Authorizing Access to Services at Penn State University Steve Kellogg, Director, Advanced Information Technologies Center for Academic Computing

Authorizing Access HOW What “Baggage” v. “Luggage” Integrated everything Authentication, authorization, namespace, management, filesystem Heterogenous What File service Web service Applications Systems Delegation

Penn State Environment 24 Campus Locations ~74,000 Full Time Students ~5,000 Part Time Students ~25,000 Employees ~5,000 “Others”

CACTUS Accounts Database (Oracle) Center for Academic Computing Tracking of User Services Backend processes Signature Stations (end user $ Auth) User Services: Access(DCE), Email, web, DFS, Database, backup, Class News, Printing, Plotting, calendar, LDAP,... Accounts Database (Oracle) One Account, Many Services Organize data from disparate sources Automation ALWAYS goal Fully extensible Scalability of services Java/web Interface External Data sources

Systems Access Lab systems Modems ISP apps Windows MAC Unix(AIX, IRIX, Solaris) Modems Authorized based on group membership ISP apps email, netnews, …

DCE Production Applications Fileservice DFS 50MB Home Directories webmail, portal profiles, personal webspace 300 MB for HPC and VIZ users 10 MB quota increment per course Quota reduced at end of semester Site licenses for Solaris, AIX, NT, IRIX

DCE Production Applications Group management – Admin, HPC, Classes, Ad Hoc – Web Authorization – Shared DFS access – 3 groups typically created for each group - Delegated group management - Group, group_admin, group_owner

DCE Production Applications CAC Web Service – AIX/Solaris/Linux – Apache w/ & w/o mod_auth_dce – Most content in DFS – Load balanced w/ IBM’s Network Dispatcher – JDBC and PerlDBI access to Oracle and DB2 .eg MicroSoft SW distribution

DCE Production Applications Web Servers (Gradient’s NetCrusader Security Adapter) – Executive Information System (EIS) – Library access to licensed Web content (LIAS) – Purchasing Catalog – Computer & Information Systems (C&IS) Web site – Microcomputer Order Center (MOC) – Smeal College of Business – Electronic Testing Services (ETS) 3

DCE Production Applications Other web service Office of Physical Plant Linux, Apache, K5 Office of Human resources NT, IIS, Gradient DCE RT, VB Lab consultant management tools AIX, K5, C Others that we don’t necessarily know about…

DCE Mandarin OS/390 Enterprise Server; ADABAS NT Web Servers; WebComm.dll Authenticated RPC client Several services; same RPC code base Student Apps (eLion) Business Apps (WebIBIS) Financial Apps (FIT) RPC protection level integrity privacy

PKI at PSU CREN CA Pilot Server Certs Short term certs OpenSSL Kx509 auth in DCE cell

Questions?