FSU Metadirectory Project The Issue of Identity Management Executive Overview

Outline Definitions Review of existing FSU enterprise-wide identities Demos of eDirectory software Desireable metadirectory features FSU Metadirectory Project Plan

Some Definitions Directory: list of users of a computer system –Examples: accounts (admin, mailer, garnet), NWRDC, PeopleSoft identity, Windows signon, Novell signon, Blackboard signon, dialup signon, etc. Metadirectory: “directory of directories”

Some Definitions eDirectory: Software product purchased from Novell that provides metadirectory services (an example of middleware) LDAP: Popular software protocol used for authentication Active Directory: Microsoft metadirectory product

Common FSU Identities C.A.R.S. (”ldap1”) –Captures all students, faculty & staff (+50,000 accounts) –Tied into automated systems on campus, such as FSUcard, HRMS, etc. –Used for authorizing “garnet/mailer” servers, dialup service

Common FSU Identities C.A.R.S. (”ldap1”) –Blackboard authentication (~33,000 students)

Common FSU Identities O.P.S. (Secure Login; ”ldap2”) –Captures all students, faculty & staff (+100,000) –Tied into automated systems on campus, such as FSUcard, HRMS, etc. –Used for authorizing many administrative applications (many, but not all of which will be replaced by PeopleSoft functionality)

Common FSU Identities Administrative –Managed in the enterprise “FSU” Microsoft Active Directory –Semi-manual account management –Mostly used by some ~6,000 administrative employees

Common FSU Identities Netware Account –Provides file service –Managed by User Services –Semi-manual account management –Mostly used by some ~6,000 administrative employees

Common FSU Identities PeopleSoft Account(s) –Many instances exist –Need for integrated authentication

Common FSU Identities PeopleSoft Portal

Metadirectory Demonstrations eDirectory demo # 1: Demonstrate simple use of the metadirectory to manage ERP VPN access First, let’s look at a simple functional diagram of the pieces and how they fit together:

Demo # 1 Small population Small task Easy to implement Will be integrated into large-scale metadirectory

Metadirectory Demonstrations eDirectory demo # 2: “Hire” a new employee in PeopleSoft; see their Microsoft Active Directory/Exchange account get automatically created Uses the Metadirectory testbed, which looks like:

Demo # 2 Metadirectory “testbed” Allows for metadirectory development in the “lab” Ties together disparate systems Doesn’t require lots of horsepower

Desirable MetaDirectory Features One single “public” FSU electronic identity –Call it your “FSUid” –Proposal: “First Name Initial, Entire Last Name, Unique –Must “grandfather” in existing identities –Capture all possible, reasonable attributes from existing directories –Merging schemas: 20mapping%2010_14_03.xls 20mapping%2010_14_03.xls

Desirable MetaDirectory Features “SSO” – Single Sign On. You use one FSUid and password to access many systems, once the system is connected to the eDirectory for authentication A nice “FSU identity” web page, where you can: –See all of your roles, as captured in the metadirectory –Change and synchronize your password across systems –Manage some attributes of your eDirectory entry

Desirable MetaDirectory Features Automation between systems –Hire a new employee, automatically get access to appropriate Outlook mailbox, Novell files, dialup access; transition person as roles change –eDirectory product allows for much customization Collaboration with departmental directories (other Active Directory trees, etc.)

Desirable MetaDirectory Features The “obvious” ones: –Secure connections to/from metadirectory –Reliable/redundant servers (in Novell parlance, “replicants” could reside in physically separate places on campus) –Quick response time (the “L” in LDAP ) –Well-maintained (backups, disaster recovery, problem solving, etc.)

What’s so special about eDir? Latest technology (Java, XML, etc.) Significant knowledge of eDir and DirXML in-house Novell consultants already have done initial PeopleSoft integration that can be re-used Complex data flow model allows for much flexibility:

Metadirectory Project Planning Integrated with PeopleSoft planning ERP VPN metadirectory in production now ½ day “Metadirectory retreat” scheduled for this Thursday Plan to have LDAP1/LDAP2/AD/PS Metadirectory in production by March ‘04 Track project at