Enabling Applications to Use Your IdMS Dan Malone Middleware Architect California Polytechnic State University, San Luis Obispo Take a tootsie pop… How will data be made available to the applications. Copyright Dan Malone, 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Identity Management The Old Way TAP – Tim’s Accounting Program PH – CSO Directory Server SOAP – Suite Of Accounting Packages First, how we got to where we are at today. Tim was a student… After this is where I came into the picture. In order to support these, I needed to reverse engineer all the pieces. 5/13/2019 2

Identity Management The Old Way SIS Unix TAP HR Email PH Talk quickly about problems we dealt with day-to-day Foundation Calendar SOAP ASI 5/13/2019 3

Something had to change!!! It’s all about the data and managing information We can’t know how every application works Need to know what data we are getting from the sources. And it needs to be clean. Using the data in a new way really shows how bad it really is. Data by itself is not as useful as information derived from it… “full time student” true/false field is much more useful than trying to determine if a “person with 12 units in the current quarter” .. Also useful to have everyone using the same definitions. E.g. if all students get unix accounts and all students get email accounts, then it better be the same list of students. We can’t learn every application, and application administrators don’t want others in their application. Then, another ITS re-org: into Information Management – Data Warehousing 5/13/2019 4

Identity Management The New Way Identity Reconciliation Data Warehouse Directory Services LDAP Authentication Services Trusted Web Authentication (CAS from Yale) LDAP Authentication Password Management Provisioning Services 5/13/2019 5

Provisioning Model It’s all about the data/information Well defined business rules We can’t be expected to know how to provision every application We don’t want to create DAP – Dan’s Accounting Program Started as an email provisioning project. We turned it into a provisioning model project so we could re-use it. The data is what the application needs to create the accounts. The app just wants to create accounts for people and needs some data (like first name and last name) to create them. The apps should be consistent, thus the data should be consistent Business rules for population selection and for data requirements. Not just “give me everything and I’ll use what I need” or “tell me what you have”. Well defined roles and responsibilities between middleware and application administrators. In our case, the middleware gathers and packages the required data. Application administrators process the data by performing the appropriate functions on the application. Must be maintainable by more that one person. Keep it simple. Not focusing on tight code or how long it takes to run. 5/13/2019 6

Build or Buy? Why to build our own Provisioning System. Products are all very proprietary Novell and Active Directory camps will never agree on which one is right Dependent on vendor supplied connectors Or build your own using the language of the vendors choice Who will manage it? Still need to define the business rules What we found: Proprietary – no standards between products Both want to be the center of the world (for more than just provisioning and IdM) Vendor supplied connectors are limited. Since we have a wide variety of applications not one vendor covers them all. So we are going to have to build at least part of it anyway. These are complex applications. Someone has to learn it and manage it. (Not just read the quick start guide and install it) Business rules aren’t something you get “out of the box” 5/13/2019 7

Provisioning Model – Diagram We are now building our provisioning system based on this model. We are running successfully in our development environment now. 5/13/2019 8

What took the most effort Convincing people we are doing the right thing Replacing vs. rebuilding TAP We can not buy a product that will do everything Application owners “We are not programmers” Data request for an application Business rules are not well defined Application owners need help Functional areas/data stewards need help People are worried that they won’t be able to do things the same way… That’s true in some ways. (You can’t just add someone to the directory) Can not buy…: Many are not thinking big picture. Needed a new form for applications, not a person. Data authority needs to approve the use. Then they know who/how people are using it. Asked for definition of student: 7 Faculty: 4 Note that none of these are coding. 5/13/2019 9

What’s working well If 80% up-front planning then 20% coding else 80% coding + 80% rework + … Once the application owners understood the model, they liked the fact they still have full control of their application Data warehouse processes are being improved Data warehouse has the same issues. 5/13/2019 10

The power is in the information Take advantage of the data and information that already exists Business rules are difficult to come by but are worth the effort Keep talking about middleware to make people remember what it will do for them Also, the data warehouse already has policies and procedures around getting data, such as the data request forms and the approval process. If you spend the time to do the business rules (application and data rules) up front, you won’t need to do as much rework. Plus you can reuse them for the next application. Middleware is behind the scenes stuff. If people do notice it, it’s usually because it broken… But, you need support to make it work, so, keep talking about the benefits. Find a way to keep interest (I wouldn’t suggest having a presentation at 2:30, after a big lunch (nap time)) So, before I open this up for questions, I have a question for everyone who has eaten their tootsie-pop: The tootsie-pop has some middleware, right? Did anyone get to the middleware in the tootsie-pop? What would a tootsie-pop be without it’s middleware? Just a sucker. 5/13/2019 11

Dan Malone – dmalone@calpoly.edu Questions Dan Malone – dmalone@calpoly.edu 5/13/2019 12