1. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org

2. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org B ANNER I NTEGRATIONS F AIRFIELD U NIVERSITY Michael Graham-Cornell Director, Computing & Network Services mgraham-cornell@fairfield.edu

3. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org A GENDA  The user experience with CAS, BEIS, and Shibboleth  CAS Overview  BEIS Overview  Shibboleth Overview  What we had  What we did  What we have  Benefits and Gotchas

4. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org U SER E XPERIENCE N UMBER 1 – MY.F AIRFIELD Staff requests my.Fairfield Active my.Fairfield Session? Active CAS Session? User logs into CAS No Yes User granted access CAS

5. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org U SER E XPERIENCE N UMBER 2 – B ANNER Staff requests Banner Forms or Self-Service Active Forms Session? Active SSOManager session? Active CAS Session? SSOManager: Lookup login ID or PIDM via UDCID User logs into CAS No Yes User granted access SSOManager UDC_Identifier

6. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org U SER E XPERIENCE N UMBER 3 – S TUDENT G MAIL Student accesses mail.student.fairfield.edu Active Gmail Session? Active Shibboleth Session? Active CAS Session? Gmail access granted User logs into CAS No Yes Shibboleth eduPersonPrincipalName

7. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org O VERVIEW OF CAS

8. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org O VERVIEW OF BEIS  Provides Inbound Account Provisioning Outbound Account Provisioning Single Sign-On (only part we’re using today)  Uses UDCIdentifier The UDCIdentifier is an unchanging, system-generated, 32- character, alphanumeric value. Like: 36BE6D6D18560C44E0440003BA33B440 Banner tables map UDCID to PIDM and Oracle logins

9. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org B ANNER S INGLE S IGN - ON TO S ELF -S ERVICE

10. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org B ANNER S INGLE S IGN -O N TO F ORMS S ERVER

11. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org O VERVIEW OF S HIBBOLETH

12. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org W HAT W E H AD  Banner (“Person” System of Record) – LOCAL NETWORK  Sun Identity Manager (NetID and Password System of Record) – LOCAL NETWORK  Sun Directory Server (LDAP) – LOCAL NETWORK  Shibboleth Identity Provider (IdP) – LOCAL NETWORK  Gmail Service Provider (SP) – IN CLOUD  Library Database Provider (SP) – IN CLOUD

13. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org W HAT WE DID – A LL ON F AIRFIELD N ETWORK  Install CAS in Test  Install CAS Service Manager  CASify Shibboleth  Install BEIS, including SSOManager  Populate Banner with UDCID’s (BEIS utility)  Propagate UDCID’s to our LDAP Directory  Install BEIS add-ons to CAS  Configure CAS Service Manager to accept Banner services

14. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org W HAT WE NOW HAVE  All of above, plus:  Shibboleth now proxies to CAS  CAS Authentication for all SSO applications, including: Banner (Forms, Self-Service, WorkFlow, BDMS), Gmail, myCampus, in-house applications, Blackboard (9.1 SP8 this summer), EZProxy (summer)

15. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org B ENEFITS  CAS is a very secure and robust SSO environment  CAS easily integrated into PHP and.NET applications (preferred for in-house authentication)  We now support CAS and Shibboleth Service Providers – very flexible and easy to configure  Only authorized service providers can authenticate  Legacy applications can still authenticate through LDAP, but are rapidly being “CASified”  Banner Forms, Self-Service, Workflow and BDMS use CAS authentication

16. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org C AVEATS /G OTCHAS  Lots of moving parts require lots of testing Verify multiple logins in same browser session Verify timeouts Verify all browsers  Time – took us about six months  Ellucian documentation for reconfiguring CAS to support BEIS assumed no Service Manager  Watch out for CAS version. Ellucian recommended CAS 3.4.2.1 (also support 3.2.1.1 and 3.3.1)  Forms and Self-Service support multiple authentication methods simultaneously, but WorkFlow and BDMS do not  Because our CAS server is local, and portal is in the cloud, we have been dealing with time-sync issues

17. live. learn. work. play. 1111 Superior Ave E Suite 310 Cleveland Ohio 44114 Tel: 216.589.9626 Fax: 216.589.9639 info@campuseai.org http://www.campuseai.org