What triggers the process of integrating a new data source into an IAM system, and why must the information need be clarified first?
An application (through its owner) needs information about people that it wants the IAM to supply; before anything else, the IAM team and the application owner must agree on exactly which attributes are needed and why.
The process for integrating data sources (Datenquellen-Erschliessung) does not start with a technical idea, it starts with a demand. The person responsible for an application, say application A, realises that the application needs information about its users: names, organisational unit, cost centre, a qualification. The IAM system is the obvious place to get it from, because it already collects identity data centrally and delivers it to many applications.
The typical first exchange is: IAM asks "Which information do you need?" and the application owner answers "All of it!" That answer is useless for three reasons:
- Data protection: personal data may only be processed for a defined purpose and only as much as that purpose needs (data minimisation). "Everything, just in case" has no purpose.
- Effort: every attribute the IAM delivers has to come from a source, be maintained and be kept up to date. Attributes nobody really uses still cost money.
- Decision basis: the next steps of the process (is the data already there? is it a new kind of data? who is the source?) can only be answered for a concrete list of attributes.
So the first activity is clarifying the information need (Klären des Informationsbedarfs) together: which attributes, for which users, for which business purpose, how current. The step is done when a concrete information need is on the table, for example "first name, last name, department and driving-licence class for all employees who use the fleet tool".
Tip: A good question to ask the application owner is "what will the application do with each attribute?" An attribute with no answer is dropped.
Go deeper:
ICO: Principle (c), data minimisation — a regulator's practical guide to collecting only what a purpose actually needs.- Requirements elicitation (Wikipedia) — why "what do you need?" rarely gets a usable answer on the first try, and techniques that do better.