1. From Directory Steering to Identity Governance Experiences at CU-Boulder

2. Dog

3. Summary What we called Directory Steering at the time was really Enterprise Identity Management.

4. Conclusions There are two types of IdM governance. IdM governance activities happen in flurries related to specific projects. This is not ideal.

5. 2001 Directory Project Steering Team Member Criteria: Policy maker at campus or system level AND/OR Knowledge expert in how University conducts business

6. Task: Directory Policy http://www.colorado.edu/its/directoryservices/documents/policy.html Establishes –Directory Governance ; –Official Data Sources (the information systems from which the Directory will extract its data, create entries, and update entries, and upon which it will base its reconciliation) ; –Directory Inclusion (categories of people who will be included in the CU- Boulder Directory) ; –Directory Use (privacy requirements; who may have authenticated access to the Directory; who may pull data from the directory and for what purposes; and who must use the Directory)

7. Task: Affiliation Affiliation describes an individual’s relationship with the university. Affiliation will be used for two primary purposes: To determine whether services should be granted to the user (check performed via a directory- enabled system) To determine what information should be displayed and/or made public for the individual associated with the entry. Affiliation DISPLAY /QUERY Admitted Student  Confirmed Student  Parent?   Student   Staff   Faculty   Student Employee   Retiree  Employee Spouse  Alum  Sponsored  vendor?  contractor?  visiting faculty?   Directory-only Conference Attendee  SERVICE

8. And Even… dir list emailidke y labADmode m dhcpWe b host acctemem o libraryidcardRTDrecctrotherspecial conditio ns ContEd noncredit[1][1] no no[2][2]no no? no yes[3][3]no[4][4]no[ 5][ 5] yes PLU S;we b ct[6][6] current enrollm ent campus ministries no yes/n o yes/ no yes/no yes/ no yesno special id card clubs/orgs[7][7]no yes/n o yes/ no yes/no yes/ no yes ucsu- reg if stdent org. Expire date conference attendee[8][8] no yes/n o yes/ no yes/no [ 9] [ 9] yes/ no yes/no no yesyes[10 ][10 ] noyes web CT, wshc short term service vendor/contrac tor no yes/n o yes/ no yes/no yes/ no yes/no no yes/no (special ) no svcs vary by ven.; expire per vendor. CU Agency list[11][11] yes/ no yes/n o yes/ no yes/no noyes/n o yes/ no yes/nono yes/no alumnino (addr ) no yes[12 ][12 ] no yes[1 3][1 3] PLU S Foundation Staff yesno yes noyes

9. Ongoing Governance Structural and Logistical Prioritization of new development Review of data use requests (ie. Photo Class Rosters) New application access to Registry data “Local” vs. “Enterprise” identity data: Application specific extensions to directory. New Process and Policy Evolving groups, roles, and affiliations Delegated administration Non-person identities Multi-campus identities and federated between campuses and entities external to the university.

10. When Ad-hoc as needed to resolve issues related to specific projects (eg. desire for new “sponsored” affiliation type to support a new departmental application). May get bypassed because issue “not worth effort.”

11. Discussion Points Should the Structural/Logistical issues be addressed by same governance as policy and process issues (are they so intertwined that the structural issues can’t be pure IT design and management concerns)? The right balance for governance: –Frequent, regular involvement in the identity implications of any and all on-going projects. –Very infrequent high-level policy making, leaving the details to business process and application owners.