Body
Executive Summary
When high-profile leadership transitions occur (such as the Office of the President), security protocol requires immediate revocation of standard user access. However, administrative continuity often demands that specific staff maintain delegated access to the former executives' emails and calendars.
To resolve this security overlap without disrupting operations, Infrastructure utilizes an LDAP Shim to decouple the accounts from the main Identity Management (IDM) system.
The Problem
Standard account offboarding completely disables access across all federated systems. In this specific scenario:
-
The Risk: Former Presidents still had active authentication paths via PortalGuard and Gmail.
-
The Constraint: Completely disabling the accounts would break the delegated access required by administrative staff to manage transition emails and calendars.
The Solution: LDAP Shim Implementation
The Infrastructure team resolved this by moving the former Presidents' accounts to an LDAP shim (resembling a standard service account setup).
Actions Taken:
-
Password Scrambling: Local Gmail account passwords were automatically scrambled to prevent direct login.
-
Authentication Decoupling: The accounts were disconnected from the primary IDM. This explicitly prevents PortalGuard logins and halts Google password resets (even if 2FA is bypassed).
-
Account Re-activation: The accounts were re-activated without entitlements. They exist purely as data containers for the delegate to access.
-
Delegation Window: Delegated access remains active and will be maintained for one year following the new President's official start date.
Future State & Lifecycle
The accounts will remain in this shimmed state indefinitely until one of two things happens:
-
Manual Removal: Infrastructure manually removes the shim and de-provisions the accounts after the one-year transition period.
-
Re-entitlement: If a user becomes entitled again, the Gmail account will automatically revert to being standard IDM-managed.
SD Note: Do not attempt to reset passwords or alter entitlements for past presidents via standard IDM tools. Any access requests or anomalies regarding these accounts must be escalated directly to the Infrastructure team.