Deployment Panel: Planning and Implementing for the Big Day Daniel Arrasjid University at Buffalo Copyright Daniel Arrasjid This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

CAMP Directory Workshop Feb 3-6, 2004 University at Buffalo  Doctoral/research extensive university  NY's largest and must comprehensive public university  27,000+ students  13,000+ employees  Two main campuses  Part of the SUNY system

CAMP Directory Workshop Feb 3-6, 2004 Prevalent UB Drivers  Technology and Business Drivers –Critical Technology Specific Directory (DCE) set to retire –Business Continuity and Disaster Recovery –Server Consolidation –Virtualization of services, dynamic provisioning –Staff resource issues –SUNY-wide Federation –Applications seeking more robust attributes –Library resource access management

CAMP Directory Workshop Feb 3-6, 2004 UB Brief History Some Highlights  1986 SSN eliminated as primary key – replaced by “Person Number”  1990 White Pages  1993 developed primitive provisioning system for unix accounts, with University-wide unix namespace.  Mid 1990s major projects/initiatives –Access ’99 – transition mainframe to distributed computing, culture change –1995 Data Warehouse - Data access policies, stewards, trustees, process –1995 Multi-purpose Identification Card System - Final linkage of single public identifier HR/Student –1996 Web-based Workflow & Paperless Processing – Major initiative in culture change, and re-tooling staff, for distributed computing  1997 initial Identity Management System(it wasn’t called that), and DCE –Person registry, biz rules, data transformation, provisioning of services and directories, self-service, special “affiliations”, data Access, security, acceptable use policy  2001 MyUB Portal  2002 Business Continuity & DR, Geographically distributed data center, SAN  2003 Kerberos 5, Active Directory, eduPerson-based Sun ONE DS

CAMP Directory Workshop Feb 3-6, 2004 Example Services Leveraging the 1997-based Infrastructure  Central - (IMAP/POP3/Webmail/filters)  MyUB Portal  UB Business apps  Wings web service protected files  Whitepages LDAP service  Library public access workstations  UBUNIX time-sharing  Blackboard  Telephony Applications  UB Business Portal  Open Ports, Wireless, VPN, Firewall, ResNet  Usenet News  Web password change  Web registration  Web grading  Web address & declared major change  Web Parking hang-tags  e-payment  Public Sites workstations  Software distribution  Distributed File System  Dept. Public Workstations and other applications  Exchange, SQL Server, MS apps

CAMP Directory Workshop Feb 3-6, idM Drivers  NIS+ out of steam  Web-based Workflow & Paperless Processing requirements  Enterprise File Service

CAMP Directory Workshop Feb 3-6, idM Communication  Infrastructure change intended to be transparent  Proposals, executive briefs, technical documents  Campus News Outlets –Web –Newspaper  Campus IT Stakeholders  Campus Forums –IT Fair –Distributed Computing Consultants  Data Custodians

CAMP Directory Workshop Feb 3-6, idM Training  No published roadmap or best practices  Leveraged experience from prior related activities –Earlier provisioning system –Data Warehouse –Operational Datastore –Campus ID Card  Intensive Training Program –6 support staff, approx 18 person-weeks  Transparent change to applications  AuthN/AuthZ modules/libraries for campus use

CAMP Directory Workshop Feb 3-6, idM Technology Considerations  High Availability 24x7 requirement  Meta-Directory –Oracle for repository and queues, w/Stand-by system –Perl Scripts & “C” programs for processing –Delegation of account management, based on roles –Automated monitoring tools, log analysis –DR  Physical Directory –DCE Replicas distributed across several subnets –Private network for replication –Automated monitoring tools –DR  AuthN/AuthZ modules/libraries for campus use

CAMP Directory Workshop Feb 3-6, idM Costs & System Configurations  Physical Directory –8 physical directory replicas, Sun Enterprise Systems, Solaris, DCE  Meta-Directory –1 primary system, 1 stand-by system, Sun Enterprise Systems, Solaris, Oracle.  Total Cost –Approx $250,000 –Approx 3.0 FTE x 9 Months

CAMP Directory Workshop Feb 3-6, 2004 What problems were we trying to solve with “I2” DS and Shibboleth?  Transition from DCE  Make more information available to support Authorization decisions  Biz continuity and service resiliency  Ease integration of applications into campus idM/middleware infrastructure  Be mainstream  Reduce vendor dependency  Authenticated Anonymous access, Privacy issues  Include non-institutional attribute data  Data co-location in a single directory  Ability to do groups as well as individual attributes  Single/Initial log-on  Inter–institutional log-on

CAMP Directory Workshop Feb 3-6, 2004 Existent Prior to Deployment of “I2” DS  Project Management Culture  Campus Governance, Prioritization, Resource Process  “Identity Management”-awareness  “Service”-based culture w/ SLAs/SLSs  Data access, security, and appropriate use policies w/roles and responsibilities  Opaque and persistent identifiers(see )  Identity Management System –Oracle-based registry –Perl and C programs to process intelligence and business rules –Automatic provisioning of services and directories –Large set of existing user attributes/profiles(groups)

CAMP Directory Workshop Feb 3-6, 2004 Roadmap  Completed –ASAB(Governance) support for activity –Discussions with ASAB infrastructure committee, members of the campus community, and peer institutions –Proposal to the Campus, and demonstration –Seek feedback  Outstanding –Determine schema governance model –Develop policies – biz rules, privacy, security, management, attribute ownership –Integrate applications –Continuous process

CAMP Directory Workshop Feb 3-6, “I2” DS Communication  Help from campus –Other UB IT folks following I2 middleware and NMI  Governance/Prioritization –Initiation Proposal to ASAB –Proposal to ASAB Infrastructure  Key Campus IT Stakeholders –1-on-1’s to the discuss proposal and issues –Discussed proposal with IT Coordinating Committee  Campus Forum –Proposal, Demo, and Ken. –Sought Feedback and held follow-up discussions

CAMP Directory Workshop Feb 3-6, “I2” DS Training  Existing expertise with Sun ONE DS  Leveraged existing infrastructure  Books, Roadmaps, Recipes  New modules, libraries, APIs  Just another physical DS  Either cost “a lot” or “fairly little” –When do you start tallying the cost, 1995? –Or just for this quiet deployment of yet another physical directory

CAMP Directory Workshop Feb 3-6, “I2” DS Technology Considerations  Meta-Directory –Leveraged infrastructure, added new feed  Production, but no anticipated production use for 8 months  Service Level Agreements  Physical Directory –High Availability –Load testing(collaborate with App Group, web-load, Jmeter, SAR) –Replicas across geographically distributed data center –Health Monitoring(Big Brother, Spectrum, RRD/mrtg, auto-paging) –Security(Firewalls, VPN, etc) –Layer 4 switches(Cisco local directors)  Infrastructure Costs – $54,000  Some director-switch issues –Combining LDAP farm and Shibboleth farm behind same switch, currently have work-around.

CAMP Directory Workshop Feb 3-6, 2004 Costs & System Configurations  LDAP –394 Hours –4x Sun Enterprise 280 systems, 2Gig RAM, 2x900MHz CPUs, Sun crypto accelerator cards, Solaris 9, Sun ONE DS, $54,000  Kerberos –365 Hours –4x Sun V120 systems with 512Meg RAM and 650MHz CPUs, Solaris 9, Kerberos 5, $14,000  Shibboleth Origin/AA/Cosign –407 Hours –Test w/ 2x Dell 6650 systems, 4x1.9GHz CPUs, 2Gig RAM, Redhat Advanced Server 2.1a. –Production, scaleable app farm with probably at least 4 systems

CAMP Directory Workshop Feb 3-6, 2004 Architecting for Business Continuity

CAMP Directory Workshop Feb 3-6, 2004 Architecting for Business Continuity

CAMP Directory Workshop Feb 3-6, 2004 Architecting for Business Continuity

CAMP Directory Workshop Feb 3-6, 2004 Meta-Directory Dataflow

CAMP Directory Workshop Feb 3-6, 2004 Meta-Directory Dataflow A Nice Diagram

CAMP Directory Workshop Feb 3-6, 2004

UB LDAP Schema Object NameAttribute NamePermissionsExample TopobjectClass (required) aci Anon Admin top posixAccount person organizationalPerson InetOrgPerson eduPerson UBEduPerson PosixAccountuidNumber gidNumber homeDirectory loginShell gecos posixdat posixdat (*) /home/staff/tks/mruser /bin/tcsh Mike R User Personcn (commonName) (required) sn (surname) (required) telephoneNumber Anon (*) Anon Mike R User User OrganizationalPersonou (organizationUnitName) physicalDeliveryOfficeName title Anon (*) Anon Technical Services 123 Computing Center Unix Systems Analyst I

CAMP Directory Workshop Feb 3-6, 2004 UB LDAP Schema InetOrgPersondepartmentNumber displayName employeeNumber employeeType givenName labeledURI mail roomNumber uid (userID) userCertificate userSMIMECertificate Anon (*) Admin Anon Anon (*) Admin Anon Admin 0790 Mike R User staff Mike 123 Mruser eduPersoneduPersonAffiliation eduPersonOrgDN eduPersonOrgUnitDN eduPersonPrimaryAffiliation eduPersonPrincipalName eduPersonEntitlement eduPersonPrimaryOrgUnitDN Anon (*) Anon Admin Anon (*) staff student dc=buffalo,dc=edu ou=People,dc=buffalo,dc=edu staff urn:mace:incommon:entitlement:common:1 ou=People,dc=buffalo,dc=edu UBEduPersonUBEduPersonKswitch UBEduPersonSunycard UBEduPersonPersonNumber UBEduPersonEntityAbbr UBEduPersonPrimaryEntityAbbr UBEduPersonInfoRelease UBEduPersonDegree UBEduPersonLibraryBarcode UBEduPersonSENSHomedir Admin Anon (*) Admin tks cse tks Y BS /home/sens/foo/mruser

CAMP Directory Workshop Feb 3-6, 2004 SUNY Federation  The Four University Centers considering shibboleth on their campuses as part of AuthN/AuthZ infrastructure  Smaller Schools may need various levels of help.  SUNY Central Administration or ITEC – potential outsourcer or consulting services.  NMI “compliant”, eduPerson schema the foundation, SUNYPerson?

CAMP Directory Workshop Feb 3-6, 2004 SUNY System-Wide Strategy