© University of Reading Go to View > Master > Slide Master to put your unit name here 20 April 2014 IT Services Identity Management

To put your footer here go to View > Header and Footer2 What is identity management? The management of data that relates to an individuals identity Use of that data – Data is created – Data is shared – Data is used to determine an individuals access to resources

To put your footer here go to View > Header and Footer3 Why manage it better? Improved accuracy and consistency of data Improved efficiency of processes Reduced security risks

To put your footer here go to View > Header and Footer4 How do we plan to do this? Using Microsoft Identity Lifecycle Manager Phased Identity Management Project

To put your footer here go to View > Header and Footer5 How ILM works ILM connects multiple data sources. These do not have to be compatible with one another Data from these sources is combined into a single unified view within ILMs metadirectory For each item of data the authoritative source is determined ILM imports that data from its authoritative source and using pre- defined rules updates other connected systems Data can change in its authoritative source at any time ILM checks for changes at pre-determined intervals Can also be triggered to perform an immediate run

To put your footer here go to View > Header and Footer6 Example ILM Metaverse RISIS BB Student no Name Dept Course Username Student no Name Course Username Student no Name Dept Course Username

To put your footer here go to View > Header and Footer7 First phase project goals Unique identifier per individual Propagation of identity data Increased automation of user account provisioning and de-provisioning More timely, accurate provision and removal of access Role based access control Content free usernames Web accessible communications directory

To put your footer here go to View > Header and Footer8 Solution overview

To put your footer here go to View > Header and Footer9 Unique identifier Generated by ILM for each individual Links staff and student information 8 digits

To put your footer here go to View > Header and Footer10 Propagation of identity data Authoritative source Self service Replacement of existing batch data feeds

To put your footer here go to View > Header and Footer11 ILM provisioning ILM detects & imports data from RISIS, HR or Remedy ILM either generates unique UoR id or joins to existing metaverse object ILM generates username and address ILM provisions record into AD Attributes passed to Exchange which provisions the mailbox and GAL entry (staff) ILM passes mail address and other attributes to the UNIX mail ADAM from where mailboxes are created (student and external) A home drive is created with filestore quota set according to user status ILM provisions record into Remedy (staff & student) ILM provisions record into the communications directory ADAM (staff) If a member of academic staff ILM provisions record into the tutor table in RISIS Username and address exported back to originating system

To put your footer here go to View > Header and Footer12 ILM deprovisioning ILM has a delayed action provisioned for leave-date + 1 When leave-date + 1 is reached – ILM disables AD account – Users home drive permissions updated by removing windows permissions and writing Windows Administrator permissions. – Remedy updated and in grace period begins – User removed from communications directory – If academic employee then RISIS tutor record set to not in use – Second delayed action provisioned for leave-date + grace period When leave-date + grace period is reached – AD account deleted – Remedy status set to deleted – User removed from UNIX mail ADAM – Home directory removed – Username and removed from originating system – Third delayed action provisioned for leave-date + 1 year + 1 week When leave-date + 1 year + 1 week is reached – Remedy record is deleted

To put your footer here go to View > Header and Footer13 More timely provision / removal of access Enabling and disabling of accounts happens on an individual basis rather than as a batch process Staff accounts created earlier Automation forces the University to define rules Rules are then applied more accurately and consistently Auditors are happier

To put your footer here go to View > Header and Footer14 Role Based Access Control A copy of attributes relating to role, such as dept, status, year of entry etc, can easily be maintained by ILM in a connected ADAM. Client systems connecting to this ADAM can use this role data to determine an individuals access rights in their own system.

To put your footer here go to View > Header and Footer15 Content free usernames Inconvenient to change username when dept or status changes. These changes are becoming increasingly common. An individuals username will no longer change. Information contained in the current username structure will be made available through an ADAM. New usernames will consist of 6 randomly generated chars, aannnn. Existing usernames will remain unchanged but should be regarded as content free. A new employee will only be given 1 staff username. A new student will only be given1 student username. Where an individual is both an employee and a student they will be given 1 for each role. A web based equivalent of the PERSON command will be created before ILM is implemented.

To put your footer here go to View > Header and Footer16 Communications directory A web accessible communications directory will be created This will always be as up to date as the HR system Employee self service will enable staff to maintain name and telephone number data themselves

To put your footer here go to View > Header and Footer17 Timescales Most of the development work has been done Next step is data cleansing and testing Plan to go live in April 08

To put your footer here go to View > Header and Footer18 Future Developments Use of ILM to gradually replace batch data feeds between systems Development of more refined role based access control Consider having 1 username per individual Consider more frequent data synchronisations if demand for it