One Identity Active Roles for Delegation

The heart of Active Roles are its Access Templates. We've solved a problem that Microsoft created when they built Active Directory in the first place. And that is it's difficult to give permissions in Active Directory, set everything up, and do what you need to do without constantly having to make changes and watch what's going on and making sure that things aren't being changed in ways that they shouldn't be. So let's take a look at how that's done in Active Roles. In Active Roles, as I said, we have something called Access Templates. An Access Template is like a bucket of rights. It tells its system what rights to give a particular group or person. And then we decide where we want to apply those rights. Let me show you. Here, I've created some Access Templates. First, I have an Access Template for my helpdesk Level 1. These are my more junior helpdesk people. They answer the calls and things like that. When I open up this template, we can take a look at the rights that are given. And you can see here that I have a whole litany of rights. And this is kind of hard to read. In order to make that easier inside of Active Roles, we've created a bunch of default templates that you can use. And you can see them here as I kind of scroll through them, all by different types of objects in Active Directory and different rights and permissions and whatnot. So again, to make that easier, we can take those templates and just build them into this template. As you can see, I have quite a few in here. Incidentally, we can be extremely granular in how we delegate permissions in Active Roles. The Reset Password template, for example, actually only allows the person to reset a password, but it does not allow them, unless you change it, to do things like turning off require password change. So we can be extremely granular, much more so than Microsoft can out of the box. Let's take a look at how they're applied. Here, we can see that a group in AD called Helpdesk has the Access Template helpdesk level 1 over my group's OU, my user's OU, and my employee's OU. Clean and simple. Since Active Roles is what we call a zero sum up security model, I don't need to worry about default rights that are given in AD or anything like that. You have no rights in Active Roles unless you've explicitly granted them. And here, you can see I've granted this set of rights to this group over these OUs. But then I have a more experienced helpdesk group. I want to give them more rights over what they do in AD. Well, gosh, now, I've got to start all over again and regrant those rights. No. No, I don't. What I can do is I can go into the template itself. And I can nest the helpdesk level 1 rights into the helpdesk level 2 template and then add whatever additional rights I want to add. Then, all I do is say, OK, I want my helpdesk level 2 group to have the helpdesk level 2 access template over whatever OUs I choose. Simple and easy. And now, anytime I change the helpdesk level 1 template, all the rights on the helpdesk level 2 template move with it. And incidentally, that goes kind of across the board. So if I change an Access Template, the rights that are granted the Access Template change in real time over those locations. I don't have to go in and undelegate rights and redelegate rights and make things complicated and difficult to see. Just so you can get a little sense of how this works, I can go over here and I can take a look and see all the rights that are granted over my employee's OU here inside of Active Directory. If I had to look at this in native AD, it would look something like this. In fact, it would look exactly like this. Good luck finding what you're looking for, and good luck passing an audit with this, when you can much more easily just look at it and see who has those rights. And you can see, for example, here are the two that we were discussing earlier. Now, Active Roles will give different people different rights and show different things to different users depending on what rights they have. You can see here that I'm logged in as a user administrator. So you can see that I have lots of rights to do all kinds of different things, all the way down to, oh, gosh, changing really deep level things about the user and provisioning them in SAS systems and whatnot. Here, I'm logged in as a helpdesk user. And you can see, I have a lot fewer rights over this user account itself. And I can pick and choose inactive roles how I want all that to work.