IAM Solution
Improve security and governance with proper identity management
Integrated application-speciﬁc authentication for single sign-on※IAM： Identity & Access Management

Service Overview
・Identity Management：Centralized management of authentication and authorization information through a company-wideplatform. In addition, by centrally controlling workﬂows such as ID submission and approval, we properly manage the ID lifecycle
and strongly support governance, including auditing.
・Integrated authentication：Hybrid single sign-on (SSO) to on-premises systems and public clouds by building an integratedfoundation for authentication of multiple applications.

Application
On-premises

Cloud service

Office365

Web system

Provisioning

Identity verification

Provisioning

Identity
Management

ActiveDirectory

UserInformation❷ID Provisioning❶Single sign-on❷Support for multiple authentication methods

Audit❸Strengthening GovernanceSingle sign-on

Integrated
authentication

User
Information

Provisioning❶Identity Lifecycle Managementetc...

salesforce

Client server system

Operationlog

Authentication
log❸audit response
Flow of authentication

Human Resources
information

ID application

ID Approval

HumanResources DBUser

Authorizer

Authentication

AuditorUserFlow of ID/Authority (ID Provisioning）

Authentication device(Veins/Fingerprints/IC cards, etc.)● Identity Management
Feature１

Identity Lifecycle Management

・Deﬁne the ID lifecycle submission and approval process as a
workﬂow to manage responsibilities within the workﬂow.
Feature2

ID provisioning

・In cooperation with the Human Resources DB, in addition to "ID","Permissions (Role)" according to the organization and job title areautomatically linked to the necessary application/AD/integrated
authentication infrastructure.

Feature3

Strengthening governance・It is also possible to automatically grant access authority (segregationof duties) to the ID according to the organization to which the user
belongs.
・Reconciliation (Identity management and identity/access authority
matching between AD/applications) can be done manually or
automatically, and if differences are extracted, they can be corrected
immediately.
・Manage logs of who has access to what applications, when, whocreated, modiﬁed, and deleted what identities for efﬁcient audit
response.

● Integrated authentication
Feature１Single sign-on

・It offers hybrid SSO capabilities across both on-premise and public
clouds to enable single sign-on regardless of the application
environment you want to use.
・Single sign-on eliminates the need to establish authentication policies
such as password assignment rules for individual applications.
・You can reduce licensing costs by arranging products to be deployedaccording to the type of application you want to use (Web/client-server/public cloud).

Feature2

Support for multiple authentication methods

・It supports various authentication methods such as IC card/PIN
code/one-time password/ﬁngerprint/biometric authentication
using a vein, and provides an authentication mechanism that meets
security requirements.
Feature3

Audit response・Log who logged in, when, and to which applications for
efﬁcient audit response.

Usage Image
Ensure consistency of user accounts from HR DB to system
An integrated identity repository that synchronizes with various human resources databases applies responsibility-based accesspolicies to accurately update user account information for various systems and services on premises and in the public cloud.
Ensure consistency of user accounts from HR DB to systemResources
Resourcesa unified
Enforce role-based
1 Human
2 Human3 Building
5 Responsibility
DBDB lookup andidentity repository 4 access policies
based accesssynchronization

management

IAM IdentityRepository

Regular employee
Human Resources
DB・Regular employee
・Temporary employee
・Employees of affiliatedAD domain

companies

Temporary employee
Human Resources
DBWindows

・Regular employee
・Temporary employee

On-premises
systemUnified repository
・Regular employee
・Employees of affiliatedHuman Resources
DB of affiliatedcompanies

companies

RBAC Model

Source forauthentication

Security Policy

Responsibility-based
access management(original text)

Public cloudservices and systems

Single sign-on via web portal, enhanced control over access to web applications
Enables single sign-on with agentless support for a variety of authentication methods from a variety of terminal web portals,
enabling integrated access management to public cloud, on-premise services, and systems without application changes.
Services in the cloud

SaaS apps

SSO userauthentication

Audit
audit log

httpsSSLSSL

Audit log

SSO and accessmanagement

Web portal

ACLDirectory

Supports diverseauthentication types

Information system

WebWebWeb

Backbone system

WebWebWeb(No Agent)On-premises system

Web Access Manager

No application
changes required＊Evidian is a registered trademark of Eviden.
＊The contents of the products and services are subject to change without notice.
＊“SmartCloud (Smart Cloud)”and the “SmartCloud” logo are registered trademarks of NTT COMWARE CORPORATION in Japan.
＊Active directory and Oﬃce365 are registered trademarks of Microsoft, its subsidiaries and aﬃliates in the United States and other countries.
＊Other company names and product names may be trademarks or registered trademarks of their respective companies.

1-9-1 Kounan,Minato-ku, Tokyo 108-8019 Japan
https://www.nttcom.co.jp/english/2023.11V5.2.0