Integrating Oracle Collaboration Suite into the Identity Management Infrastructure Dan Malone Cal Poly, San Luis Obispo Integrating Oracle Collaboration Suite into the Identity Management Infrastructure

Goals Provide a consistent user experience Provide a consistent user experience Provide account maintenance with minimal staff interaction Provide account maintenance with minimal staff interaction Follow ITS policies related to authentication and directory services Follow ITS policies related to authentication and directory services Integrate with existing infrastructure where possible Integrate with existing infrastructure where possible

Objectives address search against Enterprise directory for all clients address search against Enterprise directory for all clients Use established username and password Use established username and password Provide single sign-on by integrating with CAS Provide single sign-on by integrating with CAS Integrate non-web authentication with LDAP authentication Integrate non-web authentication with LDAP authentication Automate provisioning with well defined business rules based on enterprise data Automate provisioning with well defined business rules based on enterprise data

Directory Enterprise LDAP directory exists Enterprise LDAP directory exists Consistent search results across all clients Consistent search results across all clients Data protection already implemented Data protection already implemented –FERPA

Authentication Enterprise authentication services exist Enterprise authentication services exist –LDAP –CAS OCS has web as well as thick clients OCS has web as well as thick clients

Provisioning Fix the problems in the legacy provisioning processes Fix the problems in the legacy provisioning processes Provisioning Model Provisioning Model –It’s all about the data and managing the information Provisioning is based on information in the data warehouse Provisioning is based on information in the data warehouse –We can’t know how every application works Application owners are responsible for programming tasks on the application Application owners are responsible for programming tasks on the application

Provisioning Model

Project Information Implementation started in 2004 Implementation started in 2004 Involved many groups in ITS Involved many groups in ITS –Application Management –Information Management –User Support Services –Central Systems Support What expertise was needed? What expertise was needed? –Oracle, SQL, PL/SQL, PL/SQL Web Toolkit, working with Oracle Support –Understanding of web concepts Cookies Cookies Web forms Web forms –LDAP concepts –Know the data What tools were utilized? What tools were utilized? –PL/SQL D eveloper ( –Browser Extensions ieHTTPHeaders – IE ( ieHTTPHeaders – IE ( Live HTTP Headers - Firefox Live HTTP Headers - Firefox Add N Edit Cookies - Firefox Add N Edit Cookies - Firefox

What is current status? What is current status? Calendar in production January 23 rd, 2005 Calendar in production January 23 rd, in production May 13 th, in production May 13 th, 2005 –Migration of users (25,000) in progress thru summer What worked as expected? What worked as expected? –Directory Integration –Oracle Single Sign-on integration –Provisioning What has not worked as expected? What has not worked as expected? –LDAP integration

Lessons learned? Authentication and Provisioning are dependent on each other Authentication and Provisioning are dependent on each other –Can not be done one at a time Not everyone thinks Identity Management is cool Not everyone thinks Identity Management is cool –Sometimes you need to just tell them what their code needs to do Policy makers did not step up to the plate Policy makers did not step up to the plate –Task of defining provisioning business rules fell on app admins –Business rules were difficult for the application administrators Learned general concepts about how Oracle applications work Learned general concepts about how Oracle applications work Implement debug logging much earlier Implement debug logging much earlier Don’t expect to have a test plan that covers everything Don’t expect to have a test plan that covers everything Browser tools were invaluable Browser tools were invaluable Enabling Single Sign-on is not the end Enabling Single Sign-on is not the end “It’s fixed in 10g” – Oracle “It’s fixed in 10g” – Oracle “It’s fixed in 10g Release 2” – Oracle “It’s fixed in 10g Release 2” – Oracle

What help could you offer another campus? What we have learned about OCS What we have learned about OCS Oracle Single Sign-on/CAS code Oracle Single Sign-on/CAS code Provisioning Model Provisioning Model

Questions? Dan Malone – Cal Poly, San Luis Obispo