Checklist for migrating apps & identities off SiteMinder

Modernizing your Identity Providers (IDPs) and migrating the Identity and Access Management (IAM) components of your applications can be a complex process. However, with meticulous planning and the right tools, it can be streamlined and efficient. At Strata, we have extensive experience with various migration patterns, and we have distilled our top insights into this comprehensive checklist.

This checklist serves as your roadmap for a smoother journey, covering all critical steps from planning and discovery to user and app migration, hybrid coexistence, and retiring legacy systems. It is designed for IAM managers, directors, or project owners who need to plan for IDP migration or IAM service modernization.

Migration Planning and Discovery

Conduct a thorough analysis of your current identity infrastructure to catalog all applications, users, and identity systems. Assemble a dedicated team to identify all identities, entitlements, and IAM configurations. Assess the complexity of applications and access policies to effectively prioritize migration efforts.

To do in this phase: 

• Inventory all applications and resources protected by legacy IAM systems.
• Identify session patterns (cookies, HTTP headers, Kerberos, SAML).
• Determine the frequency and volume of app usage.
• Document all user directories and attribute sources.
• Map out your IDP’s domains, realms, policies, rules, and responses.
• Identify customizations and extensions in use.

User Account Migration

Develop a comprehensive inventory of users, attributes, groups, and roles. Map the existing schema attributes to the new identity system’s schema. Migrate users in small, manageable cohorts to minimize disruption and ensure a smooth transition.

To do in this phase:

• Configure connectors to source identity systems.
• Collect user IDs and credentials during legacy IAM login.
• Read user attributes from LDAP/Active Directory and SQL.
• Map attributes to the new identity system.
• Verify user creation and authentication in the new system.
• Enroll users in MFA solutions automatically.

App Mitigation

Implement Identity Orchestration to decouple identity changes from application code, ensuring seamless interoperability by transforming tokens as necessary. Automate the migration process to achieve efficient scalability.

To do in this phase:

• Configure Identity Orchestration to handle different session types.
• Use claims from OIDC or SAML to populate HTTP headers with required attributes.
• Combine attributes from multiple sources to enrich user profiles.
• Plan migration cohorts and manage
  migration checklists.

Hybrid Coexistence

Operate legacy and cloud identity systems concurrently during the migration phase. Extend access to on-premises applications through cloud identity systems to ensure continuous service availability.

To do in this phase: 

• Determine which identity provider to use for each user
  or app.
• Keep sensitive apps and data on-premises while using cloud identity providers.
• Extend MFA to on-premises apps without rewriting them.
• Enrich user attributes at runtime from multiple sources.

Retire Legacy IAM

Decommission legacy IAM systems upon completion of the migration process. This step will reduce costs by eliminating the need for legacy maintenance and support contracts, allowing the organization to focus on innovation and new projects.

To do in this phase: 

• Incrementally move apps from legacy IAM to cloud identity systems.
• Create and manage user sessions for apps protected by both legacy and cloud systems.
• Decommission legacy IAM infrastructure and related expenses.
•  Focus on innovation and new projects.

Additional considerations for IAM tech debt cleanup during this process:

Whenever feasible, consolidate identity data sources. According to Gartner, technical debt can significantly reduce the agility of IAM teams and compromise the effectiveness of organizational security controls. Addressing technical debt is crucial for maintaining a robust and agile IAM infrastructure!

Siloed IAM tools:
Custom or homegrown tools often lead to fragmented architectures, reducing observability and interoperability. This results in decreased effectiveness of threat protection and identity processes. Aim to replace these with standards-based solutions that support centralized administration and governance while allowing decentralized enforcement of IAM controls.

Legacy applications:
Non-standard and outdated enterprise applications pose significant challenges during migration. Integrate modern identity standards and protocols wherever possible, and leverage orchestration, proxies, and connectors to bridge gaps without extensive rewrites.

Incomplete discovery processes:
Inadequate discovery can leave out critical identities, such as machine identities and external partners, resulting in poor security posture and compliance failures. Ensure continuous and comprehensive discovery to maintain an up-to-date view of all identities and entitlements.

Poor IAM hygiene:
Poor practices in managing identities, entitlements, and roles can lead to security risks. Regularly audit and clean up IAM data to ensure it adheres to best practices and supports robust security controls.

Complex enrollment processes:
Simplify application enrollment to improve adoption and reduce technical debt. Use templates and standardized processes to streamline integration and ensure comprehensive onboarding of entitlements and policies.

Conclusion

Modernizing and migrating your identity systems is a complex journey, but with careful planning, it can be done smoothly. We’ve covered the importance of analyzing your current infrastructure, migrating user accounts and applications, running hybrid systems, and finally retiring legacy IAM systems.

Ask yourself these questions to determine if your organization is ready:

• Do you need help creating an inventory of applications, users, and identity systems?
• Are you juggling a hybrid or multi-cloud IAM infrastructure?
• Are legacy applications blocking your progress to apply modern identity protocols?

If you answered yes to any of these, consider a comprehensive migration strategy. Strata’s Maverics Platform simplifies this process with powerful Identity Orchestration capabilities, reducing technical debt and streamlining your IAM modernization.

Ready to modernize your identity systems with ease? Trust Strata to guide you through every step for a smooth, efficient transition. Contact us today to make your identity infrastructure robust, flexible, and future-ready.