1. Outsourcing IAM in North Carolina
A Statewide IAM Managed Service for K-12
San Francisco, CA
November 14-15, 2013
Mark Scheible and Steve Thorpe, MCNC

2. Introduction
“Managing Identity and Access in an Era of Distributed Services” – CAMP 2013
From the NCEdCloud IAM Project…
Challenges (Problem Statement):
1.  Too many accounts for current Services
2.  Cumbersome manual process of updating account information from NC Student System to disparate local systems and services
3.  Need solid foundation for K-12 cloud solutions growth 2

3. Background…
2 years of learning, interviewing, planning (IAM Architecture Plan – 250 pages)
RFP (long drawn out process)
Vendor Selection
Proposals
Face-to-Face Interviews & Proof of Concept
IAM Service Contract Awarded - April, 2013 to iDENTiTY AUTOMATiON 5

4. Organizations involved
NCDPI - NCEdCloud Sponsor (RttT Funding)
Friday Institute - NCEdCloud Program Manager
MCNC - NCEdCloud Service Manager
Identity Automation - NCEdCloud IAM Service Manager and Provider 6

5. Simple Goals
Provide all K-12 staff, students, parents and guests with a single login to all NCEdCloud Target Applications and Services as well other cloud services that are utilized by numerous LEA's.
Provide self-service capabilities to all end users and delegated management tools to all LEA administrators. 7

6. Numbers… Initial Scope: Employees: ~250,000 Students: ~1.5 Million
LEAs (School Districts) – 115 (2,500 schools)
Charter Schools – 111+ (growing)
5 Target Applications Year 1
Future Scope:
Guardians: ~3 Million
Guests: Unknown
10 Target Applications per year 8

7. Core Components
Person Registry: a component of the core infrastructure that provides an identity data warehouse for the NCEdCloud IAM Service. This registry is responsible for matching, merging and cleansing of data as it comes from the sources.
Central Directory: a component of the core infrastructure that provides a directory service for the NCEdCloud IAM Service. The Central Directory is the authoritative source for the NCEdCloud Username and password. It is also the source of all target system integrations whether by SAML, LDAP or direct provisioning. 9

8. Core Services
My NCEdCloud - The interface for end users and administrators that will provide self-service and delegated administration capabilities
NCEdCloud SAML IdP - The service that will provide sign-on capabilities to cloud systems that support the SAML protocol and implementation
NCEdCloud Sync - The service responsible for managing the lifecycle of accounts across ALL systems (including the Target Applications) – provision, update, deprovision 10

9. Infrastructure
The NCEdCloud IAM infrastructure will be hosted in Amazon's AWS environment. This service provides unlimited scaling as well as a world class high availability platform (across three east cost data centers) 11

10. Year 1 Target Services By March 2014: Google Apps for Education
Central Directory Local Replica (CDLR)
Zscaler – cloud-hosted firewall, content filtering
Follet Destiny
Discovery Education 12

11. Schedule Assessment Phase - Completed April 30, 2013
Design Phase - Completed June 30, 2013
Build Phase - Completed July 31, 2013 (Development)
Test Phase - Completed November 8, (Test)
Deployment Phase (Production)
November 11, March 31, 2013 for early adopters
Full Production
Available April 1, 2014 for remaining LEAs and Charters 13

12. Challenges The RFP Process The Data Sources – ALWAYS a challenge
Procurement was a lengthy process with many state procedural requirements
Funding came from RttT, but was administered by the NCDPI
NCDPI was overseen by the State IT Agency
Bottom Line – you NEED a champion (with influence)
The Data Sources – ALWAYS a challenge
Communication with the Vendor 14

13. Current Focus
LEA/Charter School Onboarding Process (for Early Adopters) - Currently working with 10 EAs
Application Form (online)
Onboarding Checklist (Readiness Review)
Planning Session (In Person or Remote)
Creation of Governance Body (Oversight/Steering)
Plan for Integrating “Home Base” Applications
Pearson PowerSchool, OpenClass, SchoolNet
True North Logic (TNL) – Teacher assessment, PD 15

14. Future Opportunities Federation of the NCEdCloud IdP
Regional Federation (NCTrust)
InCommon
Use of NCEdCloud (K-12) student credentials to access local Higher Education resources
Early College High School programs (piloting)
In State Admissions
Integration with CommIT ? 16

15. Information… ncedcloud.mcnc.org NCEdCloud IAM Web Site
Overview videos of the IAM Service
Documents (slides, IAM Plan, Service Management Plan)
ncedcloud.mcnc.org
Mark Scheible –
Steve Thorpe –
Sammie Carter (Friday Institute) – 17