Identifying needed skills and roles

 

Enterprise Identity Mapping (EIM) is designed so that a single person can easily be responsible for configuration and administration in a small organization. Or, in a larger organization, you may prefer to have a number of different individuals handle these responsibilities.

The number of people that you need on your team varies depending on the number of required skills that each team member possesses, the types of platforms involved in your EIM implementation, and how your organization prefers to divide its security roles and responsibilities.

A successful EIM implementation requires the configuration and interaction of several software products. Because each of these products requires specific skills and roles, you may choose to create an EIM implementation team that consists of people from several different disciplines, particularly if you work in a large organization.

The following information describes the skills and EIM access control authority required to implement EIM successfully. These skills are presented in terms of job titles for people who specialize in those skills. For example, a task requiring Lightweight Directory Access Protocol (LDAP) skills is referred to as a task for a Directory Server administrator.

 

Team members and their roles

The following information describes the responsibilities and required authority of the roles that are needed for managing EIM. You can use this list of roles to determine the team members that are needed to install and configure prerequisite products and to configure EIM and one or more EIM domains.

One of the first sets of roles that define is the number and type of administrators for your EIM domain. All personnel that are given EIM administrative duties and authority need to be involved in the EIM planning process as members of the EIM implementation team.

EIM administrators play an important role in your organization and have as much power as individuals that are allowed to create user identities on your systems. When they create EIM associations for user identities, they determine who can access your computer systems and what privileges they have when doing so. IBM® recommends that you give this authority to those individuals in whom you have a high level of trust based on your company's security policy.

The following table lists potential team member roles and the tasks and skills needed for configuring and managing EIM. For more detailed information about the EIM administrative tasks that each role can perform, see EIM access control.

If a single person in your organization will be responsible for all EIM configuration and administration tasks, that person should be given the role and authority of EIM administrator.

Table 1. Roles, tasks, and skills for configuring EIM
Role Authorized tasks Required skills
EIM administrator

  • Coordinating domain operations

  • Adding, removing, and changing registry definitions, EIM identifiers, and associations for user identities

  • Controller authority to the data within an EIM domain
Knowledge of the EIM administration tools
EIM identifiers administrator

  • Creating and changing EIM identifiers

  • Adding and removing administrative and source associations (cannot add or remove target associations)
Knowledge of the EIM administration tools
EIM registries administrator Managing all EIM registry definitions:

  • Adding and removing target associations (cannot add or remove source and administrative associations)

  • Updating EIM registry definitions
Knowledge of:

  • All the user registries defined to the EIM domain (such as information about user identities)

  • The EIM administration tools
EIM registry X administrator Managing a specific EIM registry definition:

  • Adding and removing target associations for a specific user registry (for example, registry X)

  • Updating a specific EIM registry definition
Knowledge of:

  • The particular user registry defined to the EIM domain (such as information about user identities)

  • The EIM administration tools
Directory server (LDAP) administrator

  • Installing and configuring a directory server (if necessary)

  • Customizing directory server configuration for EIM

  • Creating an EIM domain (see note)

  • Defining users that are authorized to access the EIM domain controller

  • Optional: Defining the first EIM administrator

    The directory server administrator can do can do everything that an EIM administrator can do.

Knowledge of:

  • Directory server installation, configuration, and customization

  • EIM administration tools
User registry administrator

  • Setting up user profiles or user identities for a specific user registry

  • Optional: Serving as an EIM registry administrator for specified user registry
Knowledge of:

  • Tools for administering the user registry

  • EIM administration tools
System programmer or System administrator Installing needed software products (may include installing EIM) Knowledge of:

  • System programming or administration skills

  • Installation procedures for the platform
Application programmer

Writing applications that use EIM APIs

Knowledge of:

After you identify which roles you want to use for configuring and managing EIM in your enterprise, you can plan an EIM domain.

 

Parent topic:

Planning Enterprise Identity Mapping for eServer