Integrating Applications with the Directory Andrea Beesing CIT/Integration and Delivery June 25, 2002

Authentication/Authorization/ Access Authentication Authentication –What: Verifying the identity of the user –How: Kerberos Authorization Authorization –What: Verifying user has authority to run application or business process –How: Permit Server/Application (current)  Directory (future) Access (to Data) Access (to Data) –What: Determining data user can manipulate/view with the application or business process –How: Application-specific

Directory for Authorization – How Directory has a “Group” object which holds a membership list Directory has a “Group” object which holds a membership list Need to map each role to one or more groups Need to map each role to one or more groups Application simply queries directory (via LDAP) as to groups user is a member of to learn what roles a user has Application simply queries directory (via LDAP) as to groups user is a member of to learn what roles a user has

Directory for Authorization – Benefits Streamlines the maintenance of application security across campus Streamlines the maintenance of application security across campus –Associating a person with a role or group is done once, not within each application –Simplifies task of removing access when an individual changes status

Best Practices to Start With Keep it simple Keep it simple –Use directory to define membership –Data access rules defined within application Begin with definition of global groups/roles (student, staff, faculty, payrep) Begin with definition of global groups/roles (student, staff, faculty, payrep) Avoid proprietary schemas Avoid proprietary schemas

Issues Directory must be more fully populated Directory must be more fully populated How is membership in groups/roles maintained How is membership in groups/roles maintained –Driven from central system –Determined by local unit –To what extent can it be automated? Can a generic distributed application be designed for memberships that require manual maintenance? Can a generic distributed application be designed for memberships that require manual maintenance?

Big Issue – The NetID Question What about people who don’t qualify for NetIDs? What about people who don’t qualify for NetIDs? What is “legitimizing” ID for inclusion in the directory? What is “legitimizing” ID for inclusion in the directory? –NetID –PeopleSoft EmplID –Guest or temporary (“dirty”) ID

Driver is HR/Payroll/Alumni Affairs suite of Applications This suite includes This suite includes –PeopleSoft HR/Payroll/Contributor Relations –Actuate, Brio –Colts, Kronos, PEDL, SES, EE –CU Connect PeopleSoft 8, Actuate and Brio allow mapping of roles to directory groups PeopleSoft 8, Actuate and Brio allow mapping of roles to directory groups

Getting Started Admin units must agree on definitions of global groups and roles Admin units must agree on definitions of global groups and roles Admin units must agree on how membership in groups and roles is maintained Admin units must agree on how membership in groups and roles is maintained Technical team must work with developers and security administrators to help them understand how each application interfaces with the directory Technical team must work with developers and security administrators to help them understand how each application interfaces with the directory