1. Middleware: Addressing the Top IT Issues on Campus
Renee Woodten Frost Internet2 and University of Michigan
Midwest Regional EDUCAUSE March 26, 2003

2. Outline Set the context Define middleware Outline the top 10 issues
Discuss the relevancy of middleware
Introduce NMI-EDIT
Highlight available resources and educational opportunities
EDUCAUSE Midwest Regional March 24, 2003

3. What is IT being asked to do?
One stop for university services (portal) integrated with course management systems
-for-life
Automatic creation and deletion of computer accounts
Submit and/or update information online
Browser or desktop preferences follow you
EDUCAUSE Midwest Regional March 24, 2003

4. More on the “to do” list Multi-campus scanning electron microscopes
Integrated voic , , and faxmail for Advancement staff
Secure PDA and wireless support
All-campus announcements (spam)
Expensive library databases shared with other schools in the system …
EDUCAUSE Midwest Regional March 24, 2003

5. What do all of these have in common?
Are the people using these services who they claim to be?
Are they a member of our campus community?
Have they been given permission?
Is their privacy being protected?
EDUCAUSE Midwest Regional March 24, 2003

6. What is middleware?
Suite of campus-wide security, access, and information services
Integrates data sources and manages information about people and their contact locations
Establishes electronic identity of users
Uses administrative data to assign affiliation and gives permission to use services based on that role
EDUCAUSE Midwest Regional March 24, 2003

7. Definitions: Identifiers
Identifiers– your electronic names
Multiple names and corresponding information in multiple places
Single unique identifier for each authorized user
Names and information in other systems can be cross-linked to it
Admin systems, library systems, building systems
HR, SS, department alumni, stud org., athletic, housing,
Legal name – sign your name
Bio Betty letting certain information about her sent to U of Beta
EDUCAUSE Midwest Regional March 24, 2003

8. Definitions: Authentication
Authentication – links the physical you to an electronic identifier
Password authentication most common
Security need should drive authentication method
Distance learning and inter-campus applications
Dean of Students – how did we map him to his electronic name in the first place?
How did he prove it? 2 methods of id or did he call up on the phone
Bio Betty – Alph U vouched for her; Univ of Bta is taking this for granted; what if they find out that Bio Betty didn’t prove her identity to the school and was given an id and was really Tara the terrorist…?
EDUCAUSE Midwest Regional March 24, 2003

9. Definitions: Authorization
Authorization services – allowing you to use services
Affiliated with the school (role)
Permitted to use the services based on that role
Dean – turn access on and off for offenders
Mary – suite of service that were turned off (student)
Troubled todd – delegated his authorization to access his information to his assistant. Did want to do it all the time, just in an emergency.
EDUCAUSE Midwest Regional March 24, 2003

10. Definitions: Enterprise Directory Services
Enterprise Directory services - where your electronic identifiers are reconciled and basic characteristics are kept
Very quick lookup function
Phone number, address, campus identifiers
Machine address, voice mail box, box location
Basically a storage spot that can thumb through and look up info for you really quickly
Biler bill – keeps location of preference information
EDUCAUSE Midwest Regional March 24, 2003

11. What is Middleware?
specialized networked services that are shared by applications and users
a set of core software components that permit scaling of applications and networks
tools that take complexity out of application integration
a second layer of the IT infrastructure, sitting above the network
a land where technology meets policy
the intersection of what networks designers and applications developers each do not want to do
EDUCAUSE Midwest Regional March 24, 2003

12. Map of Middleware Land
EDUCAUSE Midwest Regional March 24, 2003

13. Core Middleware
Middleware makes “transparent use” happen, providing consistency, security, privacy and capability
Identity - unique markers of who you (person, machine, service, group) are
Authentication - how you prove or establish that you are that identity
Directories - where an identity’s basic characteristics are kept
Authorization - what an identity is permitted to do
Public Key Infrastructure (PKI) - emerging tools for security services
EDUCAUSE Midwest Regional March 24, 2003

14. 2002 EDUCAUSE Current Issues Survey
Criteria
Important for strategic success
Potential significance in next year
Most time consuming for leaders
Most resource intensive
10 issues most significant
Issues were significant to at least 3 of the questions…portals were added because of their high potential to being significant in the next year.
EDUCAUSE Midwest Regional March 24, 2003

15. The Top Ten Issues Administrative Systems/ERP IT Funding
Faculty Development, Support, and Training
IT Strategic Planning
Security Management
Online Student Services
Teaching and Learning Strategies
Distance Education
Maintaining Network Infrastructure
Emerging Network Technologies
(Portals)
EDUCAUSE Midwest Regional March 24, 2003

16. Threads Woven Throughout
Money and Time
Integration
Policy Enforcement
Enhanced Security
Ease of Use
Capability to Iterate and Deploy Faster
Privacy management
EDUCAUSE Midwest Regional March 24, 2003

17. Money and Time Consolidated access management
Fewer staff for more applications
Fewer information repositories to manage
Fewer accounts to manage
Automated creation and deletion of accounts
EDUCAUSE Midwest Regional March 24, 2003

18. Integration Leverage existing infrastructures Data Network Services
Unique identifier is mapped to application-dependent identifiers
Network
Integrated sign-on
Services
Administrative and Course Management Systems
EDUCAUSE Midwest Regional March 24, 2003

19. Policy Enforcement
Access follows institutional policy and legal requirements
Business changes reflected in access
Dismissed students/staff have access to all services and buildings immediately revoked
EDUCAUSE Midwest Regional March 24, 2003

20. Enhanced Security More security minded Consolidation of Access
Status/role change alters service mix
Use of same identifier enhances auditing
Access to critical applications is concentrated
More security minded
EDUCAUSE Midwest Regional March 24, 2003

21. Ease of Use Directory-enabled applications Consolidated authentication
Reduce faculty need to update class rosters
Consolidated authentication
Reduces the number of userids/passwords
Move updating of information to ultimate data owner
Students update address information or destination of their forwarded
EDUCAUSE Midwest Regional March 24, 2003

22. Capability to Iterate and Deploy Faster
Use same authentication and identity infrastructure for new services
Extend services to new groups by adding to the directory
One group of staff responsible for implementing business rules
EDUCAUSE Midwest Regional March 24, 2003

23. Privacy management
Increasing need both to pass information about people for access and to protect privacy
Must have a central policy structure and related technical infrastructure for privacy management
Library applications where both authorized access and anonymity is critical
EDUCAUSE Midwest Regional March 24, 2003

24. Next Steps Develop project plan Decide on unique namespace
Review application and directory requirements
Pick initial target applications
Design and populate the directory with big picture in mind
Deploy directory and enable applications
EDUCAUSE Midwest Regional March 24, 2003

25. NMI-EDIT Consortium Funded by the NSF Middleware Initiative (NMI)
Enterprise and Desktop Integration Technologies Consortium
Internet2 – primary on grant and research
EDUCAUSE – primary on outreach
Southeastern Universities Research Association (SURA) – primary on NMI Integration Testbed
Higher-ed, government, corporate, research, and international participation
EDUCAUSE Midwest Regional March 24, 2003

26. NMI-EDIT: Goals
Much as at the network layer, create a ubiquitous common, persistent and robust core middleware infrastructure for the Research &Education community
In support of inter-institutional and inter-realm collaborations, provide tools and services (e.g. registries, bridge PKI components, root directories) as required
EDUCAUSE Midwest Regional March 24, 2003

27. NMI-EDIT: Core Middleware Scope
Identity and Identifiers – namespaces, identifier crosswalks, real world levels of assurance
Authentication – campus technologies and policies, inter-realm interoperability via PKI, Kerberos
Directories – enterprise directory services architectures and tools, standard object classes, inter-realm and registry services
Authorization – permissions and access controls, delegation, privacy management
Integration Activities – common management tools, use of virtual, federated and hierarchical organizations
EDUCAUSE Midwest Regional March 24, 2003

28. Enterprise Middleware Educational Opportunities
Pre-conference Seminars and track sessions at EDUCAUSE Annual and Regional Meetings
Campus Architectural Middleware Planning Workshops
CAMP, Boulder CO – June 4-6, 2003
CIO and Technical staff
Best practices in middleware deployment
Check the site for announcement or past conference proceedings
Advanced CAMP, Boulder CO – July 9-11, 2003
Highly technical
Research topics
EDUCAUSE Midwest Regional March 24, 2003

29. On-line Resources Available
Introductory Technical and Management Documents
Sample Middleware Business Case and Writer’s Guide
Identifiers, Authentication, and Directories: Best Practices for Higher Education
Identifier Mapping Templates and Campus Examples
And more….
See Enterprise Directory Implementation Process Site coming in April on
For more information, contact Ann West or send mail to
EDUCAUSE Midwest Regional March 24, 2003

30. Questions? Renee Woodten Frost Internet2/University of Michigan
EDUCAUSE Midwest Regional March 24, 2003