Identity Management: The Legacy and Real Solutions Project Overview

Washington State University This work is the intellectual property of WSU. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the copyright owner. To disseminate otherwise or to republish requires written permission.

The Legacy WSU Network ID Integrated Business Systems Multiple Authentication Stores Disparate Authorization Methods No Single Sign-On No Metadirectory Ad Hoc Provisioning

Business Drivers Strategic Goal: “Seamless, Intuitive, Integrated” Aging technology (DCE, custom programs) Performance and reliability Management of NIDs Management of WSU affiliates (not eligible for NIDs) Increasing reliance on Active Directory

Project History Core team construction (2004) Representatives from ITS, College of Business, Libraries, Center for Teaching Learning and Technology Six months information gathering Microsoft Technology Center invitation Clarification of project goals

Project History Project divided into sub-projects  Single sign-on  Metadirectory services  Group services  WSU Friend IDs

Key Components Microsoft Active Directory (AD)  Authoritative source for NIDs  Authorization group structure Microsoft Identity Information Server (MIIS)  Metadirectory services for NIDs  Provisions AD groups

Key Components Microsoft Active Directory Federation Services (ADFS)  Single sign-on, internal federation Microsoft Authorization Manager (Azman)  Used in conjunction with claims (AD group structure) for authorization

WSU Enterprise Directory Services Intelligence & Business Rules Source Systems Active Directory Feed Authentication, Authorization, Attribute and Group Services Metadirectory Services Person Registry ADABAS Active Directory Online Phonebook Portal Database Portal OID UPS LDAP DCE Apps & Services Portal Feed Online Phonebook Feed NID Create Asynchronous Sources WSU Identity Management Architecture 2004 Consumer Systems WSU Core Business Systems Design Concept Courtesy of Thomas J. Barton, University of Chicago

Secure UNIX Web Server Secure zOS/CICS Web Server myWSU Oracle Portal DCE Security Server DCE Authentication AD Security Server Kerberos or LDAP Authentication Active Directory Services zOS Data & Backend Apps or Other Data Sources Distributed Secure IIS Web Servers Online Learning Environments Distributed Data & Backend Apps Local SSO Oracle External Apps SSO Network Services User AD Domain SSO Local Domain SSO Local Domain SSO Local Domain SSO WSU Network ID Authentication and SSO Environment 2004 NID Active Directory Enabled Apps DCE rpc Direct Natural Attunity

WSU Enterprise Directory Services Source Systems MIIS Authentication, Authorization, Attribute and Group Services Metadirectory Services Person Registry ADABAS Portal Apps DB Portal OID UPS SunOne Active Directory Apps & Services Portal Feed NID Create Asynchronous Sources Core Business Systems WSU Identity Management Architecture 2007 Consumer Systems ADFS Azman Active Directory Feed Intelligence & Business Rules Design Concept Courtesy of Thomas J. Barton, University of Chicago

Active Directory Group Structure WSU Authorization Groups Application Groups Enterprise Groups Provisioned Groups Role Groups Employees Employees.Appointed Employees.Active Students Students.Admitted Students.Enrolled Term Groups 2007_sum 2007_fall 2008_spr

ITS Secure IIS.NET ADFS Web Servers myWSU Oracle Portal Online Learning Environments ADFS Authentication AD Security Server LDAP Authentication ADFS Enabled Apps (Potential) Distributed Secure IIS.NET ADFS Web Servers Distributed Data & Backend Apps Network Services User ADFS Federation SSO WSU Network ID Authentication and SSO Environment Internal Federation 2007 NID EntireX Connx WSU ADFS Federation Server EntireX Connx ADFS Federation SSO ADFS Federation SSO ADFS Federation SSO ADFS Federation SSO zOS Data & Backend Apps or Other Data Sources