Oakland County Department of Information Technology Project Scope and Approach

Transcription

1 Oakland County Department of Information Technology Project Scope and Approach Project Name: Active Directory Federation Services (ADFS) Upgrade Project ID: TP5186AD Leadership Group: IT Steering Committee Department: Information Technology Division: Technical Services & Network Project Sponsor: Carl Wilson Date Requested: 11/5/2015 PM Customer No. 186 Request Type: New Development Enhancement Customer Support Planned System Maintenance or Upgrade IT Team Name: Technical Services IT Team No: P Project Manager/Leader: Sherry Yagiela Account Account Number: Description: Tech Syst Planned Maint Customer Name: Information Technology Grant Funded? Yes No Mandate? Yes No Mandate Source: N/A Project Goal To improve Active Directory Federation Services (ADFS), a critical Oakland County IT architecture building block, to the latest toolset release so that a highly available infrastructure can be established. Business Objective Develop an upgraded Dev and QA ADFS environment so that security, redundancy, resiliency and accessibility can be improved. Major Deliverables Detailed project plan DEV, QA, PROD ADFS infrastructure SSO for Internal users Migrate ADFS to latest release (3.0) Migrate applications Forms Authentication for External users Customized login screen for OC RP configuration template with and without group membership checks Sample web application with Claims based authentication (with signout) Sample web application which replaces Siteminder authentication (with signout) Sample web application which replaces Windows authentication (with signout) Form Rev. 11/05/2015 Page 1 Project Rev. 12/1/2015

2 Oakland County Department of Information Technology Project Scope and Approach Project Name: Active Directory Federation Services (ADFS) Upgrade Project ID: TP5186AD Approach Create development environment Build QA environment that mirrors production Produce a production instance that will have redundancy and load balancing Testing of all applications migrated o Office 365 o ArcGIS Online o EUM o OC Time o Envision IT Time o Kronos o SP2013 Deployment Research & Analysis Gartner Research Recommendation See attached NACo Application Store Research Conducted; Nothing Found Benefits See Return on Investment (ROI) Analysis Document Impact Number of Users County Employees Divisions Technical Services Leadership Groups Technical Systems and Network Risk Business Environment Medium Project will require some changes to existing business technologies. Technical Environment Medium Previously implemented technologies with new aspects and/or new requirements. Form Rev. 11/05/2015 Page 2 Project Rev. 12/1/2015

3 Oakland County Department of Information Technology Project Scope and Approach Project Name: Active Directory Federation Services (ADFS) Upgrade Project ID: TP5186AD Assumptions Staffing IT Staffing: resources will be dedicated to the project in order to keep efficiencies Other Staffing: additional staffing will be available as follows: Role: Name Hours per Day Project Sponsor: Carl Wilson As needed Facilities Technical Funding Information Technology Other Priority Constraints Exclusions Additional applications not currently using ADFS Form Rev. 11/05/2015 Page 3 Project Rev. 12/1/2015

4 Oakland County Department of Information Technology Project Scope and Approach Project Name: Active Directory Federation Services (ADFS) Upgrade Project ID: TP5186AD PROJECT PHASE AUTHORIZATION Phase(s): Project Management, Business Area Requirements, Development Environment Build, QA Environment Build, Production Environment Build, Migration & Testing and Post Implementation Support Total Estimated Application Services Hours: 692 Cost: $88,576 Total Estimated Technical Systems Hours: 267 Cost: $0 Total Estimated CLEMIS Hours: Cost: Total Estimated Internal Services Hours: Cost: IT Application Services Division Manager Approval: IT Technical Systems Division Manager Approval: IT CLEMIS Division Manager Approval: IT Internal Services Division Manager Approval: Date: Date: Date: Date: IT Management Approval: Approved: Yes No Date: Reason: Project Sponsor Approval: Title: Date: PROJECT SUMMARY Authorized Development (see above) Hours: 959 Cost: $88,576 Preliminary Estimated Development for Future Phases Hours: Cost: Grand Total Estimated Development Hours: 959 Cost: $88,576 Form Rev. 11/05/2015 Page 4 Project Rev. 12/1/2015

5 Oakland County Department of Information Technology Project Scope and Approach Project Name: Active Directory Federation Services (ADFS) Upgrade Project ID: TP5186AD Customer Acceptance of Product: PROJECT COMPLETION AUTHORIZATION Title: Project Office Review: Date: Date: Form Rev. 11/05/2015 Page 5 Project Rev. 12/1/2015

6 This research note is restricted to the personal use of G Choosing Among Federated Identity Management Options Published: 25 September 2012 Analyst(s): Gregg Kreizman Software-as-a-service application adoption continues to spur the need for federated identity management. Enterprises have an increasing number of options to obtain this functionality. Key Challenges Software as a service (SaaS) application adoption is the primary market driver for federated identity management. SaaS applications usually have proprietary authentication services. However, federation standards increasingly will be supported to provide enterprises with single sign-on (SSO). Commercial and open-source options can provide federated authentication to SaaS applications. Maintaining adequate staff to support these solutions remains a challenge for many organizations. Enterprises most commonly want to leverage users' authentication to Active Directory for SSO to SaaS applications. Microsoft's federation components may fulfill the requirements at little or no additional cost. Federated authentication is only one identity and access management (IAM) capability needed when enterprises use SaaS. Identity administration and intelligence functions are usually also needed and are generally not included as base federation software products. Recommendations Enterprises with no access management tools, but that want to leverage Active Directory authentication for federation based on SAML 2.0 or WS-Federation, should strongly consider Microsoft Active Directory Federation Services (ADFS) 2.0. Enterprises that have deployed Web access management (WAM) tools should consider using the federation capabilities that are included or sold as add-on products for possible costbenefits over other options. Consider open-source federation capabilities, but recognize that there is no "free lunch"; support contracts will likely be needed. This research note is restricted to the personal use of widune@oakgov.com

7 This research note is restricted to the personal use of Identity access management as a service (IDaaS) should be considered when the enterprise does not want to manage an on-premises IAM infrastructure or many federation partnerships. Consider using the federation extensions to networking and authentication products when users' sessions will be routed through these products. Strategic Planning Assumption Federated single sign-on will be a commodity by year-end Introduction During the early 2000s, identity federation was needed predominantly in B2B scenarios. However, this need was small relative to other access requirements. In 2010, the growing adoption of SaaS applications began to generate an increasing level of Gartner client inquiries on the topic of enabling SSO to SaaS applications. In "Options for Coping With New Identity Islands in the Cloud" (note: this research has been archived; it may not reflect current conditions), we analyzed how most SaaS applications have failed to deliver integration with enterprise IAM capabilities. However, we also noted that authentication and federation were the most mature IAM disciplines and had the most options for integrating SaaS applications with enterprise IAM infrastructures. Federated SSO is increasingly being supported by SaaS providers. Whether or not enterprises are considering their entire sets of IAM needs for SaaS applications, SSO and federation needs are acute. What are the decision factors and the best market options for supporting federated identity management to meet enterprise needs? Federated identity management capabilities can increasingly be obtained as a subset of a variety of products and services. Here, we identify solution groupings to accomplish federation objectives along with best practices for choosing each type (see "Technology Overview for Federated Identity Management" for a technology overview and content on standards). Analysis Enterprises With No Access Management Tools, but That Want to Leverage Active Directory Authentication for Federations Based on SAML 2.0 or WS-Federation, Should Strongly Consider ADFS 2.0 Microsoft has long had federation capability with ADFS v1. However, the WS-Federation specification was the only one supported. ADFS v1 lacked SAML protocol capability until the release of ADFS v2.0 in ADFS 2.0 supports limited SAML profiles, but these are the most commonly deployed profiles and use cases for service and identity providers (see "Technology Overview for Federated Identity Management"). ADFS 2.0 is provided at no additional charge to Page 2 of 7 Gartner, Inc. G This research note is restricted to the personal use of widune@oakgov.com

8 This research note is restricted to the personal use of organizations that have maintained their licenses for Microsoft Windows Server. It requires Windows Server 2008 or above to run. Gartner has spoken with many satisfied clients who have implemented ADFS 2.0. The technology can be daunting to set up for first timers, but clients report that it works as advertised. At this time, we believe ADFS 2.0 is well-positioned to support enterprises that do not own WAM with built-in federation or stand-alone federation capability, only have Active Directory, and wish to leverage their users' Active Directory authentication for at least a few federated SSO partners. ADFS's limitations are that it only supports Active Directory as an underlying identity repository, and ADFS does not support other versions of SAML (for example v1.1), nor does it support the newer RESTful specifications OpenID or OAuth. However, Microsoft has built support for these specifications into Azure Access Control Services, which could be relevant for enterprises building applications using Azure (see "Technology Overview for Federated Identity Management" for an overview of these specifications). Enterprises That Have Deployed WAM Tools Should Consider Using the Federation Capabilities That Are Included or Sold as an Add-on Product for Possible Cost- Benefits Over Other Options WAM tools are mature, broadly implemented technologies. The majority of established WAM implementations use commercial products that support federation in the base product or use a vendor's stand-alone federation product that integrates with the vendor's WAM tool. The combination can provide consistent security policy management for applications inside and outside the enterprise. Multiple authentication methods can be supported with WAM. Authorization policies such as those defining which users, roles or groups can access applications can be managed consistently with a WAM tool. WAM vendors are more frequently supporting the newer RESTful federation specifications. Adding the same vendor's federation products to an existing WAM deployment may produce greater cost savings than adding a second vendor's commercial products. Therefore, using a WAM tool's native functionality or "bolting on" a vendor's federation product to WAM is often the best choice for enterprises that already own WAM tools. It is usually not worth the resource investment to implement WAM when the enterprise's Web application server environment is homogeneous (for example, all applications run on Microsoft.NET and Internet Information Services [IIS]) and the authorization or advanced authentication functions are not required. Ping Identity, a well-established federation software pure-play vendor, offers the PingFederate product set. It is well-regarded for its relative ease of implementation, application integration kits and standards support. PingFederate historically lacked the authorization policy engine that WAM tools had. However, Ping Identity has added the ability to read directory-held attributes to determine whether users are entitled to access federated application targets. Ping's products often are implemented in lieu of a full-fledged WAM tool, or to augment a WAM implementation that has no federation support built in. Gartner, Inc. G Page 3 of 7 This research note is restricted to the personal use of widune@oakgov.com

9 This research note is restricted to the personal use of Example vendors that include federation with their base WAM products include Entrust, Evidian, ForgeRock, NetIQ, Oracle, SecureAuth and Siemens. CA Technologies; IBM; and RSA, The Security Division of EMC, sell stand-alone or bundled federation products (see "MarketScope for Web Access Management" and its upcoming update for more information on these vendors and products). Consider Open-Source Federation Capabilities, but Recognize That There Is No Free Lunch; Support Contracts Will Likely Be Needed Enterprises that desire to implement and support open-source solutions as alternatives to commercial offerings have some choices. Oracle acquired Sun's OpenSSO WAM and federation products in Oracle's strategic WAM and federation products are its Oracle Access Manager (OAM) and Oracle Identity Federation, which Oracle is now combining into one product offering. OpenSSO Enterprise was not strategic for Oracle. ForgeRock, a startup that joined the IAM market in 2010, also provides support for OpenSSO branded as OpenAM. ForgeRock continues to develop and extend the product, and sells support for its version. The Shibboleth stack is the most well-established open-source federation software. It is used in hundreds of higher education institutions, some governments and private sector organizations. Shibboleth was not completely interoperable with other SAML implementations in its early days. However, developers moved the implementation toward SAML 2.0, and it has been interoperable with other SAML 2.0-compliant products for several years. OpenSAML, also developed as part of the Shibboleth initiative, and SimpleSAMLphp are other examples of open-source federation implementations (see wiki.shibboleth.net/confluence/display/opensaml/home and simplesamlphp.org). With the exception of ForgeRock, which supports OpenAM directly and through partners, enterprises must be prepared to support open-source federation implementations on their own, through community support, or by finding a vendor or integrator that is well-versed in the chosen implementation's intricacies. IDaaS Should Be Considered When the Enterprise Does Not Want to Manage On- Premises IAM or Many Federation Partnerships IDaaS providers offer alternatives to completely on-premises solutions. Vendors in this small, but growing and volatile market have been adding and maturing functions to help organizations extend or replace internal IAM functions, completely, or to integrate with SaaS applications. This removes the integration burden and potentially gets the customer out of the IAM operations business. In the federation use case, the IDaaS provider establishes the federations with SaaS providers, thereby relieving the enterprise of having to establish and manage those federations. IDaaS can be completely delivered in the cloud. However, there is often a bridge component of the service that is implemented on-premises to provide a secure connection between an enterprise's authentication and identity attribute store (often Active Directory) and the service. The directory is used as an identity repository and for initial user authentication that is leveraged for subsequent SSO to target SaaS applications. The directory group objects often can be used by the service to check for Page 4 of 7 Gartner, Inc. G This research note is restricted to the personal use of widune@oakgov.com

10 This research note is restricted to the personal use of membership and subsequent authorization to use target applications. IDaaS vendors can, in varying degrees, provision accounts to SaaS applications that have provisioning or directory synchronization interfaces. The small and midsize business market has contributed most of the growth for IDaaS, although some larger customers are beginning to come on board. ("A Guide to Making the Right Choices in the Expanding IDaaS Market" identifies vendors and the functions their services provide.) Use IDaaS for federation when the enterprise does not want to manage a solution itself, when it would prefer a subscription-based licensing model, and when your enterprise use-case needs can be met. Use Federation Extensions to Networking or Authentication Products When Users' Sessions Will Be Routed Through These Products In addition to the main solution groupings for which we see client interest, there is a trend for authentication, and network infrastructure and service providers to federation-enable their offerings so that these products can be directly joined to a federation. For example, Cisco builds its SAMLcompliant SaaS Access Control solution into its IronPort S-Series Web Security Appliances. SecureAuth, an IAM vendor that previously emphasized authentication with VPN integration, has extended its products to support federation and emphasize the enterprise-to-cloud and mobile endpoint use cases. This trend of extending existing products with federation support should continue, and enterprises may find that some products they already own can fulfill part of their federation requirements. Federation support being provided by networking infrastructure vendors has not been implemented for consumer-facing requirements to the scale that WAM/federation tools have. Gartner generally sees clients use the networking vendors' federation capabilities in VPN and networking gear usage scenarios where remote employees enter the corporate network through a VPN, and then can get SSO to SaaS applications based on the VPN sign-on event. Federation and SSO provide user convenience and some elements of common authentication policy management for access to SaaS applications. However, enterprises must also consider the aforementioned provisioning, authorization and intelligence requirements that may be inhibited by SaaS providers that have not provided programmatic methods to support these requirements. Federation capability will continue to be added to authentication products and services, to networking products, and is sometimes built into application platforms. For example, virtual directory vendor, Radiant Logic, has extended its products to support federation. With so many options for federated SSO, basic capabilities have been commoditized. WAM vendors and federation specialists will seek to differentiate with support for advanced use cases, multiprotocol support and application integration. However, these capabilities will be commoditized as well as applications slowly, inexorably move to standardized Web architectures and cloud services. Recommended Reading Some documents may not be available as part of your current Gartner subscription. Gartner, Inc. G Page 5 of 7 This research note is restricted to the personal use of widune@oakgov.com

11 This research note is restricted to the personal use of "Options for Coping With New Identity Islands in the Cloud" "Technology Overview for Federated Identity Management" "MarketScope for Web Access Management" "A Guide to Making the Right Choices in the Expanding IDaaS Market" Page 6 of 7 Gartner, Inc. G This research note is restricted to the personal use of widune@oakgov.com

12 This research note is restricted to the personal use of GARTNER HEADQUARTERS Corporate Headquarters 56 Top Gallant Road Stamford, CT USA Regional Headquarters AUSTRALIA BRAZIL JAPAN UNITED KINGDOM For a complete list of worldwide locations, visit Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. This publication may not be reproduced or distributed in any form without Gartner s prior written permission. If you are authorized to access this publication, your use of it is subject to the Usage Guidelines for Gartner Services posted on gartner.com. The information contained in this publication has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions of Gartner s research organization and should not be construed as statements of fact. The opinions expressed herein are subject to change without notice. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered in Gartner research. Gartner s Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see Guiding Principles on Independence and Objectivity. Gartner, Inc. G Page 7 of 7 This research note is restricted to the personal use of widune@oakgov.com

13 3.1 - Provide an Enhanced Application Service Offering Information Technology Strategic Plan Alignment TP5186AD - Active Directory Federation Services (ADFS) Upgrade Increased application integration and standardization through web services Integrate mobility and location based services in business applications Promote and utilize shared services through the use of cloud technologies to offset costs and expland product offerings to customers Increase the agility and responsiveness of business units by expanding customer analytics Leverage the County's web presence as a branded consolidated point of access to all County information and services Centralize and standardize identity and access management for all applications and content X Improve the quality, reliability, and availability of all applications X Enhance ability to provide effective and timely customer service Advance the use of IT Library (ITIL) best practice framework for IT Service Management Implement Configuration Management Database to better identify IT Assets Provide a high-quality training program to empower employees through technology Utilize a formalized customer communication plan Build IT Staff expertise through professional development Expand capacity through ongoing organization review and right sourcing Implement a Standardized Strategy Deliver services using a standardized shared technology infrastructure whereever possible Implement a consolidated security management strategy Develop and implement a policy for personally owned devices and services Improve service availability through network design and management strategies Enhance capacity planning and recovery managment strategies Adopt an enterprise architecture approach to technology planning, design, and implementation X Run Date 12/1/2015 Page 1 of 1

14 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Project Summary As Of: November 17, 2015 Description Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Total Benefits/Savings: Tangible Benefits Subtotal: Cost Avoidance Subtotal: Costs: Development Services Subtotal: 110, ,737 Subtotal: Software Subtotal: Subtotal Training Subtotal: Other Subtotal: Annual Statistics: Annual Total Savings Annual Total Costs 110, ,737 Annual Return on Investment (110,737) (110,737) Annual Costs/Savings Ratio 0.00% 0.00% 0.00% 0.00% 0.00% 0.00% Project Cumulative Statistics: Cumulative Total Savings Cumulative Total Costs 110, , , , , , ,737 Cumulative Return on Investment (110,737) (110,737) (110,737) (110,737) (110,737) (110,737) (110,737) Cumulative Cost/Savings Ratio 0.00% 0.00% 0.00% 0.00% 0.00% 0.00% 0.00% Year Positive Payback Achieved State or Federal Mandate? Signatures: NO PAYBACK Benefits Reviewed By Project Sponsor Date: Costs (including IT Resources) Reviewed By Information Technology Project Manager Date: ADFS Upgrade_ROI_v2.xls/Project Summary Date Printed: 12/1/2015 Page 1 REV: June 27, 2011

15 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Savings Detail As Of: November 17, 2015 Benefit/Savings Description Fortifying the critical environment will mitigate many risks Adding forms based component will eliminate security risk as the gab with Web allows cookies to reauthenticate a user to the environment. Adding a Dev and QA region will enable better testing and improve migrations to production. Increase maximum availability and provide zero downtime upgrades by adding an internal and external failover. Increase trust in IT due to uptime of ADFS improving customer experience Project Savings Category Intangible Benefit Intangible Benefit Intangible Benefit Intangible Benefit Intangible Benefit Budget Category/Funding Source Unit Desc Units Rate per Unit Total Savings Annual Multiplier ADFS Upgrade_ROI_v2.xls/Savings Detail Date Printed: 12/1/2015 Page 2 REV: June 27, 2011

16 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Savings Detail As Of: November 17, 2015 Benefit/Savings Description Fortifying the critical environment will mitigate many risks Adding forms based component will eliminate security risk as the gab with Web allows cookies to reauthenticate a user to the environment. Adding a Dev and QA region will enable better testing and improve migrations to production. Increase maximum availability and provide zero downtime upgrades by adding an internal and external failover. Increase trust in IT due to uptime of ADFS improving customer experience Project Savings Category Intangible Benefit Intangible Benefit Intangible Benefit Intangible Benefit Intangible Benefit Affects Project ROI? Potential Savings Extensions Y1 Y2 Y3 Y4 Y5 Y6 Y1 Y2 Y3 Y4 Y5 Y6 ADFS Upgrade_ROI_v2.xls/Savings Detail Date Printed: 12/1/2015 Page 3 REV: June 27, 2011

17 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Savings Summary As Of: November 17, 2015 Benefit/Savings Description Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Total Tangible Benefit: Tangible Benefits Subtotal: Cost Avoidance: Cost Avoidance Subtotal: Intangible Benefit: Fortifying the critical environment will mitigate many risks Adding forms based component will eliminate security risk as the gab with Web allows cookies to re-authenticate a user to the environment. Adding a Dev and QA region will enable better testing and improve migrations to production. Increase maximum availability and provide zero downtime upgrades by adding an internal and external failover. Increase trust in IT due to uptime of ADFS improving customer experience Savings Total: ADFS Upgrade_ROI_v2.xls/Savings Summary Date Printed: 12/1/2015 Page 4 REV: June 27, 2011

18 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Cost Detail As Of: November 17, 2015 Cost Description Project Cost Category Budget Category/Funding Source Unit Desc Units Rate per Unit Total Cost Annual Multiplier Affects Project ROI? Y1 Y2 Y3 Y4 Y5 Y6 IT Hours - New Development Development Svcs HR ,737 x IT Hours - New Development HR IT Hours - New Development HR IT Hours - System Maintenance Development Svcs HR x x x x x IT Hours - Customer Support Development Svcs HR x x x x x IT Hours - Planned Maintenance Development Svcs Contractor Professional Services Development Svcs 0 0 PC System - Acquisition PC System - Maintenance 2,304 0 Notebook - Acquisition 1,223 0 Notebook - Maintenance 2,372 0 Tablet Notebook - Acquisition 2,012 0 Tablet Notebook - Maintenance 0 Laserprinter - Acquisition 1,432 0 Laserprinter - Maintenance 1,104 0 Image Workstations - Acquisition 0 Image Workstations - Maintenance 3,496 0 PC Maintenance User Owned 2,304 0 Printer Maintenance User Owned 1,072 0 Package Software - Acquisition Software 0 Package Software - Maintenance Software 0 Business Objects Access Software 0 Term Emulation SFTW-Acquisition Software 0 Term Emulation SFTW-Maintenance Software 0 Server - Acquisition/Upgrade 8,000 0 Server - Maintenance Server Sftwre - Acquisition/Upgrade Server Sftwre - Maintenance 0 Server Rack Mount Oracle Enterprise Per Processor - Includes Year 1 Maintenance 21,372 0 ADFS Upgrade_ROI_v2.xls/Cost Detail Date Printed: 12/1/2015 Page 5 REV: June 27, 2011

19 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Cost Detail As Of: November 17, 2015 Cost Description Project Cost Category Budget Category/Funding Source Unit Desc Units Rate per Unit Total Cost Oracle Enterprise Per Processor - Year 2 and Beyond 3,432 0 MS SQL Server Standard Per Processor - Includes Year 1 Maintenance 4,725 0 MS SQL Server Standard Per Processor - Year 2 and Beyond MS SQL Server Enterprise Per Processor - Includes Year 1 Maintenance 19,693 0 MS SQL Server Enterprise Per Processor - Year 2 and Beyond 3,939 0 Websphere Basic Per Processor Single/Dual Core - Includes Year 1 Maintenance 3,506 0 Websphere Basic Per Processor Single/Dual Core - Year 2 and Beyond Websphere ND Per Processor Single/Dual Core - Includes Year 1 Maintenance 13,180 0 Annual Multiplier Affects Project ROI? Y1 Y2 Y3 Y4 Y5 Y6 Websphere ND Per Processor Single/Dual Core - Year 2 and Beyond 2,635 0 SSL Certificate TBD 0 TBD 0 TBD 0 TBD 0 Internet Access Project Staff Training Training 0 User Training Training 0 ADFS Upgrade_ROI_v2.xls/Cost Detail Date Printed: 12/1/2015 Page 6 REV: June 27, 2011

20 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Cost Detail As Of: November 17, 2015 Cost Description IT Hours - New Development IT Hours - New Development IT Hours - New Development IT Hours - System Maintenance IT Hours - Customer Support IT Hours - Planned Maintenance Contractor Professional Services PC System - Acquisition PC System - Maintenance Notebook - Acquisition Notebook - Maintenance Tablet Notebook - Acquisition Tablet Notebook - Maintenance Laserprinter - Acquisition Laserprinter - Maintenance Image Workstations - Acquisition Image Workstations - Maintenance PC Maintenance User Owned Printer Maintenance User Owned Package Software - Acquisition Package Software - Maintenance Business Objects Access Term Emulation SFTW-Acquisition Term Emulation SFTW-Maintenance Server - Acquisition/Upgrade Server - Maintenance Server Sftwre - Acquisition/Upgrade Server Sftwre - Maintenance Server Rack Mount Oracle Enterprise Per Processor - Includes Year 1 Maintenance Project Cost Category Development Svcs Development Svcs Development Svcs Development Svcs Development Svcs Software Software Software Software Software Potential Cost Extensions Y1 Y2 Y3 Y4 Y5 Y6 110, ADFS Upgrade_ROI_v2.xls/Cost Detail Date Printed: 12/1/2015 Page 7 REV: June 27, 2011

21 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Cost Detail As Of: November 17, 2015 Project Cost Cost Description Category Oracle Enterprise Per Processor - Year 2 and Beyond MS SQL Server Standard Per Processor - Includes Year 1 Maintenance MS SQL Server Standard Per Processor - Year 2 and Beyond MS SQL Server Enterprise Per Processor - Includes Year 1 Maintenance MS SQL Server Enterprise Per Processor - Year 2 and Beyond Websphere Basic Per Processor Single/Dual Core - Includes Year 1 Maintenance Potential Cost Extensions Y1 Y2 Y3 Y4 Y5 Y6 Websphere Basic Per Processor Single/Dual Core - Year 2 and Beyond Websphere ND Per Processor Single/Dual Core - Includes Year 1 Maintenance Websphere ND Per Processor Single/Dual Core - Year 2 and Beyond SSL Certificate TBD TBD TBD TBD Internet Access Project Staff Training User Training Training Training ADFS Upgrade_ROI_v2.xls/Cost Detail Date Printed: 12/1/2015 Page 8 REV: June 27, 2011

22 TP5186AD Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis As Of: November 17, 2015 Cost Summary Cost Description Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Total Development Services: IT Hours - New Development 110, ,737 IT Hours - New Development 0 IT Hours - New Development 0 IT Hours - System Maintenance IT Hours - Customer Support IT Hours - Planned Maintenance Contractor Professional Services Development Services Subtotal: 110, ,737 : Subtotal: Software: Usertesting.com account for nav. Usability 0. Software Subtotal: : Subtotal Training: Training Subtotal: Other: Other Subtotal: Costs Total: 110, ,737 ADFS Upgrade_ROI_v2.xls/Cost Summary Date Printed: 12/1/2015 Page 9 REV: June 27, 2011

23 TP5186AD Date Oakland County -- Active Directory Federation Services (ADFS) Upgrade Return on Investment Analysis Assumptions Assumption Description As Of: November 17, 2015 ADFS Upgrade_ROI_v2.xls/Assumptions Date Printed: 12/1/2015 Page 10 REV: June 27, 2011