Symantec Identity Governance and Administration Reviews

Identity Policy and its Ability to support Account Provisioning to RACF and AD/Exchange.

This solution was implemented for a Financial Client to automate account provisioning across various disparate systems (more than 80 systems across 5 countries). From an HR perspective, when an employee leaves the organisation, suspension, transfer and removal of access to systems can be completed within 7 days in comparison to up to 30 days when handling it manually. Access to system(s) can now be approved and granted within 3 working days going through a self-service application and approval process.

Lack of a comprehensive attestation component/product and easy to use workflow that supports both attestation and provisioning. However, currently CA does have a product for attestation.

3 years

Main issues were with migration of data from a 8.x to 12.5 sp2.

No stability issues.

No scalability issues

7/10

8/10

No previous solution used.

Initial Setup is considered straightforward due to its wizard based installation. However, it is complicated due to HA requirements.

Compilation of data for Attestation manually may take 3-6 months or more if the organisation has large number of assets distributed across several countries. The need to maintain up-to-date access list on every asset also poses a challenge.

We use the private cloud deployment model of this solution. 

Word mining and risk campaigns are the most valuable features of this solution.

I would like to have differential campaigns. In the next release, there should be the provisioning of your certifications. When you remove access or grant extra access to someone, it would be good to have direct provisioning to different sources.

It's stable and runs well. 

Technical support is good and efficient. 

The initial setup was easy. Sometimes upgrades are a little bit complex. There are many components where you have to apply a patch to each component of the solution. For the installation, I would say it's a little bit complex. It's a little bit complex to set up but when it's okay, it runs fine.

My advice to someone implementing this solution is to take a few days to plan with professional services for the setup. 

I would rate it between a six and seven out of ten. Not a ten because of the complex setup and because we had some issues applying some patches. 

• Self-service
• Role-based provisioning
• Access

It's saved on administration time, and reduced the wait time for access. It's also improved our compliance.

• Installation and upgrading is complex
• User Interface

I've used it for six years.

We did have some issues, but we were able to resolve them.

Yes, as Jboss cannot handle too much load.

Yes, when feeding many users.

It's good.

It's very good.

No previous solution was used.

It was complex because many servers are needed to follow best practice. Many manual steps are time consuming. If you add the Governance component for full IAG, it will be even more complex, because it is not properly integrated with IdM but more a separate product.

We used a vendor team who had a high level of experience.

We also looked at options from IBM and Oracle.

You should use a vendor team for the design and initial implementation.

Provisioning. It has performed well.

It has been good to keep zero day. We have almost zero day provisioning, where the user shows up on the first day of work and he has the necessary access, birthright roles, and such. Therefore, there has been good, internal performance improvement and user experience.

It has good endpoint support and endpoint connectivity to different versioning endpoints.

Identity Manager has a lack of entitlement support, unlike other products that I have worked with. Other products have a focus on the entitlement that a user has, where you can pick and choose access as an entitlement, and add it to the user or remove from the user. With CA it is all role-based, that is kind of a sticking point with me, so we have to work around that.

It is pretty good. Relatively stable. We have definitely had some downtime, but overall it is good.

We just have a two node cluster, so we have not really scaled. However, I imagine it is easy enough to scale those nodes, so it is scalable since it is a clustered app.

Technical support is great.

The initial setup was very complex. The product is just basically a conglomerate of a bunch of other products that were bought and pieced together. So it is still my one main gripe of Identity Manager. It is too many moving pieces; too many parts that were kind of stuck together. It makes it very complex. 10 servers and 10 different apps running to make it happen, and it is only getting worse now that Identity Plural is on top, which is supposed to be making it better, but we will cross that bridge sometime next year.

Policy Xpress makes modifications to how our user data is handled so easy.

This product has allowed me to take the repetitive tasks away from a person so the value of a person is better.

An out of the box way to control when a policy executes.

Five years.

No, not after someone explained a way to use Screen Logical Attributes to control the execution of policies.

No issues encountered.

No issues encountered.

I love their customer service.

I'd rate them 10/10. I have my go to techs.

We didn't have a solution previously.

Identity managment is a complex animal no matter what product you use.

We used a vendor team who I would rate as 10/10.

Look at training from the vendor not just their perfect scenarios but real world issues. Make sure your users have the skills needed to manage the product.

Extremely good customization possible with respect to local language support.

In our environment we have build separate environments and roles structures based on language and look and feel for their products.

4 years.

Only minor issues.

Sometimes, earlier only due to lack of RAM. Now it's stable most often.

Haven't faced any so far.

8 out of 10.

7 out of 10.

It was a little complex.

No other options evaluated.

Perform a pre-implementation analysis as to what level you would like to implement the solution (only role mapping/provisioning/AD sync etc) and to how it can meet your needs.

• User provisioning
• Web services

Enabled enhanced delegated control to application owners and third party support reducing overhead cost to support desk and directory services teams

GUI/Web interface

10+ years.

Numerous. Despite having a Linux/JBOSS version it does not perform at the same level of proficiency as Windows/.NET.

Yes

No

9 out of 10.

7 out of 10,

Complex, documentation was inadequate as was professional services.

Combination, and experience for professional services was less than adequate.

We evaluated Novell and Oracle as well, and for our needs this was still the best solution.

Be prepared for issues with the web interface and avoid heavy customization.

• Group management
• Task delegation
• Access granularity

It allowed local departments to manage the people in their own groups, without any help from the IT department.

Better recovery for the application server with the DB connectivity.

Two years.

Yes, at some point CA support repaired the bug.

Yes, sometimes the connection with the DB is lost, and it isn't fully recovered without restarting the server.

No issues encountered.

7/10.

7/10.

No previous solution used.

I think it depends on your background, but as soon as you understand the terminology it's not so complex.

We did an in-house implementation.

Engineering and operational.

Do a good gathering of your requirements and make sure you are creating the system architecture it in the right way.