Campus Active Directory Update Jim Green, Academic Technology Services Victor Lounds, Administrative Information Services Dave Carter, College of Agriculture Matt Stehouwer, College of Natural Science

ATS Active Directory Update Jim Green Manager, Identity Management Team Academic Technology Services

Background Summer, 2009 – U. of Iowa visit by AIS and ATS upper management Proposal for ATS Identity Management-operated AD domain – w/Kerberos, LDAP/Directory services, Netid, Shibboleth Fall 2009 – research, setup for Computer Labs standalone domain – Penn State, U. of Iowa conference calls Spring, 2010 – ATS reorganization – ATS’s “services” domain, Mel Micke joins Identity Management

Short term goals Research to discover best practices for designing/operating AD infrastructure Support Windows login in the Computer Labs Evolve into a generalized institution-wide service offering – AD infrastructure for a centrally-supported MS Exchange service offering – Other authentication/authorization applications, e.g x Coordinate with AIS and other units Work toward a coherent plan

Computer Labs AD domain Standalone domain – To be replaced by proposed central AD domain Will be rolled out to all labs by Fall, 2010 Four domain controllers Populated with all MSU netids, not just current Licensed via machine CALs Authenticates via pass-through to MIT Kerberos – Kerberos registry patch applied to workstations

Tentative design proposals Top level domain Authentication with MSU netid and password – Pass-through or sync Populate with current faculty, staff, students, affiliates Populate with attributes needed for authorization – E.g. departments for x, etc. MS Exchange, other service offerings to be operated by ATS Systems & Infrastructure team Delegated management through Organizational Units

Coordination Activities Meetings with College of Agriculture and College of Natural Science AIS shared consultant’s report and information about their AD initiative Working group formed with representatives from Ag, Nat Sci, AIS, and ATS Joint testbed put up

Issues Competing priorities, notably including EBSP Licensing Is Identity Management the best location for this service? Organizational and policy logistics Security Design choices to best meet MSU institutional needs

AIS Active Directory Update Victor Lounds, Administrative Information Services

What has AIS learned from our Development Environment? After discussions with Microsoft AD support groups and contractors we were able to identify several issues A multi-domain forest does not scale A domain is not a security boundary Although an empty forest can separate higher level roles, it does not gain any additional functionality or reliability Single Forest / Single Domain

How can a centralized AD be managed? Establishing methods for Adding Removing Tracking changes Reporting Naming Conventions Establishing a Processes for Administrative Changes

What about Kerberos & Active Directory? MSUNet Kerberos authentication is a concern because of… o Password Management o AD / MSU Kerberos o Test o Q/A o Production

CANR and CNS Active Directory Update Dave Carter, College of Agriculture Matt Stehouwer, College of Natural Science

Sharing of Resources Exchange SharePoint Knowledge Datacenter Cost CANR and CNS Partnership

Exchange CANR Forest CANR Forest CNS Forest CNS Forest SharePoint One way trust Resource Forest FIM TMG FIM – Forefront Identity Manager

Shared DataCenter at Computer Center

ANR & CNS Environment

Campus Active Directory Under Testing

Campus AD Campus Resource Forest College Forest Exchange AD Servers MIT Kerberos FIM

Campus Active Directory Update Jim Green, ATS– Victor Lounds, AIS - Dave Carter, CANR – Matt Stehouwer, CBS –