6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 1 Enterprise Directory Implementation Roadmap – Directions Provided Art Vandenberg Director, Advanced Campus Services Georgia State University “Copyright Art Vandenberg This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.”

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 2 Roadmap – Introduction

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 3 Roadmap’s Layered Detail Roadmap Intro & main sections (5 pp.)Roadmap –Project Planning, Prep & Requirements –Architecture Design, Policy Development –Data Flow, Business Process –Implementation & Deployment Next level, outline of topics (24 pp.) Detail level articles, documents, links (~340 pp.) Dual tracks: Technical & Policy Technology/architecture & policy/management activity work together GOAL: directory-enable applications Directories reflect (variety of) institutional goals and environments

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 4 Roadmap – Project Planning Develop business case, secure support (educate, assemble drivers, business case) Develop project plan Decide on implementation strategy, timing, and organizational approach Develop communications and PR plan Discuss with stakeholders when appropriate Develop project specifics Assemble resources (funding, structure, communication plan) Articles, documents, templates, links – READY TO USE!

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 5 Roadmap – Architecture & Policy Campus identifier strategy –Guidelines, templates, examples –Do you know where your identifiers are? Directory Services Architecture –Models, recipe, schemas for higher education Education and communication Policy and process development

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 6 Identifiers, Authentication & Directories Directory components (1,000 words)

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 7 Directories & Details! Best Practice Design for LDAP Directory Schema –Flat as possible - minimizes update overhead –UID unique across tree –Create “campus person” (CampusEduPerson) –Use dc naming: dc=yourschool, dc=edu –... and more Naming –Choose distinguishedName (DN) carefully –UID rather than commonName (Jim Smit, Jim Smit?) You have a rich Roadmap to guide you

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 8 LDAP Recipe Recommendations to lead to common directory schema and deployments Started 2000, living doc, now 30 pp. Good source of information – USE THIS! Directory Information Tree (DIT) –Dc naming (leverage Domain Name System) –Ou=people, dc=yourschool, dc=edu –uid=avandenberg, ou=people, dc=gsu, dc=edu

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 9 Non-flat, non unique uid, no dc-naming o=Georgia State University ou=Information Systems ou=ACSou=UCCS cn=Art Vann cn=Jan Smit cn=Sue West cn=Mae Jones cn=Jan Smit Cn=Jan Smit, ou=ACS, ou=Information Systems, o=Georgia State University

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 10 Flat, unique uid, dc-naming dc=edu dc=gsu ou=peopleou=unit uid=avann uid=jsmit uid=jsmit2 ou=acs ou=uccs uid=jsmit2, ou=people, dc=gsu, dc=edu

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 11 eduPerson object Class LDIF (LDAP Data Interchange Format)... dn: cn=schema changetype: modify... add: attributetypes attributetypes: ( NAME 'eduPersonAffiliation' DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX ' ' )... add: objectclasses objectclasses: ( NAME 'eduPerson' AUXILIARY MAY ( eduPersonAffiliation $ eduPersonNickname $ eduPersonOrgDN $ eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlement $ eduPersonPrimaryOrgUnitDN $ ))

Directory Architectures -cont’d

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 13 Working with Stakeholders Who are the stakeholders? –Technical, functional, management, users... –What are key application drivers? Get that buy-in! Ad hoc or formal committees? Stewardship (preferred) vs. ownership –Data administration – how’s it done? Identifying policy gaps is important Establish same enterprise focus as for ERP systems

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 14 Roadmap – Data Flow & Business Process Integrated provisioning architecture: –data sources/providers –data flow & meta-processes –Application targets/consumer Chicken & egg: business flow & technical –You have to solve it together (functional & technical) Keeping that in mind… let’s look at overall concept

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 15 Directory Business Flow consolidation, intelligence, provisioning

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 16 Select Meta-Directory Model Enterprise directory / metadirectory Physical or virtual “person registry” Data load requirements Provisioning model for consumer apps ETL (extract, transform, load) tools Integration/synchronization services

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 17 UMBC Meta-Directory Source systems: HR and SIS with data in Oracle RDBMS Database triggers create change logs Updates applied to iPlanet LDAP Perl scripts query iPlanet change logs –update Active Directory –Update Remedy trouble ticket Perl scripts = intelligence iPlanet directory = registry

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 18 BC Meta-Directory Source is the registry (corporate DB, VSAM files) Single entry point/identifier create (even Peoplesoft) Identity reconciliation moot Student & HR “activate” user, marking for feed Fed to iPlanet, , voic , Radius, etc. Transactions real-time or batch (ftp & update scripts) Initial user entry/activation/script triggers = intelligence

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 19 Business Process Design/Impact Policies & procedures of existing systems of record –Human Resources, Student, Financial, Alumni, ancilliary… Can you leverage an existing initiative? What are directory update or service targets? Directory use policy (users & applications) Is there a Data Stewardship Policy? Do users know how their data is used? New identifier issues (new identifiers, new issues both)

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 20 Roadmap – Enterprise Directory & Applications Implementation Requirements & Analysis complete... –Business processes, data flows complete –Meta directory architecture complete Design –system & network, schema (eduPerson), metadirectory flow Implement –LDAP server, eduPerson data load, access controls, applications Deploy –testing, verification, transition & release to ops

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 21 The Communication Plan Who knows what and when? Content and context for the plan Words to live by: –No surprises! Manage expectations. “Under promise, over- deliver.” Phased approach with multiple communication modes Optimal result: –Deliver what they want, which just happens to be what you are offering...

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 22 Repeat as needed…

6 Nov 2003 A. Vandenberg © Teach A Man to Fish Educause 2003 Anaheim, CA 23 Contact Enterprise Directory Implementation Roadmap Art Vandenberg Thank you