Account Management, The Next Generation Unified Directories at the Rochester Institute of Technology Dan Tobin Matt Campbell

About RIT RIT is one of the nation’s top comprehensive universities and sets the national standard for career-oriented education. Located in suburban Rochester, N.Y., RIT is a private university that enrolls more than 15,500 students in its eight colleges. RIT is recognized for its programs in business, engineering, art and design, photography, science and mathematics, liberal arts, computing, and many other areas.

Early Campus Computing Computing services on campus initially consisted of isolated systems saw the first multi-user system with accounts issued to all students. –This was the primary account system for the next decade. –Managing accounts was relatively easy with only one system to contend with.

Enter Complexity The rise of the World Wide Web led to a demand for Unix servers. As became increasingly mainstream, LDAP was deployed to provide an RIT directory. Other services, such as file sharing further complicated the process of managing user accounts.

Systems Abound Accounts now needed to be created in the following locations: –DCE Server –LDAP Server –VMS Cluster –Tru64 Unix Cluster –Samba Server

High Level Requirements Synchronize as many passwords as possible. Provide a centralized method to update all accounts for a user. Make the system easily expandable. Build as much cross-platform code as feasible. Updates should occur in real-time. Budgets are tight, resources are low. Minimize expenditures.

A Modular Solution HelpDesk Web Client Master Server Platform Specific Module Platform Specific Module Platform Specific Module Platform Specific Module Oracle Database

Resources One full-time co-op student and two part- time student employees were hired for this project. One full-time staff member managed the project. This kept costs relatively low and gave real world experience to RIT students.

Key Benefits Modules can be added without the need to update the entire system. Centralized control of account updates insures synchronization of information. Accounts can be added for all systems with only one tool. Off load considerable amounts of system support.

Two years pass…

New Directory As the existing systems continued to age, the demand for a replacement grew. Microsoft Exchange was selected as the solution. With Exchange came the need for an Active Directory environment. Therefore, another account base was added.

Too Many Passwords Accounts now needed to be created in the following locations: –DCE Server –LDAP Server –VMS Cluster –Tru64 Unix Cluster –Samba Server –Kerberos Server –Microsoft Active Directory

New Requirements Unify information across all directories. Provide self-service applications to reduce HelpDesk calls. There also emerged a need for more detailed information to be contained in the directories. Users wanted to be able to manage their own “identity” information. These requirements demanded slight changes.

COTS? Off the shelf solutions were sought to provide the directory integration. The IBM Directory Integrator was determined to be the best. During evaluation of this product, we came to the realization that our current systems was already 90% of the way there. Due to the proprietary nature of the IBM product, and the amount of development time required to integrate it into our environment, the decision was made to expand our own existing software.

A Modular Solution HelpDesk Web Client Master Server Platform Specific Module Platform Specific Module Platform Specific Module Platform Specific Module Oracle Database

Small Changes Self-Help Clients

New Benefits A platform independent interface API allows for rapid tool development. Self-Help applications off load HelpDesk support. One step closer to a single username and password for all RIT services. Hooks into the system allowed for password database migration, without the need to make all users change their passwords at once. Groups could be created in Active Directory and LDAP for classes, colleges, departments, etc.

Groups A breakdown of the groups synchronized across directories: –7 Divisions –10 Centers –20 Colleges –380 Departments –717 Academic Programs –490 Disciplines –5225 Courses –11846 Course Sections And this is just the start!

New Caveats Existing tools must be removed, disabled, or restricted. –Ex: Unix passwd command, Active Directory Users and Computers –Ex: LDAP updates restricted to software only Adding a single point to update accounts also adds a single point of failure. Self-help tools allow for self imposed problems. –Ex: Giving users the ability to update their forward also gives them the ability to forward it into the bit bucket in error.

Application Demonstration

The Future The immediate future of the system will be a shift from simple account management to more inclusive identity management.

More Information Related RIT presentation: Track 3 Seamless University: Physically Consolidated, Logically Distributed Thursday, October 21, :10 a.m. – 9:00 a.m. Meeting Room 103 This session presents RIT's efforts to consolidate and integrate various services, such as account management and directory services, and still provide flexibility, better manage costs, and move toward a seamless university.

Questions? Dan Tobin Matt Campbell