Implementing a Role Management System Mair é ad Martin Carrie Regenstein Internet2 Fall Meeting September 20, 2005

2 Presentation Overview Drivers for role management at UW- Madison But what’s it going to take? The Populations, Affiliations & Service Entitlements (PASE) project –Architecture & Design –Infrastructure –Functionalities –Governance –Status & next steps Relationship to I2 Signet/Grouper

3 Driver #1: Identity Management “Cradle to Endowment” - Applicants, parents, students, staff, faculty, alumni, retirees, applicants, donors, visitors, guests, etc. Managed case by case in Special Authorization system

4 Driver #2: Access to Services Need to provide select services to extended institutional community but: “All or nothing” service entitlement based on credentials –Not clear who gets what services –Services with varied risk and load tolerance

5 Driver #3: Enterprise portal - “One stop shopping” concept - registration, enrollment, earning statements, library services, calendar, , etc. Affiliation and service lifecycle issues

6 Driver #4: Challenge or Opportunity? Seeking a strategic approach to an enterprise-wide problem Organizational, cultural, technical issues: –Who decides priorities? –Who decides policies? –“Who ya gonna trust?”

7 What’s it going to take? New institutional territory Clarify leadership and decision-making roles Strategic rather than “band aid approach”

8 CIO Office: Challenge & Opportunity #1 Undergraduate Applicants can access financial aid and admission status in the enterprise portal. They do not get any other services until they enroll and change status to Student.

9 CIO Office: Challenge & Opportunity #2 The Biology 105 affiliation aggregates all students taking Biology 105 course sections. This affiliation has access to the course management system, portal, calendar and library e-reserves.

10 #3, #4, #5 ………. A visiting professor needs access to the network and course management system. UW Hospital Employees need access to Parking application. UW Connections Students get almost the same services as UW- Madison students. …………………….

11 What’s it going to take? Define, represent, and manage lifecycle of affiliations Support ad-hoc as well as institutional affiliations Support delegated administration Separate AuthN/Z processes Determine who gets what Offer services selectively

12 What’s it going to take? Engage stakeholders, work collaboratively Establish appropriate governance

13 Populations, Affiliations & Service Entitlements (PASE) Initiated in 2002 Pilot with “Retirees” affiliation in 2003 Phase 1 Implementation: “PA” (Populations, Affiliations) in 2004/5 Phase 2 Implementation : “SE” and Interfaces in 2005/06

14 Reflecting the business process A sponsor (Source) person affiliation service provider who has registers which is mapped to which consists of which is owned by service bundle

15 Reflecting the business process: Undergrad Applicants Office of Admissions person Affiliation Of Undergrad Applicant Portal Access who has registers which is mapped to which consists of which is owned by service bundle Division of Information Technology

16 PASE Infrastructure Had to reengineer our University Directory Service (UDS) person registry

17

18 UDS v3 Separated identity and role management functions Standardized source feeds Put affiliation definition back in source systems Abstracted business logic from code

19 Source Systems ISIS Students Instructors Advisors Applicants UDS v3 Source Systems Union Parking Services Rec Sports Libraries UW-MSN University Directory Service v3

20 PASE System Oracle tables: PL/SQL functions Interfaces –Java for user interfaces –Web services Shibboleth

21 PASE Functions Create Delete Enable Disable Assign person to Add attribute to Remove attribute from  Affiliation  Service

22 PASE Affiliation & Service Management Entitlement: Map Services to Affiliations Query Functions –Is Eligible? –Is Member of Affiliation? -List affiliations/services by members or owners -Get service/affiliation

23

24 Governance Requested by campus at PASE campus forum –PASE Policy Group Identity Management Leadership Group formed Jan Charged by Provost and CBO Led by Data Custodians Focus - IdM, PASE, Access to Data and Smart Card Initiatives

25 Governance IMLG membership: –Registrar (co-chair) –Director of HR (co-chair) –Head of Libraries –Director of Facilities –Chief of UW Police –Director of UW-MSN Union –Head of Continuing Studies –CIO Office/Division of IT

26 Governance Process Meets monthly Charges sub groups with deliberating on and presenting policies: –PASE Policy Working Group –PASE User Interface WG –PASE New Hires WG –One ID Card WG –Access to UDS Data WG

27 PASE Policies & Processes Role of agents: sponsor, service providers, IMLG, administrators Institutional vs.. other affiliations and services Process for service entitlement negotiation Security Framework: –Authorization –Session management, etc.

28 1.Technical 2.Functional 3.Policy PASE Project Team PASE User Interface 4.Governance PASE Policy PASE New Hires Identity Mgmt Leadership Group As seen by Mairéad

29 1.Governance 2.Policy 3.Functional PASE Project Team PASE User Interface 4.Technical PASE Policy Identity Mgmt Leadership Group As seen by Carrie PASE New Hires

30 PASE Phase II ( ) System development: –Service and entitlement engine –PASE interfaces: provisioners, connectors, user interfaces –Infrastructures PASE policies and processes Security framework

31 Relationship to Internet2 Signet/Grouper PASE predates Signet/Grouper efforts - not around when we got started in 2002/03 PASE enterprise-wide system PASE not a separate registry but integral to our UDS registry Looking at Grouper APIs

32 Contact Info Mair é ad Martin Carrie Regenstein

33 PASE Glossary Affiliation: A person’s relationship to the institution. A person can have zero, one or many affiliations. An affiliation is similar to a role. Authorization: Typically, authorization indicates what a person, properly authenticated, is permitted to do with a networked object or resource. Entitlement: Association of an affiliation with a service. Population: Registered persons or persons that can be identified by means of a Publicly Visible Identifier (PVI).

34 PASE Glossary Service: One or more activities represented in business terms. A service can either be totally automated (e.g., the mail system) or partially so (e.g., Rec Sports). Services of interest to this project are protected by an authorization process. Service Bundle: A set of one or more services. An example of this might be the bundle of services that all current members of the community get. In PASE, access privileges are defined by mapping one or more affiliations to a service bundle. Service Entitlement: The specific, more granular, actions within a service, e.g., Update student data.

35 PASE Glossary Service Provider: The organizational entity responsible for a service. Sponsor: The UW entity that proposes new affiliations possibly registers new groups of people into the UDS and possibly also defines a person’s affiliation(s).