Network Access Request (NAR) User Reference Guide · · 2018-01-04Identity & Access Management NAR User Reference Guide Version January 2018 Page 1 of 78 Network Access Request

Identity & Access Management NAR User Reference Guide

Version January 2018 Page 1 of 78

Network Access Request (NAR) User Reference Guide

1. How to Use this Guide Before you begin, please review sections 2 – 4 before submitting a NAR request to make sure you are using the right process the right way. The Table of Contents can help you quickly find the information and process steps you are looking for. Hover over the topic, hold down the Ctrl key, left click your mouse and you’ll jump to that content.

Please note:

If you access the Identity & Access Management (IAM) system from outside an AHS facility, you will be required to enter your SecurID token information.

Please note:

The Identity & Access Management (IAM) system should not be used for staff / personnel of Clinical Research / Trials. Additional details are available in the Usage Guidelines.

Please note:

Information displayed in the text and screen diagrams is fictitious and for the purposes of training only.

Table of Contents

1. How to Use this Guide ............................................................................................................................ 1 2. What are the Network Access Request (NAR) workflows used for? ................................................. 3

AHS Network Access .................................................................................................................................... 3 Shared Directory Folders .............................................................................................................................. 3

3. IAM Definitions ........................................................................................................................................ 3

AHS Employees ............................................................................................................................................ 3 AHS Non-Employees .................................................................................................................................... 3 Community .................................................................................................................................................... 3 Combination .................................................................................................................................................. 3

4. Role Information ..................................................................................................................................... 4

NAR Requester .......................................................................................................................................................... 4

NAR Requester steps at a glance ................................................................................................................. 4

NAR Approver ............................................................................................................................................................ 4

NAR Approver steps at a glance ................................................................................................................... 5

5. How do I request a new AHS network account? .................................................................................. 6

5.1 NAR Requester Steps ................................................................................................................................... 6 5.2 NAR Approver Steps ................................................................................................................................... 15

6. How do I add AHS network access to a user’s existing IAM account? ........................................... 18

6.1 NAR Requester Steps ................................................................................................................................. 18 6.2 NAR Approver Steps ................................................................................................................................... 23

7. How do I set email preferences on a user’s existing IAM account? ................................................ 26

http://www.albertanetcare.ca/learningcentre/documents/tms-it-iam-usageguidelines.pdf




8. How do I modify personal details on a user’s existing IAM account? ............................................. 34


9. How do I perform a Standard Termination request for an AHS Non-Employee? ........................... 42

9.1 NAR Approver Steps Only .......................................................................................................................... 42

10. How do I perform an Emergency Termination for an AHS Employee or AHS Non-Employee? .... 47


11. How do I request the reactivation of a network account? ................................................................ 51


12. How do I request the creation of a new Shared Directory Folder? .................................................. 57


13. How do I request access to an existing Shared Directory Folder? .................................................. 66


14. How do I remove access to an existing Shared Directory Folder? .................................................. 73




2. What are the Network Access Request (NAR) workflows used for?

AHS Network Access

Use the NAR workflows to request AHS network access for staff who do not automatically receive it when on-boarded through e-People. This generally means people who are AHS Non-Employees. See IAM Definitions.

Shared Directory Folders

Use the NAR workflows to request the creation of or access to a Shared Directory Folder, also called File Shares or Shared Folders.

3. IAM Definitions The IAM system may define employee types differently than your organization does. Please understand these differences to make sure you use the right process the right way.

AHS Employees

Staff who are on-boarded and managed through the e-People system are defined by IAM as AHS Employees. This includes but is not limited to staff of the following organizations:

Alberta Health Services

Covenant Health

Carewest

AHS Non-Employees

Personnel who are not managed and paid through e-People are defined by IAM as AHS Non-Employees. This includes but is not limited to personnel of the following organizations:

AHS Wholly Owned Subsidiaries

AHS Affiliates

Community

Personnel who are employed by private, community physician offices / clinics, dental clinics and pharmacies are defined by IAM as Community users.

Combination

A person can be more than one of these types. There are many situations today where a person works for AHS, a wholly owned subsidiary and a community facility. They would have all three types associated with their access entitlements in IAM. But each type is unique so it’s important to get it right when working in IAM. Additional details are available in the Usage Guidelines.




4. Role Information

NAR Requester

A NAR Requester is anyone who enters a Network Access Request (NAR) in IAM. If the NAR Requester also qualifies as a NAR Approver, the request will be automatically approved.

NAR Requester steps at a glance

Generally, NAR Requesters follows these steps when requesting AHS network access.

NAR Approver

A NAR Approver approves network access and Shared Directory Folder requests in IAM. A NAR Approver must meet at least one of the following criteria:

anyone with an AHS Delegation of Human Resources Authority (DOHRA) of 1 to 12

Please note that DOHRA is based on HR Position Description. Any AHS person who does not have a valid DOHRA and believes they should be able to act as a NAR Authorized Approver must contact AHS Human Resources to discuss an update to their HR Position Description.

OR

anyone with a Covenant Health DOHRA of 1 to 6

Please note that DOHRA is based on HR Position Description. Any Covenant Health person who does not have a valid DOHRA and believes they should be able to act as a NAR Authorized Approver must contact Covenant Health Human Resources to discuss an update to their HR Position Description.

OR

anyone who has been pre-approved to perform the role of a NAR Authorized Approver. This applies particularly to people who work for an AHS Affiliates or who are AHS non-employees. Please contact your local AHS IT Service Desk if you wish to become a NAR Authorized Approver. They will submit a ticket on your behalf to the appropriate team(s).

If you meet the criteria of a NAR Approver, your NAR requests will be automatically approved. That is, there is no need for you to identify another NAR Approver.

Request or ModifyAccess to

Entitlements

Find the User

Choose from Available

Entitlements and Resources

Complete details

Choose the Approving Manager

Review &

SubmitConfirm

http://insite.albertahealthservices.ca/Files/hr-standards-and-guidelines-processes-appendix-a-delegation.pdf

http://www.albertanetcare.ca/learningcentre/documents/Covenant_Health_IT_support_Levels_of_authority.pdf

http://www.albertahealthservices.ca/about/Page12928.aspx



NAR Approver steps at a glance

Network Access Requests

Generally, NAR Approvers follow these steps when approving requests for network access and Shared Directory Folders. Once network access has been provisioned in IAM, the Manager / Authorized Approver will receive an IAM email notification with the requestee’s network username and password. The Manager / Authorized Approver passes this information along and helps their new staff person login and get oriented to the tools they need for their job.

Shared Directory Folders

The overall process for giving someone access to a Shared Directory Folder follows a longer path – with much of it done behind the scenes. The process is different because two approvals are required: first, the requestee’s Manager / Authorizer Approver must approve and, second, the Shared Directory Folder owner must approve. The Manager / Authorized Approver must follow the same steps shown above. After the Approve step, IAM will route the request to IT Access File Services. They will arrange access with the Shared Directory Folder owner on your behalf. Once access to the Shared Directory Folder has been provisioned, the Manager / Authorized Approver will receive an email notification with information on how to access the Shared Directory Folder. The Manager / Authorized Approver passes this information along and helps their new staff person login and get oriented to the Shared Directory Folder.

Open Approval Notifications Review access request Complete details Approve / Deny



5. How do I request a new AHS network account? An IAM Network Access Request (NAR) should only be used to request AHS network access for people who are not getting it automatically when on-boarded through e-People. Please use the NAR form to request AHS network access for AHS Non-Employees. Refer to sections 2, 3, and 4 for use, definitions and role information.

5.1 NAR Requester Steps

1. ENTER the IAM URL into the intranet address bar: https://iam.albertahealthservices.ca/user LOG INTO IAM

2. CLICK Request or Modify Access to Entitlements.

3. CLICK to identify the user.

https://iam.albertahealthservices.ca/user



4. ENTER the user’s Legal First Name, Last Name and Date of Birth (DOB).

5. CLICK Request Access beside Network Account.

. CLICK Next The Network Account Details screen will appear.



Please note:

If an error message appears REVIEW the accounts and verify that a new network account is required. See Usage Guidelines If yes: CLICK Create New User. If no: CLICK Cancel at the bottom of the screen.



7. ENTER the following mandatory* information and as much optional information as possible:

Title

Middle Initial or check No Middle Name

Preferred First Name

Suffix

AHS Zone

External Email Address

Job Title

Department

8. CLICK to select the user’s AHS Zone from the drop down list.



9. CLICK to select the appropriate User Sub-category.

Please note:

The User Sub-category selected will determine who the Approving Manager or Group will be.

10. If the user requires an AHS email address, SELECT the checkbox beside Create Email Account.



11. CLICK to select the user’s Company from the drop down list.



12. CHOOSE the Approving Manager.

Please note:

If you are a qualified NAR Approver, the request will be automatically approved; you will not need to choose an Approving Manager. Proceed to step 14. If you are not a qualified NAR Approver, or if the manager is not correct or no manager is specified:

CLICK Change Approving Manager. Use the search field to search for an available Approving Manager. CLICK Select User.

13. CLICK Next. The Review and Submit screen will appear.



14. CLICK Submit. The Confirmation screen will appear.



15. CLICK OK.

The Home screen will appear. The Request will appear in the Request Status pane.

Please note:

If you are a qualified NAR Approver, your NAR requests will be automatically approved.

Process is Complete



5.2 NAR Approver Steps

1. ENTER the IAM URL into the intranet address bar: https://iam.albertahealthservices.ca/user

LOG INTO IAM

2. CLICK Approval Notifications.

The Awaiting Approval screen will appear.

3. CLICK the link under Request.




4. REVIEW the information entered by the Requester.

Please note:

Not all information may be changed.



5. CHOOSE the person to receive the new user’s log on information.

Please note:

New logon credentials will be automatically sent to the Requester. If the credentials need to be sent to someone other than the Requester, CLICK Change Credential Recipient. If the credentials are only to be sent to the Requester proceed to step 6.

Use the search box to find the user who will receive the credentials and CLICK Select beside their name.

6. To approve the request CLICK Approve. To deny the request CLICK Deny. To save any changes made and return to the Awaiting Approval screen CLICK Save for Later. To return to the Awaiting Approval screen CLICK Cancel. The Awaiting Approval screen will appear.

7. The Awaiting Approval screen will appear. The account will be automatically provisioned in IAM and the credentials will be sent to the user specified.

Process is Complete



6. How do I add AHS network access to a user’s existing IAM account?

If you would like to request AHS network access for a person who already has an IAM account, follow these steps. Remember that an IAM Network Access Request (NAR) should only be used to request AHS network access for people who are not getting it automatically when they are on-boarded through e-People. Refer to sections 2, 3, and 4 for use, definitions and role information.




3. Use the search fields to find the user.

CLICK Search. User Search Results: will appear.




4. FIND the user and look under the AHS Network Account heading. If the user has No AHS Network account, CLICK Select beside the user’s name. The user’s List of Available Entitlements and Resources will be displayed below the search results.

5. CLICK Request Access beside Network Account. CLICK Next The Network Access Request (NAR) Details screen will display.



6. CLICK Modify from the drop down list. The user’s Personal Information will display.

7. CLICK to select the User’s Account Type

Please note:

If an Active Directory (AD) account is required you must check Non-Employee.



8. COMPLETE all the mandatory fields and as many of the optional fields as possible.




Please note:

If are a qualified NAR Approver, the request will be automatically approved; you will not need to choose an Approving Manager. Process to step 10. If you are not a qualified NAR Approver, or if the manager is not correct or no manager is specified:


CLICK Next The Review and Submit screen will display.

10. CLICK Submit The Confirmation screen will appear. CLICK OK The Home screen will appear. The Request will appear in the Request Status pane.

Process is Complete





LOG INTO IAM

2. CLICK Approval Notifications

The Awaiting Approval screen will appear.






Please note:




5. CHOOSE the person to receive the new user’s login credentials.

Please note:

New logon credentials will be automatically sent to the Requestor. If the credentials need to be sent to someone other than the Requestor, CLICK Change Credential Recipient. If the credentials are only to be sent to the Requestor proceed to step 6.

Use the search box to find the person who will receive the credentials and CLICK Select beside their name.



Process is Complete



7. How do I set email preferences on a user’s existing IAM account? Follow these steps to set the email preferences for a person who already has an IAM account, follow these steps.

Please note:

The user must have already have access to the AHS network. If they do not, complete process 5.0 or 6.0 first.

To be able to set email preferences, the user must have two existing email accounts: an AHS email account and another, external, email account. If the user only has one email account, it will be automatically considered the preferred email.









4. FIND the user.

Please note:

As stated at the beginning of this process, the user must have access to the AHS network. Look under the AHS Network Account heading. If the user has No AHS Network account, go back to process 1.0 or 2.0. To be able to set email preferences, the user must have two existing email accounts: an AHS email account and another, external, email account. If the user only has one email account, it will be automatically considered the preferred email. CLICK Select beside the user’s name. The user’s List of Available Entitlements and Resources will display.



5. CLICK Request Access beside Network Account. The Network Access Request (NAR) Details screen appears.

6. CLICK Modify in the drop down list. The user’s Personal Information will appear.

7. IF the user requires an AHS email account, CLICK the Create Email Account checkbox.

ENTER the user’s external email account in the External Email Address field.

8. CLICK to select Preferred Email from the drop down list: either the AHS email address or the other external email address.



9. COMPLETE all mandatory fields and as many of the optional fields as possible.




Please note:

If you are a qualified NAR Approver, the request will be automatically approved; you will not need to choose an Approving Manager. Proceed to Step 11. If you are not a qualified NAR Approver, or if the manager is not correct or no manager is specified:




Process is Complete





LOG INTO IAM

2. CLICK Approval Notifications. The Awaiting Approval screen will appear.






Please note:




5. CLICK the link under Request. CHOOSE the person to receive the new user’s login credentials.

Please note:

New logon credentials will be automatically sent to the Requestor. If the credentials need to be sent to someone other than the Requestor, CLICK Change Credential Recipient. If the credentials are only to be sent to the Requestor proceed to step 6.




Process is Complete



8. How do I modify personal details on a user’s existing IAM account?



LOG INTO IAM







4. CLICK Select beside the user’s name. The user’s List of Available Entitlements and Resources will display.

5. CLICK Request Access beside Network Account. The Network Access Requst (NAR) Details screen appears.

6. CLICK Modify from the drop down list. The user’s Personal Details will appear.



7. CHANGE information as needed. Be sure all mandatory fields are complete.




Please note:





Process is Complete





LOG INTO IAM







Please note:




5. CHOOSE the person to receive the new user’s log on information.

Please note:






6. To approve the request CLICK Approve.

To deny the request CLICK Deny. To save any changes made and return to the Awaiting Approval screen CLICK Save for Later. To return to the Awaiting Approval screen CLICK Cancel. The Awaiting Approval screen will appear.

7. The Awaiting Approval screen will appear. The account will be automatically updated by IAM and the credentials will be sent to the user specified.

Process is Complete



9. How do I perform a Standard Termination request for an AHS Non-Employee?

A Standard Termination is completed for a person who is retiring or who has resigned. An AHS non-employee, as defined in the IAM system, is a person who was not on-boarded, and is managed and / or paid through e-People. Refer to sections 2, 3, and 4 for use, definitions and role information.

9.1 NAR Approver Steps Only

This process can only be done by a qualified NAR Approver. 1. ENTER the IAM URL into the intranet address bar: https://iam.albertahealthservices.ca/user

LOG INTO IAM







CLICK Search.

5. CLICK Select beside the user’s name.


7. CLICK Next. The Access Request screen will appear.



8. CLICK to select Terminate / Suspend from the drop down list. The screen will automatically refresh.

9. CLICK to select the Request Type: Non-Employee Termination.



10. For an AHS non-Employee Standard Termination, ENTER the Effective Date and the Effective Time. CLICK Next The Review and Submit screen will appear.




12. CLICK OK. The Home screen will appear.

Process is Complete



10. How do I perform an Emergency Termination for an AHS Employee or AHS Non-Employee?

An Emergency Termination is done in IAM for a person whose employment and access are permanently terminated on an urgent basis. It is not to be used for people who are changing work locations, retiring or resigning. It is not to be used for people working with Clinical Research / Clinical Trials. An Emergency Termination is done in IAM for both AHS Employees and AHS Non-Employees as defined in the IAM system. Refer to the Usage Guidelines document and sections 2, 3, and 4 for use, definitions and role information.


This process can only be done by a qualified NAR Approver. 1. ENTER the IAM URL into the intranet address bar: https://iam.albertahealthservices.ca/user

LOG INTO IAM







4. Use the search fields to find the user. CLICK Search.






8. CLICK to select Terminate / Suspend from the drop down list. The screen will automatically refresh.

9. CLICK to select the Request Type: Emergency Termination.

10. ENTER the Effective Date and Effective Time. CHOOSE your HR Representative from the drop down menu. CHOOSE Yes or No for Investigatory?





13. CLICK OK. The Home screen will appear.

Process is Complete



11. How do I request the reactivation of a network account?


This process can only be done by a qualified NAR Approver.

Please note:

If you want to reactivate the network account of a former AHS employee:

o who will be an AHS Employee again, please contact AHS Human Resources. o who will be an AHS Non-Employee please continue with this process in IAM. o who will be an AHS Non-Employee AND Community user, please continue with this process in IAM and take

special note of Step 8.


LOG INTO IAM


3. Use the search fields to find the user. CLICK Search.





5. CLICK the Reactivate Access button.

6. ENTER the user’s DOB Month and DOB Day using the drop down menus.

7. CLICK Next. The Complete Access Request screen will appear.



8. At the Complete Access Request screen, you must identify what the person’s User Type is. We’ve set up this table to help you choose the right User Type.

Was Is Action you should take

AHS Employee (as defined by IAM – See Usage Guidelines)

AHS Employee Contact AHS Human Resources

AHS Non-Employee Complete this process and choose Non-Employee at Step 9.

AHS Non-Employee and a Community user

Complete this process and choose Non-Employee and Community at Step 9.

AHS Non-Employee (as defined by IAM – See Usage Guidelines)



AHS Non-Employee and Community

Complete this process and choose Non-Employee and Community at Step 9.

Community (as defined by IAM – See Usage Guidelines)



Community Complete this process and choose Community at Step 9.

Cautionary note #1:

If you attempt, in IAM, to reactivate the network access for a former AHS employee who is becoming an AHS employee again, you will get an error message. The message will advise, as does the table above, to contact AHS Human Resources. If you get the error shown here, DESELECT the Employee User Type and the error message will disappear. Contact AHS Human Resources.






9. At the Complete Access Screen ENTER User’s Account Type based on the table shown in Step 8. ENTER any updated information in the mandatory* fields and as many of the optional fields as possible.



10. Select User to Receive The Credentials by CLICKING on Change Credential Recipient and using the search function.


12. REVIEW the information entered. CLICK Submit. The Confirmation screen will appear.



13. CLICK OK.

Please note:

If you do not CLICK OK, your request will be delayed for up to four (4) hours.

Process is Complete



12. How do I request the creation of a new Shared Directory Folder?





Please note:

It is recommended that the person you identify here will be the owner of the file share.




4. CLICK Request Resource beside Shared Drive / Folder (New).




6. Ensure the Approving Manager listed is correct.

Please note:


CLICK Change Approving Manager. Use the search field to search for an available Approving Manager. CLICK Select Approving Manager.



7. ENTER the following mandatory information and as much optional information as possible:

Suggested Share Name – a suggested name for the shared directory folder

Program / Department Name

Type of Information

Retention Requirements

Projected Growth per year (in Gigabytes)

ENTER the Program / Department Name in the free text field.



8. CLICK to select the user’s Zone from the list.

9. ENTER a Share Owner SEARCH for an available Share owner

Please note:

The new Share owner must have the correct Delegation of Human Resources Authority. CLICK Select User

ENTER the Users Needing Modify Access and Users Needing View Only Access in the free text fields. If possible ENTER each user’s network username.



10 ENTER the Primary Share Owner(s) in the free text field. If required also ENTER the Secondary Share

Owner(s) in the free text field. If possible ENTER each user’s network username

11 ENTER a short descriptive name for the shared drive in the Please Enter any Additional Information text box.

12. CLICK Next.

The Review and Submit screen will appear.




14. CLICK OK.

The Home screen will appear.

The Request will appear in the Request Status pane.

Process is Complete










4. REVIEW the information entered by the Requester and make changes as required. All fields are editable.

5. To approve the request CLICK Approve. To deny the request CLICK Deny. To save any changes made and return to the Awaiting Approval screen CLICK Save for Later. To return to the Awaiting Approval screen CLICK Cancel. The Awaiting Approval screen will appear. The request will be sent to AHS IT Access to complete.

Process is Complete



13. How do I request access to an existing Shared Directory Folder?




3. CLICK to identify the user. If you choose Myself proceed to step 4. If you choose Existing User use the search fields to find the user.

CLICK Select beside the user.




If you choose New User,

Please note:

A Network Access Request will be automatically added to this file share request for a new user. This is because the user must have AHS network access before they can have access to a shared drive on the network. ENTER the user’s Legal First Name, Last Name and Date of Birth (DOB).

4. CLICK Request Access beside Shared Drive / Folder (Existing).



5. CLICK Next.

The Directory Share Folder Access Request screen will appear. If you have selected New User and an error message appears REVIEW the accounts and verify that a new network account is required.

If yes: CLICK Create New User. If no: CLICK Cancel at the bottom of the screen.


Please note:

If you are a qualified NAR Approver, the request will be automatically approved; you will not need to choose an Approver Manager. Proceed to step 7. If the manager is not correct or no manager is specified:




7. ENTER the Server Name, Folder Name and Drive Letter in the free text fields.

CHOOSE the Access Level from the drop down list.

Please note:

Access levels are as follows. Read/Write – end-user has full access to files in the shared directory folder Read Only – end-user can open but not edit the files in the shared directory folder Mirror Access – end-user will be given the same access as another end-user – the other end user’s network name must be included in Additional Notes Remove Access – remove an end- user’s access To request more than one Share Drive for a user CLICK Add Another Share to Request. If you are a qualified NAR Approver, the request will be automatically approved; you will not need to choose an Approver Manager. Proceed to step 7. If the manager is not correct or no manager is specified:





10. CLICK OK.

The Home screen will appear. The Request will appear in the Request Status pane.

Process is Complete



13.2 NAR Approver Steps Please note:

In the majority of cases, approval to access an existing shared drive involves two approvals.

The first approval is requested from the person’s Manager who approves / denies the validity of the access request. If approved, IAM automatically routes the request to the IT Access File Services team. They manage the second approval process.

The second approval is requested from the owner of the shared drive who approves / denies the access to the shared drive. Once both approvals are given, access is provisioned.

Please also note:

If you receive a file share request for a new user, it will include a request for their network access. You must approve the AHS network access first – whether or not you mean to approve the request for file share access. 1. ENTER the IAM URL into the intranet address bar: https://iam.albertahealthservices.ca/user

LOG INTO IAM



4. REVIEW the information entered by the Requester and make changes as required. All fields are editable. To request more than one Share Drive for a user CLICK Add Another Share to Request.




5. To approve the request CLICK Approve. To deny the request CLICK Deny. To save any changes made and return to the Awaiting Approval screen CLICK Save for Later. To return to the Awaiting Approval screen CLICK Cancel.

The Awaiting Approval screen will appear. The Request will then be sent to the AHS IT Access Team to complete.

Process is Complete



14. How do I remove access to an existing Shared Directory Folder?




3. CLICK to identify the user. If you choose Myself proceed to step 4. If you choose Existing User use the search fields to find the user.

CLICK Select beside the user.




4. CLICK Request Access beside Shared Drive / Folder (Existing).

5. CLICK Next.

6. CLICK to select Share Request from the drop down menu.

Please note:

If you choose Approval an error will appear.




Please note:



8. ENTER the Server Name, Folder Name and Drive Letter in the free text fields. CHOOSE the Access Level from the drop down list. To request more than one Shared Directory Folder for a user CLICK Add Another Share to Request.



9. TYPE instructions to remove access into the Notes or Other Information free text field.

CLICK Next. The Review and Submit screen will appear.




11. CLICK OK. The Home screen will appear. The Request will appear in the Request Status pane.

Process is Complete







4. REVIEW the information entered by the Requester and make changes as required. All fields are editable. To request more than one Shared Directory Folder for a user CLICK Add Another Share to Request.

5. To approve the request CLICK Approve. To deny the request CLICK Deny. To save any changes made and return to the Awaiting Approval screen CLICK Save for Later. To return to the Awaiting Approval screen CLICK Cancel.

The Awaiting Approval screen will appear. The Request will then be sent to the AHS IT Access Team to complete.

Process is Complete


Documents

Network Access Request (NAR) User Reference Guide · · 2018-01-04Identity & Access Management NAR User Reference Guide Version January 2018 Page 1 of 78 Network Access Request