2-Oct-0101 October 2001 Directories as Middleware Keith Hazelton, Senior IT Architect University of Wisconsin-Madison Keith Hazelton, Senior IT Architect University of Wisconsin-Madison

2-Oct-01 2 Directory Middleware Outline Richer sets of objects in the directory Groups and roles via directories Directories playing nicely together Specific projects: DoDHE, Shibboleth, Digital Video

2-Oct-01 3 MACE-Dir Background Advice on institutional directories: LDAP Recipe, Early Adopter work Clarification of how to use existing attributes New object class for inter- institutional needs: eduPerson 1.0

2-Oct-01 4 Richer sets of objects in the directory Eduperson enhancements: Internationalization New values for eduPersonAffiliation

2-Oct-01 5 Richer sets of objects in the directory eduOrganization object class: Institution-level attributes As needed to support inter- institutional applications

2-Oct-01 6 Richer sets of objects in the directory Other objects in the directory: Applications Services Devices

2-Oct-01 7 Richer sets of objects in the directory Apps, services, devices: Build on pre-existing efforts Grid Information Services CIM Learning Mgmt. Systems

2-Oct-01 8 Groups and roles via directories Key questions: How to represent groups How to create and maintain them

2-Oct-01 9 Groups and roles via directories Current problem: No agreement on how to do this Off-shelf applications hard- wired & mostly wrong servers, portal engines…

2-Oct Groups and roles via directories The two kinds of info requests: Is person x a member of group y? Give me a list of all members of group y (and some additional info re each)

2-Oct Groups and roles via directories Is person x a member of group y: Access control question: Does x belong to the group of people authorized to use this resource or service?

2-Oct Groups and roles via directories List of members of group y: Mailing list creation Provisioning (accounts, class lists)

2-Oct Groups and roles via directories Work plan re groups in directory: Draft a “good practices” doc. Vet draft with stakeholders Encourage adoption of good practices (institutions, vendors)

2-Oct Directories playing nicely together Discarded goal: Single huge institutional directory with all attributes anyone and any application will ever need

2-Oct Directories playing nicely together New goal: One institutional directory that manages identity across IT systems; Plus a federation of special- purpose directories complementary to above

2-Oct Directories playing nicely together Core challenge: managing identity across a collection of directories, each of which is authoritative for a different set of attributes. Even across institutional boundaries

2-Oct Directories playing nicely together The least understood of all the problems on the directory list Video conferencing, video on demand, and Grid applications driving demand for solutions

2-Oct Directories playing nicely together Privacy issues will be central As will the proper division of labor between directories and databases As will metadirectory solutions

2-Oct Specific projects: Directory of Directories for Higher Education White pages application spanning higher education First application to rely on early MACE-Dir work: LDAP Recipe, eduPerson 1.0

2-Oct Specific projects: Directory of Directories for Higher Education Next steps: Expansion of list of participating schools Help on policy concerns re “one stop shopping” for HE directory information on the internet

2-Oct Specific projects: Directory of Directories for Higher Education User interface design (see Eisenberg presentation)

2-Oct Specific projects: Shibboleth Authenticate locally, access resources globally Secure sharing of authorization information between home institution and target site

2-Oct Specific projects: Shibboleth Attribute authority: Draws on institutional directory services Pilot apps will leverage eduPerson, but additional attributes needed for some

2-Oct Specific projects: Shibboleth Person taking a for-credit course at a different institution: Need to define, create and share new data elements Shibboleth will drive directory evolution

2-Oct Specific projects: Video conferencing VIMM will generate long list of what could be done better MACE-VidMid early deliverable: design for authenticated, controlled access to video streams

2-Oct Specific projects: Video conferencing Major vendors working with VidMid: Promise of vendor support for standards that emerge gives directory aspects high priority

2-Oct Conclusion These projects fit the MACE-Dir profile: Directory middleware work must be driven by actual application needs

2-Oct Conclusion Targeted applications are inter- institutional or institution to vendor. But MACE-Dir work generally seems to have immediate local utility as well