IDENTIFYING ROLES WITH SIMILAR MEMBERSHIP AND ENTITLEMENT INFORMATION

摘要

Techniques are disclosed for identifying roles with similar membership and/or entitlement information in an identity management system of an enterprise. A role defined in an identity management system may be associated with membership information and entitlement information. The membership information may identify one or more members who has been assigned the role. The entitlement information may determine how members of the role can interact with a target system within the enterprise. The entitlement information may include a list of actions that members of the role can perform on the target system. Embodiments allow for identifying roles that have similar membership and/or entitlement information. If an existing role already gives similar entitlement(s) to similar member(s), the role may be prevented from being created. Thus, embodiments prevent creating and maintaining redundant roles.

主权项

1. A system comprising:
one or more processors; and a memory coupled with and readable by the one or more processors, the memory configured to store a set of instructions which, when executed by the one or more processors, cause the one or more processors to:
determine, responsive to a triggering event, membership information associated with a first role, wherein the membership information associated with the first role identifies a set of one or more members of the first role;determine a plurality of roles configured for a set of target systems, the plurality of roles not including the first role;for each role in the plurality of roles:
determine a set of one or more members for the role in the plurality of roles; anddetermine a similarity score for the role in the plurality of roles based upon the set of members of the first role and the set of members of the role in the plurality of roles;determine at least a second role from the plurality of roles based upon the similarity scores determined for the roles in the plurality of roles; andoutput information related to at least the second role.