The Employer Perspective of Managing Access to Federated Systems and the Need for an Ontological Approach

Identification, authentication, and authorization (IAA) play a significant role in federated identity management for disparate information systems (IS) within an organization. Although all three components are vital to system access control processes and help minimize unauthorized access to resources, authorization is the most cumbersome and time-consuming process (relative to identification and authentication) in many organizations today. However, most prior studies focus on the user perspective and only address authentication issues (e.g., single sign-on). In order to fill a gap in the literature, our work studies the organizational perspective of managing IS access and aims to address the issues associated with managing the authorization process. In doing so, we develop an ontology-based design artifact, called Onto-IAA, describing how disparate IS perform authorization natively. Via this ontology, organizations can significantly reduce the effort required to manage the authorization processes. Onto-IAA operationalization is demonstrated for two real IS, and its utility is evaluated using an observational approach in a global retail chain with approximately 25 disparate IS and over 5000 employees. Additionally, the experimental approach is used to test its effectiveness to control access to other IS, which are not utilized to “train” or develop the ontological model.