1. Current Middleware Picture Tom Barton University of Chicago Tom Barton University of Chicago

2. MACE: Objective & Modus Operandi Promote deployment of common middleware infrastructure across higher ed Practices, standards, models, tools, documentation to facilitate campus design & implementation Community-based, community-driven Early adopters, working groups Liaison, collaboration with other middleware communities Demonstrate viable models to vendor community

3. Current activities span … … typical dimensions of middleware for management of security Directories, identifiers, schema Authentication Authorization Messaging Diagnostics Operational practices but …

4. … take account of realities that are particularly higher ed Students Courses Multiple affiliations Multiple authorities and authority structures Self-identified activities Loosely affiliated populations Activities that span many organizations

5. Selected Harvest Recent releases eduPerson (200604) Enterprise Authentication Implementation Roadmap Higher Education Person Survey Use Cases: AAMC Identifier in Identity Management Systems Shibboleth 1.3d Signet 1.0 Grouper 0.9 Nexus pre-release 3 And a few integrative moments

6. Identity & Access Management: Functional Vocabulary VerbObjects ReflectData of interest from systems of record into registry, directory JoinIdentity information across systems ManageCredentials, group memberships, affiliations, privileges, services, policies Provide IAM info via - relay thru run-time request/response - provisioning into App/Service stores Authenticate (AuthN)Claimed identities Authorize (AuthZ)Access or denial of access LogUsage for audit

7. Connecting Sources of Authority

8. LDAP Attribute Management & Delivery: Affiliation, Privilege, & Privacy uid: jdoe eduPersonAffiliation: … isMemberOf: … eduCourseMember: … eduPersonEntitlement: … SIS HR Distributed Authorities/ Self Loaders Person Registry Group Registry Grouper Privilege Registry Signet Core Business Systems Shibboleth/ GridShib Attribute Authority Attribute Release Policies ShARPe Subject API Nexus

9. Finishing What’s On Our Plate Shibboleth 2.X & openSAML 2 Delegation, standards-based webSSO Enhanced management (AU partnership) Signet 1.X & Grouper 1.X Signet API, UI customization, XACML Group math Common rules engine, final Subject API

10. Finishing What’s On Our Plate Documentation Integrated story of when & how to deploy tools Concrete scenarios harvested from early adoption Toolset integration Harmonious design: configuration, internationalization, installation, site integration, composability

11. Tour of related track sessions Tuesday Federations – 1:15 EDDY – 3:00 FWNA – 4:30 VO Management – 4:30 Wednesday Preparing for Shibboleth – 8:45 Roles & Privileges – 1:15 PKI & USHER – 1:15 Inter-campus resource sharing – 3:00 Accessibility – 4:15 Managing Middleware – 4:15