1. ~60 staff 1.Collaborators around the world 2.Supports communities of collaborators external to Internet2 3.Community uses wiki, mailing lists, instant messaging, voice conferencing services 4.Doesn’t want to be in the identity issuance business for external collaborators 5.Need to allow external + internal collaborators to use same service instances A Short description of Internet2

2. A Middleware Unified Field Theory Identity Management / Directories Privileges / Groups Single Sign-On / Federation Diagnostics Enterprise Integration from network to application Michael R Gettes Internet2 October 2007 An interpretation of the original MACE mission

3. What do we want? Inter-Enterprise Workgroup Collaborations not sexy

4. or C ollaborative O rganizations CO

5. Identity Groups Privileges Federated Access

6. and … Applications “It’s the App stupid!”

7. Give COntrol To COmmunity Members

8. Integrate with Existing COmmon IT Infrastructures in Higher Education

9. Flexible Scalable Modular

10. COmponents S H I B B O L E T H LDAP-PC Signet Grouper LDAP Directory Identity Mgr Applications & Network COCO

11. stop talking start walking demo COmanage.internet2.edu

12. COmponents S H I B B O L E T H LDAP-PC Signet Grouper LDAP Directory Identity Mgr Applications & Network COCO

13. Comanage … is only a demonstration of the CO model a CO fits within a service delivery strategy

14. Application Management App Access to data is managed by LDAP (initially) Identity data can be distributed by any desired mechanism in the future. SQL databases, feeds, message bus technologies.

15. Truth be told… LDAP-PC Large-Scale Performance and namespaces SIGNET Minor UI and Deployment GROUPER Some UI and Large-scale Performance SIGNET only immediate concern

16. Many COs on a single server (if you wanna do that) Grouper/Signet/LDAP-PC Identity Mgr Grouper/Signet/LDAP-PC LDAP Application set

17. No local identity issued for external users to access CO services big win! O=University,c=US ou=People(this is where 50K fac/staff/stu might reside) ou=CO(external identities for CO go here) ou=Groups(a place to store groups for all) Example directory tree for CO environment Applications pointed here for identities yields the union of internal and external

18. Future… Begin addressing issues of “attribute eCOnomy” Protect CO by Identity Provider… can solve “IEEE problem”? Web site wants to know: Are you a member of IEEE? My University IEEE-CO This org has membership data but does not manage identity - a CO with only external users. User Home Identity Provider

19. Diagnostics Lifting up shib log files and making EDDY deposits Creating a unified and federated view of diag data Network data: flows, snort, snmp System stats: cpu, i/o, mem, etc… Infrastructure: shib, ldap, authN, etc… Application: http, confluence, sympa, calendar etc, etc, etc… http://web.cmu.edu/eddy

20. Network Layer? Why not? Integrate with Grids? Why not? Addresses VO scenarios? Why not?

21. V O VO? CO

22. Make your opinion known… Should Internet2 use COmanage for service delivery? Rick Summerhill rrsum@internet2.edu Cheryl Fremon cmfremon@internet2.edu and kjk@internet2.edu and gettes@internet2.edu

23. it’s all about /me done Talk amongst yourselves