1. CASE STUDY: UNIVERSITY OF CALIFORNIA, DAVIS

2. UNIVERSITY OF CALIFORNIA, DAVIS Implemented Rice 1.0.0 in October 2009 Integrated home-grown Faculty Merit & Promotion system in February 2010 Upgraded to Rice 1.0.3.1 in August 2010 Integrated Kuali Financial System – phased implementation – August 2010 2

3. UCD KIM IMPLEMENTATION UC Davis has a homegrown aggregation system that pushes identity data into LDAP Identity Service is integrated with LDAP Makes calls to LDAP Service library which returns DTOs representing objects in any of three directories “Parses” the DTOs to build Entity and Principal objects [ getEntityInfo(), getPrincipalInfo(), etc. ] Authentication is configured for CAS KIM is the system of record for Roles, Groups, Permissions, and Responsibilities 3

4. IDENTITY DATA MAPPING Entity ID : Universal User ID in LDAP Principal IDs User Account IDs from account provisioning system exposed in LDAP System generated Principal Names Kerberos Login IDs from account provisioning system exposed in LDAP User defined Principal Names can change over time, but Principal IDs do not

5. FUTURE PLANS Upgrade to Rice 2.x – 2012 Kuali Financial System – full implementation – 2012 Kuali Coeus – 2012 Integrate KIM with Sun Identity Manager / Sun Role Manager Identity Roles Groups (possibly leverage Grouper & Sun products) Permissions & Responsibilities (maybe) 5

6. CASE STUDY: THE UNIVERSITY OF ARIZONA

7. THE UNIVERSITY OF ARIZONA Working on a KFS implementation UA netid is used for authentication Identity information is available in UA’s Enterprise Directory Service (EDS) Connect to EDS using Spring LDAP and overriding the KIM IdentityService In order to use the KIM GUI’s properly, the UIDocumentService is also overridden

8. KIM WITH LDAP Identity information is available in UA’s Enterprise Directory Service (EDS) Uses Spring LDAP as an adapter layer between Spring and LDAP datasource Uses KIM ParameterService to map between KIM and LDAP attributes Implement / Override KIM IdentityService In order to use the KIM GUI’s properly, the UIDocumentService is also overridden

9. KIM WITH LDAP Setup Spring LDAP module <bean id=”contextSource” … <bean id=”authenticationSource” … <bean id=”springSecurityAuthenticationSource ” … <bean id=”ldapTemplate ” …

10. KIM WITH LDAP The Spring LDAP integration and Kuali Rice ParameterService are injected into the EdsPrincipalDaoImpl instance. <bean id=”edsPrincipalDao” class=”edu.arizona.kim.dataaccess.impl.EdsPrincipalDaoImpl”> The EdsPrincipalDaoImpl is an implementation of PrincipalDao which connects to EDS and maps the principal and entity information into KIM domain objects.

11. SPRING CONFIGURATION EXAMPLE …

12. FIELD MAPPING PARAMETER entityId=uaid; principalId=uaid; principalName=uid; givenName=sn; principals.active=eduPersonAffiliation; lastName=sn; firstName=givenName; employmentInformation.employeeStatus=uwRegid.*; employmentInformation.employeeId=uwEmployeeID; names.lastName=sn; names.firstName=uwPersonRegisteredFirstMiddle

13. VALUE MAPPING PARAMETER principals.active.Y=staff,faculty,employee; principals.active.N=student,alum,affiliate;

14. KIM WITH LDAP Rice ParameterService maps EDS attributes to KIM KIM ClassAttribute NameEDS Attribute Name KimPrincipalInfoprincipalIduaid KimPrincipalInfoentityIduaid KimPrincipalInfoprincipalNameuid KimEntityNameInfolastNamesn KimEntityNameInfofirstNamegivenName KimEntityEmployementInformationInfoemployeeId KimEntityEmployementInformationInfoemailemployeeEmail …

15. KIM WITH LDAP Implement and Override KIM Services kimIdentityService getPrincipal() getPrincipalByPrincipalName() lookupEntities() getEntityDefaultInfo() … UiDocumentService loadEntityToPersonDoc() saveEntityPerson()

16. CASE STUDY: UNIVERSITY OF WASHINGTON

17. THE UNIVERSITY OF WASHINGTON Integration with.NET Completed a proof of concept Future plans for Rice, KFS, Kuali Student Existing Homegrown systems Several integration points

18. THE UNIVERSITY OF WASHINGTON LDAP integration KIM integration with home-grown system Hybrid solution Secure web services Source control and build process

19. THE UNIVERSITY OF WASHINGTON Kuali App Server Astra LDAP UW Org WS SAGE UW Security Handler UW Entity Service UW KIM Group Service UW KIM Role Service KIM RoleType Service Business Users End Users UW Workflow Service SAGE Post Processor Devs Kuali Rice Portal UI End Users

20. LDAP INTEGRATION Spring LDAP & Spring Security Modules Encryption Configuration Spring System parameters Mapping

21. ROLES AND GROUPS INTEGRATION JAX-WS used to generate Java classes Roles Mapped directly to ASTRA roles using convention ASTRA “span of control” mapped to KIM qualifiers Groups Mapped to specific roles within ASTRA

22. WORKFLOW INTEGRATION SimpleDocumentService Routing calls (create, route, approve, etc) Post Processor Callbacks through web services Notification to external system Route status changes (saved, initiated, enroute, final, etc) Route node changes (who has responsibility now) Qualifiers

23. OUTCOME AND FUTURE PLANS Highly functional All major integration points completed Code contributions Team confidence What’s Next?