Identity Governance Suite with Organization-Specific Soft-Lockout Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in managing user access and enforcing governance controls due to the lack of a unified identity governance suite, leading to increased complexity and costs, as well as inadequate auditing capabilities, particularly with SPML requests originating from a single proxy account.
Innovation Solution
Implementing a unified identity governance suite with features like organization-specific soft-lockout policies, a uniform interface for heterogeneous account state repositories, and propagating real user identities in SPML calls to enhance auditing accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single proxy account is used for all SPML requests, then system complexity is reduced and authentication is simplified, but auditing accuracy deteriorates because the real user identity cannot be tracked
Solution Approach 1:
The patent introduces an intermediary mechanism that passes the real user identity through the proxy account authentication process. The identity management system extracts the authenticator from the SPML request and propagates it through the provisioning workflow, enabling accurate auditing while maintaining the simplified single-proxy authentication model.
2Adaptability or versatility
If multiple vendor products are implemented as point solutions, then specific governance needs are addressed, but system complexity and integration costs increase
Solution Approach 1:
The patent merges provisioning, privileged access management, role management, and compliance functions into a unified identity governance suite from a single vendor. This consolidation eliminates the need for multiple point solutions and reduces integration complexity while maintaining comprehensive governance capabilities.
Solution Approach 2:
The identity management system provides universal functionality that handles multiple governance tasks through a single platform. The system can perform provisioning, access management, role assignment, and auditing through integrated workflows, reducing the need for separate specialized products.
3Adaptability or versatility
If organization-specific soft-lockout policies are implemented, then security behavior can be customized per organization, but policy management complexity increases
Solution Approach 1:
The patent applies local quality by allowing different soft-lockout policies for different organizations within the identity management system. Each organization can have customized security behaviors such as different lockout durations or attempt thresholds, while the system manages this diversity through centralized policy configuration.
Data Source
AI summary
Different types of soft-lockout policies can be associated with different organizations (or groups) in an identity management system. Each soft-lockout policy can indicate different parameters such as a number of login attempts allowed and an amount of time that a user account will be locked-out if the maximum allowed attempts are exceeded unsuccessfully. Users can be associated with the different organizations. For each user, the soft-lockout policies for the organization with which that user is associated are applied to that user when that user attempts to log in. Thus, different groups of users can be handled with different security behaviors regarding unsuccessful login attempts. If, for example, a user were to become moved from one organization to another, then the soft-lockout policies associated with the user's new organization would become applicable to that user.