live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: FRIENDLY NAMING CONVENTIONS – LEVERAGING THE POWER OF OPEN LDAP AND MULTIPLE DIRECTORIES Abhishta Bodapti Karl Horvath Lauren Halupke Gwynedd-Mercy College

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: WHERE IS GMC LOCATED?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: STUDENTS

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: HOW BIG IS THE IT DEPARTMENT?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: How many projects do we have at hand?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: PROBLEM THE PROBLEM

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: HOW IT LOOKED?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: NAMING CONVENTION?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: DEPARTMENTS INVOLVED?  Administrative Systems  Enterprise Systems  Desktop Support  Information Systems

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: PROJECT GOALS  No changes to AD  Build a fail-over DC solution  Ease of use for end-user  Cost

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: RESOURCES

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: SOLUTION

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: MULTIPLE DIRECTORIES?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: W HAT ARE THE BENEFITS ?  Multiple directory integration  Selective (regEx) import of directory user groups  Convert user groups (directory) directly to roles (local to myCampus)  Simultaneously leverage both imported (from directory) and existing (from myCampus DB) groups / roles

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: W HAT ARE THE BENEFITS ?  Import additional personal attribute(s) to empower SSO bridges to enterprise applications  Ability to set hot LDAP/AD failover in case primary LDAP/AD is not reachable

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: W HAT IS THE "M ULTIPLE D IRECTORY " CONCEPT ?  Leverages PAF (P ersonal A ttribute F ramework )  PAF = middleware between myCampus and CAS  CampusEAI's PAF application acts as a CAS client that consumes CAS attributes.PAF  Uses the CAS SAML validation filter to consume user attributes, including group and role memberships.

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: W HAT IS THE "M ULTIPLE D IRECTORY " CONCEPT ?  It uses attributes to create and synchronize the myCampus user base with data from one or more sources.  This is a required component for Multiple Directory configurations but is also available for single source environments.

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: H OW DOES IT WORK WITH AD OR LDAP  CAS can be configured with one or more Authentication Handlers.  An ldapAuthenticationHandler is typically configured to authenticate users against a school's enterprise LDAP server.  A fileAuthenticationHandler is typically configured to authenticate users against a configured users.properties file.

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: K EY F ILES  users.properties  authenticationHandlers-local.xml  deployerConfigContext-local.xml  credentialsToPrincipalResolvers-local.xml .edu/paf/configuration

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: H OW DOES IT WORK WITH AD OR LDAP  Defines all authenticationHandlers authenticationHandlers-local.xml

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:  Define location (IP) of directories with LDAP Bind Accounts deployerConfigContext-local.xml

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:  Map attributes from LDAP (key) to Principal (value) credentialsToPrincipalResolvers-local.xml

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax:  Map attributes from SAML validation to corresponding myCampus attribute. Available to be edited in GUI.edu/paf/configuration

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: PAF Configuration Screen The “Behavior” section allows the mapping of attributes in the response to myCampus arguments for creating a user. The left hand side should contain the attribute as shared in the SAML validation. The right hand side is the corresponding myCampus attribute.

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: Preserve Existing and Imported User Groups / Role Membership In this scenario, certain, configurable groups/roles may wish to be preserved (i.e. not blown away ) on sync “existing values” refers to user groups/roles local to myCampus system “imported values” refers to the user group and roles brought in from the directory (UserGroup1|UserGroup2).* = All User Groups or Roles

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: HOW IT LOOKS NOW?

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: I NTERESTED IN M ULTIPLE D IRECTORY ?  Multiple Directory Integration? Estimated Project Cost: $ 4,000  Directory Replication and Cloud Hosting Estimated Project Cost: $ 8,000

live. learn. work. play Superior Ave E Suite 310 Cleveland Ohio Tel: Fax: