1. Identity and Access Management Services
Tom Jordan
Presented to Infrastructure Technical Advisory Group (ITAG)
November 20, 2017

2. Identity and Access Management Services
Agenda
Overview of Campus IAM services
Who’s using IAM services?
IAM Populations
Gaps / Campus Needs
Current Initiatives
Future Initiatives
Forums for campus feedback
How ITAG can help II
11/20/2017

3. IAM on Campus The IAM Problem Space
IAM On Campus (from IT Services Survey)
17 campus services for Identity Management
38 campus services for Access Management
7 campus services for Directory Services
Major campus providers:
Identity Registration
Directory Services
Account Management
Grouping / Provisioning
Person Data Delivery
Access Management
DoIT
Business
Athletics
AIMS
Computer Science
SMPH
Engineering
11/20/2017

4. Overview of DoIT IAM Services and Infrastructure
SIS
Identity Registry
Authentication
Services
On-Premise WebSSO Apps
NetID Login
Hosp
Madison Data Sources
Cloud Apps for UW Madison
WI Fed
SpecAuth
IDM/PASE
Credential Management
Common Systems Apps (on-prem and in the cloud)
MFA
etc
PHEXPORT
(Customer Data Views)
Directory
Services
UW Madison Directory-based apps and Infrastructure
LDAP
Active Directory
HRS
Office365
UWM
Google Apps
UW System Provisioning (OIM)
Cloud Directories
UW System Data Sources
UWW
Cisco Spark
UWGB
etc
UW Madison Provisioning (Regsync)
Enterprise Group Management (Manifest / Grouper)
Ad-hoc and data-driven grouping for authorization
Person
APIs
SOAP / REST
Person data APIs for developers
Messaging
Identity
Sources
Identity
Reconciliation
Identity Data
Management
Identity Data Integration
Identity Consumers
11/20/2017

5. Who uses IAM services? Principal Customers By IAM Service
UW Madison application owners / providers
UW Madison business process owners
By IAM Service
Person Data Views – about 300 data views*
Person Web Services – about 25 customers*
Directory Services – about 200 departments / subunits
Manifest – about 300 departments / subunits
SAML / NetID Login – about 1,500 applications
11/20/2017

6. UW Madison IAM Populations
Students (including SOAR, applicants and former students)
Faculty / Staff
Affiliates
Special Authorizations
UW Foundation
Visiting Staff / Researchers
Partner Agencies on campus (Forest Products Lab, USGS, etc)
UW Health / UW Medical Foundation
Pre-College Program
Summer Research Opportunities Program (SROP)
Lifelong Learners
Manifest-Invited Populations
UW System populations (students, facstaff, affiliates)
11/20/2017

7. Gaps / Issues / Campus Needs
Gaps in current infrastructure offerings
Scalable provisioning and deprovisioning for compliance and audit
Scalable support for Unix integration with directory services
Scalable automation by departments
Support for modern development tools and processes (REST APIs, ORM-friendly data models)
Support for stronger authentication types (MFA)
Technical debt in some IAM components
Gaps in populations / account types
Additional ‘affiliate’ populations
Social / External Identity integration
Non-person and Privileged Accounts
11/20/2017

8. Current Initiatives Initiative Gap Addressed Duo Deployment
Strong Authentication (MFA)
SpecAuth retirement
Technical Debt
REST-based Person API
Support for modern development toolsets
Message queueing for person data change notification
11/20/2017

9. Future Initiatives Initiative Gap Addressed
Self-Service attribute release
Scalable automation for departments
API-based access to group information
Unix integration with NetID authentication
Services for Unix environments
Person Hub refactor / replacement
Technical Debt
Service / privileged account management
Compliance and Audit
Improved provisioning / deprovisioning capability
11/20/2017

10. Service Feedback Individual Services
NetID Login –
Campus Active Directory –
Manifest -
Measuring Service Effectiveness / Customer Satisfaction
Meetings with campus departments in 2016
Customer Survey of IAM Needs – Early 2018
General IAM Feedback –
11/20/2017
blah

11. How ITAG could help Are we offering the right IAM services to campus?
How do we reach those units that are not engaged?
What other feedback venues should we be using to get feedback from our customers?
What are you hearing?
11/20/2017