5 ms·
- Use 1Password or similar password vault to deliver account passwords on day one; the password manager also promotes good personal password management practice
by jitl 2y ago
- Use 1Password or similar password vault to deliver account passwords on day one; the password manager also promotes good personal password management practices
- only share passwords for personal accounts; those accounts you terminate when the employee separates. For shared resources, use SSO and SCIM group management via the SSO provider to add and remove accounts from groups with different roles.
Rippling seems like a neat offering because they bundle SSO with HR people management, and their HR product is the best I’ve used as an employee - hopefully the administrative side is just as good or better.
If those SaaS tools aren’t in your budget, try looking for open-source or gratis alternatives with the same shape, or repurposing whatever IT infra you have to implement a similar model.
- theogravity 2y agoWe use 1Password at our company and it works extremely well. We also use opal for dynamic access to things like AWS or our DB service where a temp user with a specific IAM role / temp db user / pass is created for that user's session. For higher level access, someone would approve the request before credentials are generated. https://opal.dev/ https://opal.dev/
- egamirorrim 2y agoOOI do you ever use SCIM for something really granular? I have a service where people can be one of 5 roles and then have access to 1..30 named 'workspaces' - all that we'd like to control with policy on our side not vendor side I think it's unsuitable for SCIM because I'd have to create 5*30 AD groups?
- jitl 2y agoUsers can be in more than one group right? Or they might have a different role per workspace?
- deltaknight 2y agoHonestly I’ve worked in places with many 1000s of AD groups. At some point, that’s just what fine grained access control means, I’m not sure there’s much point in trying to prematurely optimise for fewer groups. Of course, if there’s a way to simplify the access (like are there truly 5 roles or in practice do people end up bucketed in to 2/3), or if you can configure one role group with the user is always in and group per workspace that’s always ideal, but that might well come back to bite you.
- icansearch 2y agoI wouldn't want HR in charge of my secrets management in any way shape or form. Happy to have a level of group synchronisation out of HR's systems, but certainly would not give them the ability to manage the high-power users.
- robertlagrant 2y agoHR might be a more suitable place to decide who is in what role than IT is, though?
- meerita 2y agoI love 1Password. I use it personally, but at company level we use another.