Hi Madhu,
If you are looking at integrating SAP IDM with GRC, there is a standard provisioning framework which you can use. In order to know how to configure this, refer to the corresponding configuration guide here and also the documents/blogs mentioned by Matt in his reply post.
If you are using any other Identity Management solution other than SAP, then it depends on how you are going to design your integration framework.
In a nutshell, its like what you have mentioned.
Initiate Request in IDM -> Passes Request Parameters to GRC Webservice -> GRC web service processes and sends back the response [Success/Failure]
But, its up to you to decide how to initiate request from your IDM solution and how to handle the complete Access Control process. Say in SAP IDM, when integrated with GRC, a role assignment request is submitted in IDM, SAP IDM sets a pending value on the request, then triggers the GRC provisioning framework, which using Virtual directory server communicates with SAP GRC and submits the request for Risk analysis. Once the risk analysis request is submitted, based on the result handling(event based/polling) configuration, SAP IDM receives the status/response of the request.
Based on the response received SAP IDM applies the pending on the assignment, after which the SAP Provisioning framework does the provisioning.
The above scenario I am explaining is based on the Centralized provisioning configuration where only the risk analysis is done on the GRC side.
So, in the case of other Identity Management products, I am not sure how the provisioning framework is built and how the requests are held in pending state till the response is received from SAP GRC after the request is submitted.
Probably you need to discuss with your IDM guys and understand how it works in Identity Management product you are using. Some sort of custom connectors / customization is required on the IDM product side.
I would suggest the following way.
1. Submit the role assignment from IDM.
2. IDM checks whether the requested role requires Risk Analysis or not !!
3. If Risk analysis is not required, your IDM solution directly processes the assignment requested and user is assigned with role.
4. If Risk analysis is required for the role, trigger your custom GRC integration framework which calls the Submit User Access Request Web Service – GRAC_USER_ACCESS_WS
5. In the above step, the request is submitted to GRC system.
6. After the request is submitted, you have to probably call Request Status Web Service – GRAC_REQUEST_STATUS_WS to know the status of the request.
7. Once the status of the request is received by IDM, provision accordingly.
You can refer to the document SAP Access Control 10.0 Interface for Identity Management for more information.
All the best !!
~Krishna
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.