Bank of America Corporation
Role Discovery for Identity and Access Management in a Computing System

Abstract:

Methods, apparatuses, and systems are described for provisioning access rights in a computing system. A data structure may be created that corresponds to the access rights of a computing system. The data structure may be traversed to identify candidate bundles of access rights that correspond to patterns of access rights in the computing system. The candidate bundles of access rights may be evaluated to select one or more bundles to define as one or more roles in the computing system. The defined roles may then be provisioned to the users of the computing system as a replacement for the individual access rights. Various constraints may be applied to reduce the number of candidate bundles of access rights to evaluate.