Configuration for MySQL integration operations

The base setup of the MySQL integration enables successful data aggregation in accordance with the defined integration data schema. The collected and normalized MySQL integration data is presented in two perspectives: the account, resource and entitlement catalogue of the MySQL integration and the Analytics warehouse. Both allow users to perform access auditing and data analysis.

To support workflow automation, provisioning and reconciliation, additional integration configuration is required, including:

  • Identity lifecycle management
  • Access control and account administration
  • Automated access provisioning for onboarding/reinstatement scenarios
  • Automated access termination for offboarding scenarios
  • Other custom integration operations

Identity lifecycle management

To correctly identify the identity owner of an account created directly on the MySQL target system, and to determine the account type for subsequent access governance processes, at least the following rules must be configured:

  • A Correlation Rule, which automatically assigns an account owner during the data aggregation process.
  • A Customization Rule, which determines the account type based on the agreed account naming convention.

Correlation Rule Code Sample

var account = readOnlyAccess360DbContext.Accounts
    .Where(x => x.IntegrationId == integrationId && x.Id == accountId && !x.Terminated)
    .SingleOrDefault();

if (account is not null)
{
    if (account.Name.StartsWith("adm_"))
    {	
        var accountPrincipal = account.Name
			.Substring(1)
			.Replace("adm_", string.Empty)
			.Replace("tmp_", string.Empty)
            .Replace("_dev", string.Empty)
            .Replace("'@'%'", string.Empty);
			
		accountPrincipal = string.Concat(accountPrincipal
			.Select(x => Char.IsUpper(x) 
				&& accountPrincipal.IndexOf(x) != 0 
					? " " + x 
					: x.ToString()))
			.TrimStart(' ');

        if (!string.IsNullOrEmpty(accountPrincipal))
        {
            var ownerIdentityId = readOnlyAccess360DbContext.Identities
                .Where(x => x.Name == accountPrincipal && !x.Terminated)
                .Select(x => x.Id)
                .SingleOrDefault();

            if (ownerIdentityId != default)
            {
                return new(ownerIdentityId, OwnerType.Identity);
            }
        } 
    }
}

return null;

Customization Rule Code Sample



var account = readOnlyAccess360DbContext.Accounts
    .Where(x => x.IntegrationId == integrationId && x.Id == accountId && !x.Terminated)
    .SingleOrDefault();

if (account is not null)
{
    if (account.Name.StartsWith("adm_"))
    {
        var accountPrincipal = account.Name
			.Substring(1)
			.Replace("adm_", string.Empty)
			.Replace("tmp_", string.Empty)
            .Replace("_dev", string.Empty)
            .Replace("'@'%'", string.Empty);

		var isAdmin = account.Name.StartsWith("'adm_");
		var isTemporary = account.Name.StartsWith("'tmp_");
		
		accountPrincipal = string.Concat(accountPrincipal
			.Select(x => Char.IsUpper(x) 
				&& accountPrincipal.IndexOf(x) != 0 
					? " " + x 
					: x.ToString()))
			.TrimStart(' ');

        if (!string.IsNullOrEmpty(accountPrincipal))
        {
            var ownerIdentityId = readOnlyAccess360DbContext.Identities
                .Where(x => x.Name == accountPrincipal && !x.Terminated)
                .Select(x => x.Id)
                .SingleOrDefault();

            if (ownerIdentityId != default)
            {
				if(isAdmin)
				{
					return (AccountType.Privileged, null, null, null);
				}
				else if(isTemporary)
				{
					return (AccountType.Temporary, null, null, null);
				}
				
				return (AccountType.User, null, null, null);
            }
        } 
    }
}

return (AccountType.Orphan, null, null, null);

Access control and account administration

Configuration of MySQL provisioning rules is required for account creation and for updating additional account properties. Each provisioning rule defines the value of a specific additional account property.

Some properties are mandatory at account creation, while others are optional. Provisioning rules for mandatory properties must be configured to enable successful account creation. Provisioning rules for optional properties may be configured as needed.

For MySQL account creation, the provisioning rule that defines the account name must comply with MySQL requirements, according to which an account identifier consists of two parts: the user name and the host, separated by the @ symbol, see an example of the account on the figure below and a rule code sample. This rule is required to ensure successful account creation. However, when authenticating to MySQL using the created account, only the user name (the portion preceding the @ symbol) should typically be used.

MySQL account example created via ObserveIDMySQL account example created via ObserveID

var identityName = identity.Name;
              
if (identityName.Contains("@")) 
{
identityName = identityName.Substring(0, identityName.IndexOf("@"));
}
                
identityName = identityName.Replace(" ", "");
                
if (accountType == AccountType.Temporary) identityName = "tmp_" + identityName;
if (accountType == AccountType.Privileged) identityName = "adm_" + identityName;
if (accountType == AccountType.Firecall) identityName = "adm_s_" + identityName;
                
var devPostfix = "_test";
var maxUsernameLength = (32 - devPostfix.Length);
identityName = identityName.Length > maxUsernameLength ? identityName.Substring(0, maxUsernameLength) : identityName;
identityName = identityName + devPostfix;
               
return $"'{identityName}'@'%'";

Automated access provisioning for onboarding/reinstatement scenarios

To enable automated provisioning of MySQL access during identity onboarding or reinstatement, corresponding birthright roles must be defined with the required MySQL access assignments. This ensures that new identities are provisioned with accounts that include the specified MySQL entitlements.

For existing identities, any reconciliation of MySQL access is performed through an Identity Update request, in full alignment with the applicable birthright role assignment rule, which can be coded in C# or configured with the filters.

Automated access termination for offboarding scenarios

The Leaver Rule of the MySQL integration does not impose predefined constraints and allows administrators to define the approach for handling MySQL accounts when an identity is offboarded. The following Account Termination Behavior options are available:

  • .LockAndRemoveAllEntitlements - removes assigned entitlements and then locks the MySQL account.
  • .Delete - deletes the MySQL account.
  • .Lock - locks the MySQL account.
  • .TransferOwnership - transfers ownership of the MySQL account to another identity.
  • .DoNothing - leaves the MySQL account unchanged.

A sample implementation of the Leaver Rule is provided below. To switch between termination options, set the required value for the AccountTerminationBehavior. object.

return (AccountTerminationBehavior.Delete, null, null);

Custom Integration Operations

Upon request, the MySQL integration can be extended with custom operations implemented on an ad hoc basis and tailored to the specific needs of an organization. This enables the creation of customized functional capabilities designed to meet unique business requirements.