The Virtual Quill

The rules about roles

Shekhar Jha recently posted a note about roles and role management, where he states: "I have always considered roles as a means to achieve the end goal of access management." But feels that others have a different view: "But a lot of people do see the roles themselves as something important that need to be 'mined' out of privileges." He adds, "I may be slightly biased against the role-management because I see the end goal as Access Management and not role management."

I've spoken before about the two differing approaches to role definition. First there's the top-down method of starting with the compy's org chart, squeezing in HR's job definitions, tacking on regulatory "must"s and "must not"s then tweaking for individual enterprise activity. Secondly there's the bottom-up method of discovering access rights by trolling the network then creating roles based on common access rights. This latter case is what's known as "role mining."

The reality is, of course, that you need both. Relying solely on role mining leads to compounding all of the errors that have built up over time - and they can be enormous. But creating roles simply by copying the org chart means you end up with a "mission statement for rights" which, like your enterprise's other Mission Statement, looks good, sounds good and it's much more likely to be honored in the breach than in the observance.

We need to think of roles as an abstraction layer for identity.

We're abstracting needs and requirements from the mass of individuals within the organization but at the same time we're abstracting rights and privileges from the resources that are the targets of the users' needs (some would call this abstraction "entitlements"). The use of an abstraction layer allows us to construct access rules which are easily, but securely, enforced by the system while also automating set-up and tear-down of the access. Roles make the job of managing users and their access rights and needs far easier, far more automated and far more auditable.

Roles are necessary, but not sufficient, for a well designed identity management system.