Identity and Access Management Roadmap Presentations for Committee on Technology and Architecture March 21, 2012 Amy Day, MBA Director of GME IAM Committee Chair

Disclaimer – IAM Team Merger UCSF and UC Berkeley Budget implications –May change priorities –Shared projects: ID Match Core Registry Central Access Management Central Group Management

AD Flattening Consultant recommendations soon May include: –Standard log-on experience –Single username and password –Single set of tools for managing identity –Automated provisioning –Standard account life-cycle management $110,000 (already approved and funded)

Shibboleth Integration Support More support is needed to assist with and encourage integration with MyAccess Central support to facilitate MyAccess integrations Improve training materials Assist in developing enterprise integration requirements $150,000 (already approved and funded)

Documentation and Standards Documentation and standards are needed as services and applications are centralized Develop, clarify, and/or disseminate IAM standards and expectations: –For the use of single sign-on –Standard contract language –For integration with central IAM services –Etc. $30,000 (part of an FTE)

Person Profile Data Update Mechanism for UCSF staff, faculty, etc to update their own person profile data –Currently done through Human Resources for Campus employees –Already done in Medical Center Development of an application $80,000

IAM Disaster Recovery Infrastructure costs to build out an AIM DR environment Enable login via MyAccess if UCSF datacenter is down $50,000

LDAP Proxy Service Depends on plan of action for AD flattening Verify authentication across the various AD domains until they are consolidated $30,000

Two-Factor Authentication Out of compliance with policy/requirements for the processing of credit cards Proof of Concept two-factor implementation, using the OATH standard –Infrastructure –Integration with Shibboleth –Licensing costs $150,000 (Berkeley has $68,000)