing groups from your target system as Managed Resource.
What they don’t do
They won’t be added automatically as Resource resource in the CoreOne Suite, if you create them directly in the target system.
Linked Resources: You have to link the newly created Active Directory AD-Group in the CoreOne Suite Admin UI to be able, to assign it to a Core-Identity. See: /wiki/spaces/IKB/pages/1796997245
Managed Resources: You’ve chosen the wrong way. It is not possible to use this Groupgroup. You have to delete it in the target system and recreate it in the CoreOne Suite Admin UI and the CoreOne Suite creates the Group group in the target system automatically. See: /wiki/spaces/IKB/pages/1796997245
Only the creation of the resources is not enough. You need to make sure, that the corresponding system-Features are enabled and also the CleanUp-Task runs on a schedule.
Frequently Asked Questions
| Expand | ||
|---|---|---|
| ||
Technically: Yes you can. Logically: It’s not that simple. For Example: The IAM Manager’s goal is to create a new Active Directory Group. In some OU-Path’s where you work with Linked Resources he have to do that directly in the target system Active Directory. For an another OU-Path where you work with Managed Resources he have to get the job done through the Admin UI of the CoreOne Suite. |
We recommend, to focus on one type. We observed, that new IAM Manager’s are often confused, if there are different ways, of how they have to handle rights. | Expand | ||
|---|---|---|
| ||
The CoreOne Suite Cleanup Task only controlls known Objectsobjects/entities. In the context of an Active Directory that means:
Example 1: Group “Application_Read-Write” is a Linked Ressource. The Group has two members. The first User “Diego Testoni” was created and added to this Group group by the CoreOne Suite. The other User “Thomas Gruti” is a manually, directly in the Active Directory created User user and not recognized by the CoreOne Suite. The CoreOne Suite Cleanup CleanUp Task will only manage the membership of Diego Testoni. The membership of Thomas Gruti won’t be touched by the CoreOne Suite. Example 2: The Active Directory User “Diego Testoni” was created through the CoreOne Suite and has 5 Groupgroup-Membershipsmemberships. The CoreOne only recognises 3 of these Groupsgroups. The CoreOne Suite will also only controll these 3 Groupsgroups. The other 2 Groupgrou-Memberships memberships won’t be touched by the CoreOne Suite.Example 3: |
| Expand | ||
|---|---|---|
| ||
The Linked Ressource will still be available in the CoreOne Suite. You will see a lot of errors in the application log of the CoreOne Suite. You will have to remove all Linked Resource members in the CoreOne Suite first and then delete the Linked Resource. After that, you can delete the AD-Group directly in the target system. See: System monitoring |
| Expand | ||
|---|---|---|
| ||
The CoreOne Suite will recreate the AD-Group and add all known entities. In the case of an AD-Group mostly the assigned rights to the old group won’t be taken over, you will have to grant permissions to the newly created groups still manually. |
| Expand | ||
|---|---|---|
| ||
Managed Ressources are the way to go. This will centralize the identity and access management into the CoreOne Suite. |