1. Identity Management – Why and How Experiences at CU-Boulder Copyright Linda Drake, Director of Development and Integration, University of Colorado, Boulder, 2007 This work is the intellectual property of the author. Permission is granted for this material to be shared for non- commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

2. Why? Drivers for IdM Fundamental principle: role-based access Faculty: faculty course toolkit (email rosters, photo rosters, web grading) Students: registration, grades, financial aid Staff: address update, benefits enrollment, online pay advice Affiliate: library services (as a state resident), email Blended identity – combination of faculty, student, staff, affiliate roles from multiple sources

3. Why? Drivers for IdM Timeliness Services are available as soon as access is needed Access is automatically provisioned – no need to request Access is automatically deprovisioned when role changes

4. Why? Drivers for IdM Security Simplify password management and reset Workflow enforces policy – no “friends and family” program

5. Why? Drivers for IdM Administration Consolidate account management – AD, email, WebCT Simplify our environment, delegate management duties Replace home-grown and deprecated middleware solutions

6. Where are we and how did we get here? Directory Services (aka Enterprise IdM) 2001: implemented a campus-wide directory The “ED” – enterprise directory comprised of: Registry – relational database LDAP directories Blend identities from 3 major sources – Human Resources, Student Information System, “uniquid” (unix-based account management system) First service was “white pages” – online person directory

7. Where are we and how did we get here? Technology is easy – Policy is really hard Directory Services governance board – the key to success Define affiliations and associated services Require new services and applications to be directory- enabled http://www.colorado.edu/its/directoryservices/documents /policy.html On Beyond Z - http://www.educause.edu/ir/library/pdf/EQM0243.pdf

8. Where are we and how did we get here? Sun Identity Manager Purchased in 2005 after lengthy evaluation Implementing with aid from Aegis, USA consultants Phase I complete – hardware and software installed, LDAP adapter for new email system ready Next steps – replace “uniquid” account management system, develop provisioning adapter for WebCT CE 6.0, develop self-service tools (password mgmt, etc)

9. HR SIS CIW Registry Update Registry DB CU_People DB PLUS WebCT MetaMerge ED LDAP LDAP Directories Local copy WebCT Uniquid CS Rosters Student e-mail AD First dot Last Andy-Net Database Extracts Sponsored Entry IT Service & Support Managed Services IT Partners DURM Identity Management today Hesiod (DNS) CUConnect

10. Identity Management SIS HR LDAP Resources Database Resources Customer Nickname Identity Management future

11. Questions ?