Introduction

ID management is the management of account information necessary for employees to use services and systems.
It has become commonplace to centrally manage all accounts used by employees for work, from logging into a PC to activating communication tools.
In this article, we will introduce Okta, an IDaaS product, in light of the changing nature of identity management.

*If you apply from "Click here for product introduction materials" at the bottom of this page, you will be able to download materials that introduce actual use cases of ID integration, so please read until the end!

What is a directory service?

Many companies use some kind of directory service to manage employee IDs.
A directory service is a service that manages various network resources such as user accounts and network-connected devices.
It is also called a directory server because it also has the ability to provide external parties with the information stored and managed by the service as a single system.
Typical directory services include Active Directory, which is stored as standard in Windows Server, and LDAP servers, and many people may use them as account management solutions.
However, the problem is that ID management using the directory server mentioned above has reached its limits.

Challenges in ID management

There are two major reasons.

②Increase in SaaS

Another factor is the increase in cloud services.
Various SaaS such as Box, Slack, and zoom are now being used for business.
In addition to account management on the directory server, account management for these SaaS services was also required. It takes a lot of time and effort to think about everything from linking accounts with accounts on the directory server, creating, changing, and abolishing SaaS accounts, and changing the granted privileges.

There are other reasons as well, such as security risks and user convenience, but to put it simply, management and operational costs are becoming difficult.

As a result, there are an increasing number of cases in which ID management and authentication are being left to other solutions rather than traditional directory services.
Introducing IDaaS (Identity as a Service).

From directory server to IDaaS

IDaaS is a cloud service that centrally manages and authenticates IDs.
This service takes over the management of ID operations that was previously performed by servers such as AD, and also serves as an authentication platform, so it is a service that can be expected to have many benefits, from improving business efficiency to strengthening security.
However, since it requires a process to transfer IDs from existing directory services, I am concerned about whether it is possible to transfer IDs from existing directory services as they are.

Therefore, in order to dispel such concerns, this time we will introduce two strengths of Okta's products, a leading IDaaS company, from the perspective of ID integration.

Advantages of Okta in Identity Integration

Okta has a variety of strengths, but the following are its strengths when it comes to identity management and integration.

① “1:N” cooperation with a wide variety of ID sources is possible

Okta can integrate from a wide range of ID sources, including directory services such as AD and LDAP mentioned above, cloud HR services such as ID management databases and SmartHR, and CSV files. Even if you have multiple identity sources, you can manage them centrally with Okta.

A major feature of Okta is the diversity of collaboration partners that goes beyond directory services.

By the way, Okta also allows you to specify ID sources on an attribute basis. For example, it is possible to customize the system by linking the user's address from AD and the work type from the human resources system.

• 【example】
  • Full-time employees are managed with AD server, and contract employees are managed with CSV.
  • Employee IDs are managed on the AD server and also managed on a separate HR system.

② Possible to integrate AD of multiple domains/forests

Okta allows AD integration for multiple domains and forests.
If you are a large company with subsidiaries or overseas corporations, you may have multiple AD domains and manage IDs for each.
If you have multiple ADs and want to centrally manage them on a directory server, you need to integrate the domains in advance, but with Okta, that work is not necessary.
If you don't need domain integration and can centrally manage IDs, you can kill two birds with one stone.

• 【example】
  • Domestic bases use a domestic AD domain, and overseas bases use a foreign AD domain.
  • Consolidate multiple AD domains separately and then unify them into a new AD domain via Okta

By now, I hope you have understood that Okta is an IDaaS that makes ID integration easy.
To give you a more concrete image, we will introduce actual use cases that fully utilize features 1 and 2 above.

Real use case: ID integration across multiple networks

In this case, there were many ID directories at each location.
The problems caused by the proliferation of directories were not only the high man-hours required to operate them, but also the lack of control, which was a huge problem in terms of governance.

That's where Okta comes in.
By implementing Okta, which can integrate from a wide variety of identity sources and even from multiple AD domains, we were able to achieve unified global identity management.
In addition, since it also creates an authentication infrastructure, it is also connected to solving issues in terms of governance.

at the end

What did you think. In this article, we introduced Okta from the perspective of ID integration.

Identity integration is just one of Okta's strengths. There are many more features such as integration with SaaS (SSO, provisioning), authentication settings for individual apps, multi-factor authentication, Workflows function, etc., and many customers switch from other IDaaS products due to its versatility and ease of use. Masu.
For more information about the Workflows feature, please read our blog.

While the importance of ID management is recognized, we often hear concerns that it is still not possible to reduce management costs and improve security.
If you have problems with ID management but don't know what to do, please contact Macnica.

\Details of the use case introduced in this article + Introducing other use cases/