Identity and Access Management Services Tom Jordan <tom.jordan@wisc.edu> Presented to Infrastructure Technical Advisory Group (ITAG) November 20, 2017

Identity and Access Management Services Agenda Overview of Campus IAM services Who’s using IAM services? IAM Populations Gaps / Campus Needs Current Initiatives Future Initiatives Forums for campus feedback How ITAG can help II 11/20/2017

IAM on Campus The IAM Problem Space IAM On Campus (from IT Services Survey) 17 campus services for Identity Management 38 campus services for Access Management 7 campus services for Directory Services Major campus providers: Identity Registration Directory Services Account Management Grouping / Provisioning Person Data Delivery Access Management DoIT Business Athletics AIMS Computer Science SMPH Engineering 11/20/2017

Overview of DoIT IAM Services and Infrastructure SIS Identity Registry Authentication Services On-Premise WebSSO Apps NetID Login Hosp Madison Data Sources Cloud Apps for UW Madison WI Fed SpecAuth IDM/PASE Credential Management Common Systems Apps (on-prem and in the cloud) MFA etc PHEXPORT (Customer Data Views) Directory Services UW Madison Directory-based apps and Infrastructure LDAP Active Directory HRS Office365 UWM Google Apps UW System Provisioning (OIM) Cloud Directories UW System Data Sources UWW Cisco Spark UWGB etc UW Madison Provisioning (Regsync) Enterprise Group Management (Manifest / Grouper) Ad-hoc and data-driven grouping for authorization Person APIs SOAP / REST Person data APIs for developers Messaging Identity Sources Identity Reconciliation Identity Data Management Identity Data Integration Identity Consumers 11/20/2017

Who uses IAM services? Principal Customers By IAM Service UW Madison application owners / providers UW Madison business process owners By IAM Service Person Data Views – about 300 data views* Person Web Services – about 25 customers* Directory Services – about 200 departments / subunits Manifest – about 300 departments / subunits SAML / NetID Login – about 1,500 applications 11/20/2017

UW Madison IAM Populations Students (including SOAR, applicants and former students) Faculty / Staff Affiliates Special Authorizations UW Foundation Visiting Staff / Researchers Partner Agencies on campus (Forest Products Lab, USGS, etc) UW Health / UW Medical Foundation Pre-College Program Summer Research Opportunities Program (SROP) Lifelong Learners Manifest-Invited Populations UW System populations (students, facstaff, affiliates) 11/20/2017

Gaps / Issues / Campus Needs Gaps in current infrastructure offerings Scalable provisioning and deprovisioning for compliance and audit Scalable support for Unix integration with directory services Scalable automation by departments Support for modern development tools and processes (REST APIs, ORM-friendly data models) Support for stronger authentication types (MFA) Technical debt in some IAM components Gaps in populations / account types Additional ‘affiliate’ populations Social / External Identity integration Non-person and Privileged Accounts 11/20/2017

Current Initiatives Initiative Gap Addressed Duo Deployment Strong Authentication (MFA) SpecAuth retirement Technical Debt REST-based Person API Support for modern development toolsets Message queueing for person data change notification 11/20/2017

Future Initiatives Initiative Gap Addressed Self-Service attribute release Scalable automation for departments API-based access to group information Unix integration with NetID authentication Services for Unix environments Person Hub refactor / replacement Technical Debt Service / privileged account management Compliance and Audit Improved provisioning / deprovisioning capability 11/20/2017

Service Feedback Individual Services NetID Login – help@login.wisc.edu Campus Active Directory – activedirectory@doit.wisc.edu Manifest - manifest@doit.wisc.edu Measuring Service Effectiveness / Customer Satisfaction Meetings with campus departments in 2016 Customer Survey of IAM Needs – Early 2018 General IAM Feedback – iam-feedback@office365.wisc.edu 11/20/2017 blah

How ITAG could help Are we offering the right IAM services to campus? How do we reach those units that are not engaged? What other feedback venues should we be using to get feedback from our customers? What are you hearing? 11/20/2017