1. User Provisioning Project Design Phase Presented to ITLC March 24, 2011 David Walker, ITAG Co-Chair Information and Educational Technology, UC Davis Mary Doyle, ITAG ITLC Liaison Information Technology Services, UC Santa Cruz

2. Project Team Dede Bruno, UCOP Chet Burgess, UCOP Dedra Chamberlain, UCB Mary Doyle, UCSC Datta Mahabalagiri, UCLA Tony Merriweather, UCLA Jeff McCullough, UCB Benn Oshrin, UCB David Walker, UCD Albert Wu, UCLA

3. Overview Charge from the ITLC Recap of work through September 2010 Actions at September 28, 2010 ITLC meeting Work on design phase Next steps Possible value to shared systems (PPS/HR) Discussion

4. The Charge from ITLC 1.ITAG should recommend a specific middleware platform/approach to evaluate and pilot 2.ITAG should consider various projects/initiatives that could serve as a pilot for the approach 3.ITAG should present thoughts/observations relating to resources required to complete a successful pilot.

5. ITLC Meeting September 28, 2010 Recap of work through September 2010 Approval to begin work on design phase Further work approval contingent on design plan to be complete in early 2012 (or accelerated depending on PPS/HRIS interface) Allocation of up to $30k funding Funding plan proposal needed

6. Work Through September 2010  High level design  Roadmap for future phases  Potential use cases

7. Proposal for User Provisioning  A Service Provider (SP) specifies the identity attributes it requires and the people it requires those attributes for.  Identity Providers (IdP) configure their Attribute Release Policies (ARP) for the SP. The IdP also defines the group of its community members required by the SP.  At a time determined by the SP, the SP requests all attributes allowed by the ARP.

8. High-Level Design

9. Proposed Project Phases and Tasks Phase 1 Detailed Planning – 16 weeks* commencing January 28, 2011 and completed April 30, 2011 1.1Staffing/Recruiting 1.2Develop Detailed Project Plan 1.3Develop Detailed Architecture (*timing adjusted to reflect actual duration estimates as of March 17, 2011)

10. Phases and Tasks continued…. Phase 2 Design, Build, Test – Approximately one year 2.1Technology evaluation and selection 2.2Develop Communications Plan 2.3Design and Implement Common IAM Interface 2.4Prepare Product Documentation 2.5Test, QA 2.6Release Product 2.7Pilot Deployment

11. Phases and Tasks, continued….. Phase 3 Deployment (~ 9 months done by each UC location) 3.1Implement Group Manager (Grouper) 3.2Implement eduPersonTargetedID 3.3Campus policy, procedure, relationships for brokering requests 3.4Integrate Common IAM Interface with local IAM (Snapshot) 3.5Integrate Common IAM with local IAM (Subscription and Change Log)

12. Design Phase  Kick-off meeting @ UCOP January 28 th  Create conceptual design  Create component diagram  Create use case diagram  Complete detailed design – end of April  Review of design – early May  Request approval to move forward at May ITLC meeting

13. Conceptual Design

14. Component Diagram

15. Use Case Diagram

16. Next Steps Gain understanding of similar work occurring outside UC through consultation with non-UC IdM resources to validate approach and finalize design Complete detailed design Continue to conduct bi-weekly check-ins Explore potential relationship to PPS/HRIS project needs

17. Funding Proposal Travel reimbursement for in-person meetings January 28, 2011 next meeting TBD

18. Can User Provisioning Support PPS/HRIS? With the release of the PPS/HRIS rfp and the impending selection of a vendor, depending on the winning proposal, is there an opportunity to leverage the work of the user provisioning project in the PPS/HRIS project?

19. Discussion Questions/comments?

20. UCTrust Status Presented to ITLC March 24, 2011 David Walker, UCTrust Work Group Co-Chair UC Davis Dedra Chamberlin, UCTrust Work Group Co-Chair UC Berkeley

21. Current State  UCTrust Basic certifications  All campuses, plus LBNL and UCOP, except...  UCSB very soon  Current UCTrust Work Group Activities  Assessment of InCommon Silver with UCITPS  Interoperability with UCTrust Basic  Single certification process  Next generation campus IAM software components  The user provisioning project

22. Potential 2011 UCTrust Activities  Required by user provisioning project  Group management  TargetedID  User-controlled attribute release  Administration of virtual organizations  Guidance for service providers  Useful attributes and identifiers  Determination of required level of assurance  When should an application be federated?