Pre-Con Ed (Lab): CA Identity Suite—Raising the Bar on User Productivity and System Efficiency

World®
’16
CA Identity Suite—Raising the Bar on
User Productivity and System Efficiency
Matthew K. Miller – Sr. Principal Consultant – CA Technologies
SCX02E
SECURITY

1 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
For Informational Purposes Only
Terms of this Presentation
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies. The presentation provided at CA
World 2016 is intended for information purposes only and does not form any type of warranty. Some of the specific slides with customer
references relate to customer's specific use and experience of CA products and solutions so actual results may vary.
Certain information in this presentation may outline CA’s general product direction. This presentation shall not serve to (i) affect the rights
and/or obligations of CA or its licensees under any existing or future license agreement or services agreement relating to any CA software
product; or (ii) amend any product documentation or specifications for any CA software product. This presentation is based on current
information and resource allocations as of November 1, 2016, and is subject to change or withdrawal by CA at any time without notice. The
development, release and timing of any features or functionality described in this presentation remain at CA’s sole discretion.
Notwithstanding anything in this presentation to the contrary, upon the general availability of any future CA product release referenced in
this presentation, CA may make such release available to new licensees in the form of a regularly scheduled major product release. Such
release may be made available to licensees of the product who are active subscribers to CA maintenance and support, on a when and if-
available basis. The information in this presentation is not deemed to be incorporated into any contract.

Agenda
CA IDENTITY SUITE OVERVIEW
CA IDENTITY ANALYTICS & LAB
ACCESS REQUEST RECOMMENDATIONS & LAB
CERTIFICATION CAMPAIGNS & DEMONSTRATION
MOBILE EXPERIENCE & DEMONSTRATION
1
2
3
4
5

CA Identity Suite
Overview

Main Concepts of CA Identity Suite
Bridging the Gap SimplicityOne Stop Shop
Concepts

CA Identity Suite Services

CA Identity Portal

CA Identity Suite 12.6.8
New Capabilities

CA Identity Suite 12.6.8 Key Benefits
§ Strengthens operational efficiencies
– Adds analytics that provide insight into the performance of the identity and access governance process. With identity
performance analytics, customers can quickly address issues and tune their processes to help identity and eliminate
bottlenecks, meet service level commitments and improve general identity operations.
§ Improves the user experience and user productivity
– Adds new personalization capabilities and options for users responsible for access certification; provides more
information the way the user wants to see it.
– Provides context-based suggestions which help users get the access that they need to successfully do their job.
– Provides comprehensive mobile support so everything a user can do at his/her desk, can be done via mobile.
§ Improves time-to-value
– Simplifies deployment through out-of-the-box, pre-configured customer use cases, helping to reduce the time it takes
to get common user scenarios up and running for faster time-to-value.
© 2016 CA. All RIGHTS RESERVED.

CA Identity Portal Mobile

System Efficiency
Configuring CA Identity Analytics
Administrating > Administrating CA Identity Portal > CA Identity Suite Administration > Analytics Dashboard

Identity Analytics
Empowering the Business to Achieve Operational Excellence with Real-time Analytics
§ Operational Excellence Console for Managers
§ Centralized dashboard providing a unique
view of all identity lifecycle processes
§ Allow managers to analyze processes and drill
down into potential problems and remediate
them
§ Improves efficiency and productivity of the
enterprise
§ SLA statistics give project sponsors business
justification for project ROI
© 2016 CA. All RIGHTS RESERVED.

Analytics Dashboard Overview

Who Can See Analytics?
Profile Scoping Rule:
Profiles can be limited to a subset of
users based on user attributes,
entitlements, group membership
or a combination

What Types of Analytics Gathered?
Analytics Tracking:
Access Catalog Items (Add, Remove, Modify)
Identity Processes

Access Catalog Items
Provisioning Role as defined in
CA Identity Manager
Analytics Gathered
Number of times requested / removed
Duration of provisioning (min/max/avg)
Associated approvals (if applicable)

Identity Processes
Identity Portal Task is linked to
Identity Manager Admin TaskAnalytics Gathered
Number of times processed
Duration of process (min/max/avg)
Associated approvals (if applicable)

Analytics Dashboard Overview Once enabled, analytics data is
collected and available

Enabling Analytics

Define Analytics Views
Analytics Views are the
metrics gathered

Creating Analytics Views
Only 2 Analytics Views may
be enabled globally

Types of Analytics Views
Requester: attributes about the individual submitting the task / making the request
Subject of the Request: attributes about the individual being processed / receiving access
A form property: attribute gathered from the form submitted as part of the process / request

What’s the Difference?
Jeff Andrews
Manager
Elizabeth Talbot
User
Title = Manager
User ID = andje01
Title = Developer
User ID = talel01
Jeff Requests Access for
Elizabeth
Requester | Title = Manager
Subject of the request | Title = Developer

Jeff Andrews
Manager
Elizabeth Talbot
User
Title = Manager
User ID = andje01
Title = Developer
User ID = talel01
Elizabeth Requests Access
for Herself
Requester | Title = Developer
Subject of the request | Title = Developer
Requester | Manager ID = andje01

Jeff Andrews
Manager
Title = Manager
User ID = andje01
Jeff Creates New
Contractor
Form Property | Contract Period = 90 Days
Requester | Manager ID = andje01

What are the Data Points?
Duration to complete in
timescale
Number of requests
started on the date

How do I Read the Charts?
Average duration over the
course of the timeframe
Total requests over the
Longest duration over the
Shortest duration over the

Requests created on January 3rd
took on average 9 days
1 request was submitted on
January 3rd

Hover over to view result of the process
over the course of the timeframe

Export Analytics

Excel Spreadsheet Export

Flat File (.csv) Export
Microsoft Excel View
Notepad++ View

Image Export

Breaking Down the Workflow
Data available only if a workflow is
associated to the IDM task

Workflow Details – Level 1
Select the node to get details

Select an actor to get
additional details

Outcomes produced by the
actor selected

Export to Images

Exported Images

Configuring CA Identity Analytics Lab

Configuring CA Identity Analytics Lab
§ Set-up Analytics Capability
§ Define Analytics Views
§ Show analytics around salesforce.com access requests
– Provide metrics on Managers approving access
– Provide metrics on departments requesting the access
§ Will show SLA on completed transactions

Log Into CA Identity Manager Admin UI
CAdemo123
superuser

Validate / Modify ‘Create Web Services’ Admin Task
*Create Web Services*

Ensure Hide in Menus is not Selected

Ensure Web Services Configuration Exists
Should Already Exist for
CA IdG Integration

Create Web Service if it Doesn’t Exist ONLY PERFORM IF NO
WEB SERVICE
DEFINITION EXISTED

Log into the CA Identity Portal Admin UI
CAdemo123
sigma

Open Identity Portal CA IdM Connector
ONLY PERFORM IF NO
WEB SERVICE
DEFINITION EXISTED

Enter Web Service Definition to Connector
Web Services Name
Web Services URL
ONLY PERFORM IF NO
WEB SERVICE
DEFINITION EXISTED

Save Connector
ONLY PERFORM IF NO
WEB SERVICE
DEFINITION EXISTED

Enable Analytics

Open Analytics Views

Create Analytics View – Department

Create Analytics View – Manager ID

Open Entitlement Tree

Select SalesForce Target Permission

Open Analytics and Select Employee Dept.

Before You Save the Analytics Views

Ensure salesforce.com is Checked; then Save

Restart the CA Identity Manager Connector
Wait for the connector
to restart

Open Identity Portal to Test

Log into Portal
CAdemo123
danka01

Navigate to Access Catalog

Select Request for Self

Open Applications Catalog

Add CRM – salesforce.com to Cart and Checkout

Check Status of Request

Request is Pending Approval - Logout

Login as Jeff Andrews; Kara’s Manager
CAdemo123
andje01

Click on Tasks to Approve

Approve the Task and Logout

Log into Portal
CAdemo123
garan01

Navigate to Access Catalog

Select Request for Self

Open Applications Catalog

Add CRM – salesforce.com to Cart and Checkout

Check Status of Request

Request is Pending Approval - Logout

Login as Tony Belli; Anne’s Manager
CAdemo123
belto01

Click on Tasks to Approve

Approve the Task and Logout

It Takes a Few Minutes for the
Analytics to Be Rendered…

Login as Jeff Andrews; Kara’s Manager
CAdemo123
andje01

Click the Analytics Module

Type in “Sales” To Select salesforce.com

Results

Hover to See Number of Requests, then Click Analyze

Analyze Shows Breakout of Analytics Views;
then Click Workflow on Top

Workflow Shows Actor’s Interaction

What We Accomplished
§ Set-up the Analytics feature
§ Defined Analytics Views
§ Showed analytics around salesforce.com access
– Managers approving access
– Departments that had users requesting the access
§ Saw the SLA for two completed transactions

Configuring Real-Time
Decision Support Tools

Real-Time Decision Support Tools
Context Based Recommendations
§ Easy-to-use access request process
through an intuitive 'Shopping Cart‘
experience just got smarter.
§ Advice Tools such as real-time context-
based access recommendations
§ Recommendations and suggestions are
calculated and displayed
in real-time during access requests
§ Suggestions are context-based, i.e. Based
on users’ attributes, current access and
requested access

Recommendations
§ Reverse of an SoD rule; what you MAY want vs. what you
CAN’T have
§ Based on who a user is (attributes) or what a user has
(existing access privileges)
§ Dynamically calculates upon adding entitlements to shopping
cart
§ Can still be governed by approval workflows

Suggestions Configured within the Portal Admin UI

Suggestion Definition
Message that appears to the user
providing context

Which target permission(s) will be
recommended to the user

When will the suggestion be made

§ User’s attribute: based on who a user is
§ User’s Permissions: based on what a user has
§ Group: support for complex combinations of attributes and
permissions We’ll configure suggestions for
each of these in the lab

Why this is something You Should Use
§ Enable users to gain common access that may not apply to
birthright access
– Decrease entitlement clutter
§ Provide context to new users
– What do I need?
§ Complementary access to applications for increased
productivity
– Am I getting the full benefit out of an application?

Configuring Real-Time
Decision Support Tools Lab

Real-Time Decision Support Tools Lab
§ Configure User Permissions Suggestion
– Will suggest salesforce.com
– Will recommend if user has access to the CRM Application
§ Configure a Complex (Group) Suggestion
– Will suggest CA Service Management – Tier 1 Support access
– Will recommend if user is a member of the Help Desk LDAP Group, OR
– Will recommend if a user is in the IT Services Department and has
Tier 2 Support access

Log Into the CA Identity Portal Admin UI
CAdemo123
sigma

Configure Access Catalog

Suggestion Definition Page

Define Name and Message; then click Add Permissions

Scroll Down and Select salesforce.com

Click Add Condition

Select the User’s Permission Option

Scroll Down and Select CRM Application

Save the New Suggestion

Create a New Suggestion

Define Name and Message; then Click Add Permissions

Scroll Down and Select Tier 1 Support

Click Any Under when to Apply and then Add Condition

Select the Group Option; then Add Condition

Add the First Condition for the First Suggestion

Add the Second Condition for the First Suggestion

Scroll Down and Select Tier 2 Support

Add the Condition for the Second Suggestion

Define the Condition

Scroll Down and Select Help Desk Group

Save the Suggestion

Login in to Identity Portal as
CAdemo123
ferma01

Click Access; Request For Self

Existing CRM Access Presents the Recommendation
Notice she has the CRM access

Hover Over the Suggestion
Clicking here will add the access to the
shopping cart.
Will clear the suggestion.

Login as Kara Danvers
CAdemo123
danka01

Click Access; Request for Self

Existing CRM Access Presents the Recommendation
Kara has 2 recommendations, but not the
one for Service Management; she is in IT
Services, but doesn’t have Tier 2 access

Find CA Service Management

Add Tier 2 Support to the Shopping Cart
Now that she has Tier 2 access in her cart,
she satisfies both conditions for the first
recommendation critieria

Login as Greg Imaroni
CAdemo123
imagr01

Click Access; Request for Self

Greg has Help Desk Group Access
Greg satisfies the condition for the
second recommendation criteria.

What We Accomplished
§ Configured a User Permissions Suggestion
– Suggested salesforce.com based on a user’s existing entitlement:
CRM Application
§ Configured a Complex (Group) Suggestion
– Suggest CA Service Management – Tier 1 Support access based on two
different conditions;
§ If user is a member of the Help Desk LDAP Group, OR
§ If a user is in the IT Services Department and has Tier 2 Support access

Certification Campaigns
§ Simplifies and centralizes all necessary
compliance activities in one place.
§ Business entitlements catalogue simplifies
certifications
§ Risk analysis highlights risky access to:
– Enable real-time remediation
– Improve policy enforcement
– Simplify regulatory compliance
§ Easily customizable for the needs of each
role/user
Certify Users Access in a Friendly Efficient Method
CRM Customer
view
Update HR
reports
View
Billing
Reports

Table of contents
Detailed information
Personalized view
Progress bar

Table of Contents
List of all active certifications
assigned to the user.
Clicking on a campaign
expands to the list of
users

Table of Contents – Sortablility
Organizes by users
Organizes by resources / entitlements
Organizes by roles

Detailed Information

Personalized View
Metadata stored in CA Identity Governance

Identity On The GO
The Most Comprehensive Mobile Application in the Market
Request approval Password management Certification campaignsBranding Perform access requests

Mobile Experience can be Branded
The Menu will expose all
in-scope modules for the user
A subset of the in-scope modules
are displayed for the user

Mobile Access Requests
Shopping cart experience in a
mobile format

Mobile Access Approvals
Approval and implementation
workflows exposed
Approval actions: Approve, Reject,
Reserve, Reassign

Mobile Certifications
Simplified view of the entitlements

Must See Demos
Onboard
Enterprise Users
CA Identity Suite,
CA Identity Service
CA API Management
SECSE001
Enable a Hybrid
Launchpad
CA Identity Service
SECSE003
Streamline Identity
Governance
CA Identity Suite
SECSE005
Control Privileged
Access
CA Privileged Access
Manager
SECSE004

Security
For more information on Security, please visit:
http://cainc.to/EtfYyw

Stay connected at communities.ca.com
Thank you.

Pre-Con Ed (Lab): CA Identity Suite—Raising the Bar on User Productivity and System Efficiency

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (18)

Similar to Pre-Con Ed (Lab): CA Identity Suite—Raising the Bar on User Productivity and System Efficiency

Similar to Pre-Con Ed (Lab): CA Identity Suite—Raising the Bar on User Productivity and System Efficiency (20)

More from CA Technologies

More from CA Technologies (20)

Recently uploaded

Recently uploaded (20)

Pre-Con Ed (Lab): CA Identity Suite—Raising the Bar on User Productivity and System Efficiency