Single Sign-On Release Information. FAMIS Post-Conference Workshop June 26, 2013

Transcription

1 Single Sign-On Release Information FAMIS Post-Conference Workshop June 26, 2013

2 Agenda Welcome Overview Project Status Integration Decision Points System Demo On-boarding Steps Adjourn

3 Overview One web address One username and password Selection of FLDOE applications: FloridaSchoolLeaders.org Leadership Development Tool eipep Educator Preparation Institution Reporting Tool CPALMS Statewide Standards & Instructional Resource Tool PMRN Interim Assessment for Reading Interim Assessment Item Bank Test Platform English Language Arts Formative Assessment For STATE resources, not local resources Separate from district LIIS SSO minimum standards requirement

4 Current Experience State Resources Username & Password Set 1 Username & Password Set 2 Username & Password Set 3 Username & Password Set 4 Username & Password Set 5 Username & Password Set 6 Application 1 Application 2 Application 3 Application 4 Application 5 Application 6 Multiple web addresses, different usernames and passwords for each Administrators provision users with for each application/multiple sites

5 Future Experience State Resources Application 1 Application 2 Username & Password Set Application 3 Application 4 Application 5 Application 6 One web address, one username and password, access to multiple applications Administrators provision users from one source

6 Project Status On-boarding is open FLDOE SSO is available at Changed unique identifier and file formats VPN issue resolved for federated LEAs 6 LEAs are integrated Alachua (Hosted) Bay (Hosted) FLDOE (Federated) Hamilton (Hosted) Hillsborough (Federated) St. Lucie (Federated)

7 Project Status Documentation is updated LEA Integration & User Provisioning Specification, LEA Certificate of Readiness, FAQs, and Contacts are updated LEA Participation Form and MOU did not change LEA on-boarding steps are updated Application on-boarding schedule and the USDOE goal have not changed

8 Integration Decision Points Authentication Methods FLDOE-Hosted WS-Federated As of Tuesday, 6/25/13: 23 FLDOE-Hosted 21 WS-Federated 29 Unknown

9 Authentication Methods FLDOE-Hosted Requires user provisioning information One username and password issued by FLDOE using one security policy Users authenticate with FLDOE - (sts.fldoesso.org) No additional technology required No local Directory requirements WS-Federation Requires user provisioning information One username and password issued by the LEA using the LEA security policy *LEA Admins and Location Admins using the FIM Portal will have an additional username and password Users authenticate with LEA - sts.yournetwork.org Requires current SAML 2.0 compliant federation service, an SSL certificate, and 3 rd party code signing certificate. Local Directory must include user addresses

10 FLDOE-Hosted

11 WS-Federation Example based on Microsoft s ADFS 2.0 services but other Identity Providers can also be used.

12 Integration Decision Points Key Contacts Functional Lead Technical Lead

13 Integration Decision Points User Provisioning Data Management Centralized Decentralized + Authoriz = Identity ation User Provisioning Data

14 User Provisioning Creating, updating, or disabling a user s account for access to FLDOE SSO resources LEAs are the authoritative and responsible party for user provisioning LEAs may delegate provisioning authority to location administrators

15 Identity Attributes Field Name Order Example SSO ID 1 54 Required Address 2 John.Smith@fldoe.org Required Valid User 3 True Required User Type 4 Staff Required First Name 5 John Required Middle Name 6 Jay Optional Last Name 7 Smith Required Name Suffix 8 Sr. Optional State ID Number 9 FL Optional Birth Date Optional Site Id Required Job Category Optional Local ID Number Required

16 Authorization Attributes Field Name Order Example SSO ID 1 54 Required Local ID Number Required Application Id 3 4 Required Role Id 4 45 Required Attribute 1 5 Defined by application Attribute 2 6 Defined by application Attribute 3 7 Defined by application Attribute 4 8 Defined by application Attribute 5 9 Defined by application Attribute 6 10 Defined by application Attribute 7 11 Defined by application Attribute 8 12 Defined by application Attribute 9 13 Defined by application Attribute Defined by application

17 Integration Decision Points Data Submission Methods Files CSV or XML Automated or Manual Upload SFTP, FTPS, or HTTPS Requires TIBCO FTP account FIM Portal Requires FLDOE SSO account Combination of Files and FIM Portal

18 Data Submission Methods Manual Provisioning using FIM Portal LEA Technical Lead LEA Admin Location Admin FLDOE.org User Provisioning Tool Success / Error Reports Input File : CSV or XML Secure File Xfer Manual Provisioning using Files LEA Technical Lead Input File : CSV or XML Input File : CSV or XML LEA Admin Location Admin Automated Provisioning using Files LEA Technical Lead

19 File Information SSOID-YYYYMMDDHHmm-FileType.csv Identity.csv Authorization.csv Each record is a separate line No field/column headers No double quotes Entire district can be uploaded each time Pre-processing package runs to find new records and records with deltas/changes.

20 File Information Files will disappear from view once uploaded CSV or XML for both files; no mix-n-match Files take precedence over FIM Portal Files are processed after 6:00 PM (EST) each day Reports and accounts may not be available until the next day

21 FIM Portal Information Useful for: Decentralized user provisioning Designate LEA Admins or Location Admins Create, modify, or disable users Add, modify, or remove user authorizations Reset a FLDOE SSO password Hosted users and Federated Admins

22 FIM Portal Information Manual process Can be overwritten by files Must use IE 7.0 or above (Chrome and Firefox browsers are not supported) Processing time can vary (could be minutes to hours)

23 Delegation (FIM Portal)

24 Delegation (FIM Portal) LEA Administrator Manage all users in LEA Able to designate LEA Admins and Location Admins Access to SSO Reports Access to authorization information online Location Administrator Manage location users only Can only designate Location Admins No access to SSO Reports Access to authorization information online

25 System Demo Log in as FLDOE-Hosted user Log in as WS-Federated user Orientation to FLDOE SSO Portal Menu Demonstration of FIM Portal Add or Modify User Add or Modify Authorizations Designate Admins Password Reset Delete or Disable User

26 Prior to On-boarding Select authentication method FLDOE-Hosted WS-Federation Select key contacts LEA Functional Lead LEA Technical Lead Get forms

27 On-boarding Steps 1. Submit the Memorandum of Understanding (MOU) and LEA Participation Form to The FLDOE SSO team will provide the LEA Functional and Technical Leads with their unique SSO ID and secure file transfer account information to support the provisioning process. If WS-Federation is selected as the LEA s authentication method, documentation will be provided on how to establish a trust. The LEA will work with the FLDOE SSO team to establish the connection before proceeding to Step 2.

28 On-boarding Steps 2. Upload staff identity file to the secure file transfer account (CD to TEST); the FLDOE SSO team when complete. The FLDOE SSO team will provide feedback on the results of the file. Accounts will not be created. 3. Verify the IT Helpdesk information that will be published online for user support.

29 On-boarding Steps 4. Upload lead identity file (for the two leads only) to the secure file transfer account (CD to PROD); the FLDOE SSO team when complete. The FLDOE SSO team will elevate the leads to LEA Admin status and provide training on how to use the system. This allows the leads to get familiar with the system before initiating accounts for the entire LEA.

30 On-boarding Steps 5. Complete user provisioning training. 6. Schedule a cutover date. 7. Notify the LEA Helpdesk staff and end users.

31 On-boarding Steps 8. Submit the Certificate of Readiness form to The Certificate of Readiness is required to satisfy a grant deliverable for public school district LEAs participating in the Race to the Top grant. Upon receipt of the form, the FLDOE SSO team will review, sign, and return a scanned copy via . The document may be uploaded to the grants management system as evidence the deliverable has been met, or you may select the no upload option and indicate the details of when it was sent and to whom (ex: sent July 1, 2013 to fldoe-sso@fldoe.org). If the LEA is not participating in the Race to the Top grant, skip this step and proceed to Step 9.

32 On-boarding Steps 9. On the scheduled cutover date, upload production-ready user provisioning information to the LEA s secure file transfer account (CD to PROD). Successful receipt of user provisioning information triggers automated s to FLDOE-Hosted users with their username and password prompting them to complete their account registration and WS-Federated users will be enabled to utilize applications as authorized (notification will not be sent from FLDOE).

33 On-boarding Steps 10.Log into the FIM Portal and review SSO Reports for PROD file processing results; continue to manage LEA users and support FLDOE SSO.

34 Deadlines Applications On-boarding FSL, eipep, & CPALMS by August 2013 Certificate of Readiness Due by Q1Y4, September 30, 2013 Full integration into the SSO system Due by Q2Y4, December 31, 2013 Can be completed after the Certificate of Readiness is submitted

35 Outreach Individual Communications to LEAs One-on-One or Group Webinars Regional Workshops (fall) Online Training Modules (on-demand)

36 Questions?

37 Contact Information FLDOE SSO Web Site Phone (850) Local Systems Exchange