System and method for provisioning resources to users based on policies, roles, organizational information, and attributes

• US 20020147801A1
• Filed: 01/29/2001
• Published: 10/10/2002
• Est. Priority Date: 01/29/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bohren, Jeffrey S., Gullotta, Tony J., Chen, Liangtong, Curie, Jeffrey C.
• Granted Patent: US 6,947,989 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for provisioning users with resources is disclosed. The method includes the steps of establishing a set of attributes, organizational information, and user roles, and defining a plurality of resource provisioning policies based on selected attributes and user roles. The method also includes the steps of receiving attribute information, organizational information, and user role information for a particular user or resource, determining which resource access policies are applicable to the user based on the received user role information and attribute information, and provisioning the user with resources based on the applicable resource access policies. The resources to be provisioned include “hard” resources as well as “soft” resources. “Soft” resources may include e-mail and voice mail accounts, application programs, databases, files, folders, the Internet, Web pages, organizational Intranets, messages to third parties, digital certificates , the capability to purchase products over the Internet, the ability to order a corporate credit card, access to financial services providers, and the like. In addition, users may be provisioned with “hard” resources such as telephones, computers, cellular telephones, pagers, personal digital assistants, desks, chairs, file cabinets, other physical components, and the like. In addition, a user may be provisioned with resource bundles, which a resources that are comprised of other resources.

Claims

1. A method for provisioning users with resources, the method comprising the steps of:

establishing a set of attributes, organizational information, and user roles;

defining a plurality of resource provisioning policies based on selected attributes, organizational information, and user roles;

receiving attribute information, organizational information, and user role information for a particular user, resource, or database;

determining which resource provisioning policies are applicable to the user based on the received user role information, organizational information, and attribute information; and

provisioning the user with resources based on the applicable resource provisioning policies.

2. A method as recited in claim 1, the user roles comprising a yes value and a no value, the attributes comprising multiple non-binary values.

3. A method as recited in claim 2, further including the step of reconciling resources by comparing resources currently provisioned to the user with a list of resources that should be provisioned to the user based on the applicable resource access policies, and identifying any differences.

4. A method as recited in claim 3, further including the step provisioning or de-provisioning resources to the user based on the differences detected by reconciliation.

5. A method as recited in claim 2, further including the step of de-provisioning the user with some or all of the user'"'"'s allocated resources if the user is terminated, suspended, or placed on leave.

6. A method as recited in claim 2, further including the steps of:

receiving timing information related to the timing of the provisioning or resources; and

provisioning the user with resources at a certain time specified by the timing information.

7. A method as recited in claim 2, the attributes comprising user attributes and resource attributes.

8. A method as recited in claim 2, further including the step of provisioning the user with “

hard”

resources and “

soft”

resources.

9. A method as recited in claim 2, further including the step of provisioning the user with resource bundles.

10. A method as recited in claim 2, further including the step of defining a plurality of resource provisioning policies utilizing decision statements that allow irrelevant steps to be bypassed.

11. A method as recited in claim 2, the step of provisioning the user with resources comprising communicating requests for the resources to applications or persons.

13. A system as recited in claim 12, the user roles having a yes value and a no value, the attributes comprising multiple non-binary values.

14. A system as recited in claim 13, the one or more processors further programmed for reconciling resources by comparing resources currently provisioned to the user with a list of resources that should be provisioned to the user based on the applicable resource provisioning policies, and identifying any differences.

15. A system as recited in claim 14, the one or more processors further programmed for provisioning or de-provisioning resources to the user based on the differences detected by reconciliation.

16. A system as recited in claim 13, the one or more processors further programmed for de-provisioning the user with some or all of the user'"'"'s allocated resources if the user is terminated, suspended, or placed on leave.

17. A system as recited in claim 13, the one or more processors further programmed for:

receiving timing information related to the timing of the provisioning or resources; and

provisioning the user with resources at a certain time specified by the timing information.

18. A system as recited in claim 13, the attributes comprising user attributes and resource attributes.

19. A system as recited in claim 13, wherein the user may be provisioned with “

hard”

resources and “

soft”

resources.

20. A system as recited in claim 13, wherein the user is provisioned with resource bundles.

21. A system as recited in claim 13, the plurality of resource provisioning policies utilizing decision statements that allow irrelevant steps to be bypassed.

12. A system for provisioning users with resources, the system comprising:

memory for storing a set of attributes, organizational information, and user roles, a plurality of resource provisioning policies based on selected attributes, organizational information, and user roles, and attribute information and user role information for a particular user or resource; and

one or more processors coupled to the memory and an organizational network, the processors programmed for

determining which resource provisioning policies are applicable to a particular user based on the stored user role information, organizational information, and attribute information, and

provisioning the user with resources based on the applicable resource provisioning policies.