CAMP Integration Reflect & Join A Case Study The University of Texas Health Science Center at Houston William A. Weems Assistant Vice President Academic Technology

CAMP Integration Middleware Makes the Global Sharing of Resources Invisible to Users.

CAMP Integration 3 Increasingly, people must easily and securely exchange information in cyberspace among "known" individuals and to securely access restricted resources they “know” can be trusted without having to struggle with numerous and onerous security processes.

CAMP Integration 4 How do you prove you are who you say you are? How do you know that someone is legitimate in his or her dealings with you, and how do you get redress if things go wrong? If your identity is stolen and used fraudulently, or personal records are altered without your knowledge or permission, how do you prove that it was not you? It is difficult enough to verify someone's identity in the tangible world where forgery, impersonation and credit card fraud are everyday problems related to authentication. Such problems take on a new dimension with the movement from face-to-face interaction, to the faceless interaction of cyberspace. Identity and Authentication by Simon Rogerson

CAMP Integration 5 Ideally, individuals would each like a single digital credential that can be securely used to authenticate his or her identity anytime authentication of identity is required to secure any transaction.

CAMP Integration 6 UTHSC-H: An Identity Provider (IdP) It is critical to recognize that the university functions as an identity provider (IdP) in that UTHSC-H provides individuals with digital credentials that consist of an identifier and an authenticator. As an IdP, the university assumes specific responsibilities and liabilities.

CAMP Integration 7 Two Categories of Identity Physical Identity – Assigned Identifier - Authentication –Facial picture, –Fingerprints –DNA sample Identity Attributes – Authorization Attributes –Common name, –Address, –Institutional affiliations - e.g. faculty, student, staff, contractor, –Specific group memberships, –Roles, –Etc.

CAMP Integration 8 Issuing a Digital Credential Individual appears before an Identity Provider (IdP) which accepts the responsibility to –positively determine and catalog a person's uniquely identifying physical characteristics (e.g. picture, two fingerprints, DNA sample), –assign a unique, everlasting digital identifier to each person identified, –issue each identified person a digital credential that can only be used by that person to authenticate his or her identity, –maintain a defined affiliation with each individual whereby the validity of the digital credential is renewed at specified intervals.

CAMP Integration 9 Identity Provider (IdP) uth.tmc.edu Person IdP Obtains Physical Characteristics Identity Vetting & Credentialing Identifier Permanently Bound Assigns Everlasting Identifier Digital Credential Issues Digital Credential Person Only Activation Permanent Identity Database

CAMP Integration 10 The University of Texas System STRATEGIC LEADERSHIP COUNCIL Statement of Direction Identity Management April 27, 2004 The University of Texas System Information Technology Strategic Leadership Council agrees that deployment of a robust, secure, interoperable infrastructure for identity management in support of inter-institutional collaboration is a strategic goal. This infrastructure will be based upon the available standards and best practices:

CAMP Integration 11 The University of Texas System STRATEGIC LEADERSHIP COUNCIL Statement of Direction Identity Management April 27, 2004 LDAP (Lightweight Directory Access Protocol) compliant directory services, eduperson schema as promulgated by EDUCAUSE and Internet2, utperson schema (to be developed) inter-institutional access control utilizing Internet2 Shibboleth, and consistent institutional definitions and identity management trust policies for students, faculty, and staff as well as sponsored affiliates.

CAMP Integration 12 UTHSC-H Identity Management System HRMSSISGMEISGuest MSUTP INDIS OAC7OAC47 Secondary Directories Sync Person Registry Authoritative Enterprise Directories Authorization Service Authentication Service User Administration Tools Change Password Attribute Management Identity Reconciliation & Provisioning Processes

CAMP Integration 13 Person Registry Identity Reconciliation –Unique Identifiers Generated by Source of Record SSN – If Available (HRMS, GMEIS, UTP, Guest, SIS) Student ID, Employee Number - HRMS –Full Name First, Middle, Last –Birth Information Date of Birth, City of Birth, Country of Birth –Gender UUID – An everlasting unique identifier

CAMP Integration 14 Person Is New ? Is Single Match ? Is Possible Or Multiple Match ? Add Update Manual Processing No matches or possible matches Identifiers match one and only one person No possible matches Identifiers match more than one person And / or Name or Birth information match one or more persons yes no yes no

CAMP Integration 15 Database Schema Person Table UUID Date of Birth Place of Birth Country of Birth Identifier Table ID Name ID Value Name Table First Middle Last Gender Male / Female

CAMP Integration 16 UTHSC-H Identity Management System HRMSSISGMEISGuest MSUTP INDIS OAC7OAC47 Secondary Directories Sync Person Registry Authoritative Enterprise Directories Authorization Service Authentication Service User Administration Tools Change Password Attribute Management Identity Reconciliation & Provisioning Processes

Sponsor Submits Guest Request Applicant Appears Before LRAA LRAA Verifies Applicant’s Data LRAA Certifies Applicant’s Data Identity Reconciliation Assign UUID, Add to Person Registry Not in Person Registry Guest Added to Guest Database Applicant in Person Registry Applicant Currently Affiliated LRAA Credentials Guest LRAA Credentials Guest No Guest Request Voided Yes LRAA Resolves ID Uncertainty Possible Identity Match Guest Added to Guest Database

No Sponsor’s Request Forms Guest Management System LRAA’s Review/Update Forms Unverified Applicant’s Data Verified Applicant’s Data Review/Update Submission Submit to Reconciliation New Person? LRAA’s Approval Form Yes No Check Present Affiliations Current Affiliations Enterprise LDAP Directory Approval Processes Guest DB Create LDAP Entry Void Sponsor’s Request Yes Person Registry Identity Management System

CAMP Integration 19

CAMP Integration 20 Identity Provider (IdP) uth.tmc.edu PersonIdentifierDigital Credential Permanently Bound Assigns Everlasting Identifier Issues Digital Credential IdP Obtains Physical Characteristics Person Only Activation Identity Vetting & Credentialing UTHSC-H Two Factor Authentication Permanent Identity Database ? ?

CAMP Integration 21 Identity Provider (IdP) uth.tmc.edu PersonIdentifierDigital Credential Permanently Bound Assigns Everlasting Identifier Issues Digital Credential IdP Obtains Physical Characteristics Person Only Activation Using Network Username Password Identity Vetting & Credentialing UTHSC-H Username/Password Authentication Permanent Identity Database ??????? ?

CAMP Integration 22 UTHSC-H Strategic Authentication Goals Two authentication mechanisms. –Single university ID (UID) and password –Public Key Digital ID on Token (two-factor authentication) Digital Signatures Highly Secure Access Control Potential for inherent global trust