Self service account creation/management

Question

Our developers often request for new service accounts or the reset passwords on existing service accounts. 
 We automation in place via our ITSM for the creation of service accounts, but nothing in place for password resets and the process via the ITSM isn't great. 
 What would be great is if we could let people create new service accounts via the active roles self service portal, I just cannot work out how or if that is possible. We would also make the requestor the managed by so they can take care of password resets. 
 Is this possible?

Stu.Pollock · Accepted Answer

Hi jody gilbert 
 
 There are a number of options available to enable <some group of users> to be able to request the creation of an account, but depends on your use case. 
 All of them in some part relate to granting permissions to perform the desired task via Access Templates, then linking that Access Template to some OU where these service accounts should be created, granting it to some trustee (a user or group). 
 
 To enable someone to create a service account (for initial testing), I do the following: 
 1) Create a new security groups call "Allowed to create service account" (or something more inline with your naming standards 
 
 2) Add some test user account into that group (not an account which already has full ARS Admin permissions) 
 
 3) Confirm (or Create) the OU where the service accounts should be created 
 
 4) Link the Access Template "CN=Users - Create User Accounts,CN=Active Directory,CN=Access Templates,CN=Configuration" to the OU where the service account should be created, adding the "Allowed to create service account" group as the trustee 
 
 5) Also link the Access Tempalte "CN=All Objects - Read All Properties,CN=Active Directory,CN=Access Templates,CN=Configuration" to the Managed Domain where the Serviec Account OU exists, adding the "Allowed to create service account" group as the trustee 
 
 NB: the 5th entry is only required if the users don't already have access to that OU somehow, this is not least privilege, it would grant members of that group, permissions to read everything in that managed domain. But for demo purposes 
 6) For testing, open a second Active Roles Console, and log in as the test user added into your group in step 2., Then navigate to the Service Account OU, right click and choose New and User 
 
 7) Continue through the new user form and test the creation of the user

The permission granted so far, are only to create the object, not to change any of the properties. 
 As I suspect you don't want everyone in the "Allowed to create service account" to bew able to change things (like passwords) against any service account in that OU, you're not going to want to grant permissions to the "Allowed to create service account" group. Instead if as part of creation, you set the Managed By attribute to be the creating person or someone set as part of the creation. You can grant for example 
 Link the Access Template "CN=Users - Help Desk,CN=Active Directory,CN=Access Templates,CN=Configuration" to the active roles well known principal "Manager" and apply against your service accounts OU. Then as long as the service account has a manager attribute assigned against it, the user listed as the manager will be able to perform whatever tasks against objects they own as granted by the users - help desk access template, in this case it would be "Reset user passwords, unlock user accounts, assign or remove digital (X.509) certificates from user accounts, view all properties of user accounts." 
 
 Then if you got back into the console where you logged on as the test user, and re-connect, when you right click the service account, you'll get a different set of options than before (including reset password)

Self service account creation/management

Top Replies