Groups and Operations in the Clouds

Transcription

1 Groups and Operations in the Clouds Mark McCahill Duke University CSG Spring 2012

2 Identities + Affinities we have more subtle problems than just simple identity mapping maintaining roles in across apps both on-prem and in the cloud(s) massive community churn every semester (unlike corporate market)

3 Common roles community czar: content moderation, can assign rights/roles to others participant: read/write access delegate: personal proxy for czar or participant visitor: read-only access

4 Can Groups and Roles Span Applications? each app (or cloud app suite) has it s own group management feature apps may not expect to fetch role information from an external source we can use group membership to denote specific roles within applications, but how do we keep this in sync across many apps/clouds?

5 Common patterns sync from institutional LDAP/AD to an app s private directory/cache app with remote access to LDAP/AD use apps web services provisioning layer for group/role definitions lazy-loading of group info via Shib/ SAML assertions

6 case study: Toolkits centralize and automate group/role maintenance across apps define community membership: automatically defined groups (instructor, students, TAs) user-defined ad-hoc groups (manager, visitor, guest lecturer, auditor)

7 Toolkits architecture web interface select tools track activity Toolkits tool provisioning engine Wordpress Sympa Quad define community community database Webfiles Jabber group membership engine activity stream engine Wiki VCL Grouper LDAP Shibboleth Sakai...others...

8 Video repository Show&Share + MXE + tagging video iframes plugins Wordpress Toolkits activity stream unified communications Quad Sympa Webfiles Sakai Toolkits activity streams spanning applications + ad-hoc groups + ERP/student system groups Exchange calendar CUPS Jabber + Presence UCM call manager WebEx Skype...others... identity management Grouper LDAP + AD Shibboleth PeopleSoft student system

9 Video repository video iframes Sakai Show&Share + MXE + tagging open social gadgets JSR-286 portlets Toolkits activity stream unified communications Wordpress Sympa Webfiles Quad Toolkits activity streams spanning applications + ad-hoc groups + ERP/student system groups Exchange calendar CUPS Jabber + Presence UCM call manager WebEx Skype...others... identity management Grouper LDAP + AD Shibboleth PeopleSoft student system

10 Video repository video iframes Quad Show&Share + MXE + tagging open social gadgets JSR-286 portlets internal activity stream unified communications Wordpress Sympa Webfiles Sakai Toolkits activity streams spanning applications + ad-hoc groups + ERP/student system groups Exchange calendar CUPS Jabber + Presence UCM call manager WebEx Skype...others... identity management Grouper LDAP + AD Shibboleth PeopleSoft student system

11 SCIM to the rescue? Simple Cloud Identity Management sounds good on paper but... rigid schema rudimentary group support where is the mapping to roles?

12 Getting Operational what the users are experiencing? monitoring & notifications SLAs an ounce of prevention troubleshooting change control trending

13 Trust - but verify Verify SLAs with operational monitors: user experience (i.e. JMeter synthetic transactions) network connectivity and latency to vendor s gateway

14 and more verification Vendor scorecards: meta analysis of long term trends How much stress testing can the cloud take before other customers are compromised? Boomerang - automagically track web page users bandwidth and latency

15 avoid bad patterns no cloud test instance = no way to test before changes go live war room dress rehearsals to understand roles/responsibilities monitoring blindspots = slow troubleshooting all admin eggs in one basket = when admin portal fails, cannot check system health or report the outage

16

17

18 opportunity collaborative cloud monitoring down for everyone or just for me? common cloud vendors and shared monitoring tools? correlation analysis