1. Identity Management in the Environment of Mendel University in Brno Milan Šorm

2. 26. března 2007SDI 2007, ZČU v Plzni2 Contents University in numbers Historical identity management Ideal solution University information system Current implemented situation Known problems Results Future ideas

3. 26. března 2007SDI 2007, ZČU v Plzni3 University in numbers Medium-sized university 12 000 students 2 000 employees 2 000 other users in campus 4 faculties, 80 departments 5 000 prepared network connections 3 500 PCs 50 user servers

4. 26. března 2007SDI 2007, ZČU v Plzni4 Historical identity management No centralized identity management No policy for building servers interconnecting department networks accessing network environment creating accounts connection information services to netword More than 20 admins Totally decentralized

5. 26. března 2007SDI 2007, ZČU v Plzni5 Ideal solution One account credentials for one user Setup policy for connecting all PCs, servers and services to netword environment One place to define AAA for all services Minimize number of network admins Centralized storage for data and profiles Single sign on Maximum HA

6. 26. března 2007SDI 2007, ZČU v Plzni6 University information system In last 7 year we reconstruct all small IT services and production ISs to one central complex information system with integrated data warehouse This information system can be source of all information about our users and their credentials, rights, roles etc. Unique source of informations

7. 26. března 2007SDI 2007, ZČU v Plzni7 University information system Public information portal

8. 26. března 2007SDI 2007, ZČU v Plzni8 University information General object qualify principle We can describe any group of objects (users, computers, departments, segments, roles, rights etc.) and identify them by IDs We can put these groups to relations and prepare source of all AAA informations All of these informations are dynamic Example: students and schedules

9. 26. března 2007SDI 2007, ZČU v Plzni9 Current implemented situation Many meetings with server and service administrators and IT departments lead to setup one policy in creating account (UIS based, algorithmized) setting groups, rights, quotas through Technology subsystem in UIS by power users (owners, specialists) accessing network and creating new services is maintained through central IT department

10. 26. března 2007SDI 2007, ZČU v Plzni10 Current implemented situation University IS Data warehouse Primary LDAP server LDAP replicas Services

11. 26. března 2007SDI 2007, ZČU v Plzni11 Current implemented situation UIS prepare all data for identity management in central data warehouse (Oracle 10g) Application logic stored in DW (PL/SQL) create and update primary LDAP server (OpenLDAP) with all credentials LDAP push data to LDAP replicas All IT services are connected to one or more LDAP replicas for AAA services

12. 26. března 2007SDI 2007, ZČU v Plzni12 Current implemented situation All faculty and university services are connected to this AAA infrastructure For accessing network you need: registered computer through computer authorization in UIS Technology subsystem account in AAA infrastructure for accessing network (eduroam connector, dormitories net connector, public network access during conferences etc.)

13. 26. března 2007SDI 2007, ZČU v Plzni13 Current implemented situation Consolidation of IT services centralized e-mail distributing system centralized file server services systém standardization of classrooms installations UIS know for each user his personalized policy: where user read e-mails desktop information fileserver connections …

14. 26. března 2007SDI 2007, ZČU v Plzni14 Current implemented situation Classroom computers access central server farm for roaming Windows or Linux profile These profile has defined scripts for attaching other resources E-mail is passed through distribution server which run antispam and antivir and distribute e-mails to user favourite e-mail server Samba or AD solution Linux PAM solution

15. 26. března 2007SDI 2007, ZČU v Plzni15 Current implemented situation Information about allowed classrooms is stored in LDAP and Samba/Linux classroom servers or stations use them for managing login process All other information (home directory, roaming profile, other resources) is accessed through dynamically created profile and scripts called from this profile

16. 26. března 2007SDI 2007, ZČU v Plzni16 Current implemented situation Many other IT services access central LDAP UIS web interface Catering service (Anete Kredit) Network accessing service (eduroam, Faro) VPN concentrator HelpDesk software Impromat copy centre Old e-learning services Services on faculties

17. 26. března 2007SDI 2007, ZČU v Plzni17 Known problems Changing passwords (only through UIS) Two profiles (Linux, Windows) Absence of SAP connector Not all things are online (e.g. e-mail groups, destroying of accounts…) No implementation of single sign on Less security due to only one account credentials

18. 26. března 2007SDI 2007, ZČU v Plzni18 Results One login, one password, one account system, no account administrator Only 2 central administrator on university Very popular for basic user Very popular for technology owners Many statistics information Only start point on long journey for mobile work at university

19. 26. března 2007SDI 2007, ZČU v Plzni19 Other results Implemented also for our customers: Slovak Technical University (26 000 users) Technical University in Zvolen (6 000 users) Škoda Auto University (1 000 users, in progress) Current situation: changed to central information systém activated primary LDAP generation first replicas installed some services connected

20. 26. března 2007SDI 2007, ZČU v Plzni20 Future ideas Single sign on Mobile profile through VPN Adding printing profiles to LDAP User friendliness interface for administrators Using of virtual desktop infrastructure Using of some other identity tokens (cards, USB flash drives, tokens) Building PKI over this solution

21. 26. března 2007SDI 2007, ZČU v Plzni21 Thank for your attention. Any questions?