Identity Management. Manager, Identity Management. Academic Technology Services. Michigan State University Board of Trustees
|
|
|
- Miranda Cunningham
- 10 years ago
- Views:
Transcription
1 Identity Management and Shibboleth h at MSU Jim Green Manager, Identity Management Michigan State t University it Academic Technology Services
2 Identity Management Definition: Identity management is the set of business processes, and a supporting infrastructure, for the creation, maintenance, and use of digital identities. -- The Burton Group MSU s centrally-supported IdM infrastructure: Digital credentials Authentication Single Sign-on Directory Services Middleware Federation
3 Organizational Structure Libraries, Computing and Technology Academic Technology Services (ATS) Administrative Information Services (AIS) Broadcast Services Enterprise Business Systems Project (EBSP) Enterprise Information Stewardship (EIS) University it Librariesi University Archives & Historical Collections (UAHC) Virtual University Design & Technology (VUDAT)
4 How IdM fits in EIS IT governance EBSP new HR, financial, BI, research administration AIS Enterprise data/systems of record, administrative systems ATS Network, LMS, mail, web, computer labs IdM Requires partnership EIS, EBSP, AIS Stakeholders data stewards Registrar s office Human Resources ID Office Internal Audit Others
5 Guiding Organizations Internet2/MACE (Middleware Architecture Committee for Education) NMI-EDIT (National Science Foundation Middleware Initiative Enterprise and Desktop Integration ti Technologies) Educause/Internet2 CAMP (Campus Architecture and Middleware Planning) workshops Educause Identity Management Working Group InCommon
6
7 MSU IdM technology Central authentication service Kerberos Intra-institutional single sign-on Sentinel Federated authentication Shibboleth Directory services OpenDS msueduperson, eduorg, eduperson CommunityID Provisioning Web services Self service account creation/management NetID legacy provisioning system
8 InCommon Trust fabric between federation members Higher Ed Government NIH, NSF Sponsored participants -- Apple, EBSCO, OCLC, Shibboleth and SAML Participant Operating Practices statement Federation membership not necessary
9 Shibboleth introduction An Internet2/MACE initiative Open source Apache 2.0 license Strong community Standards-based -- SAML InCommon other federations Authentication and Authorization Infrastructure Simplify inter-organizational access to resources Intra-organizational applications, too
10 Shibboleth components Identity yp provider (IdP) Java/Tomcat Works with authentication/sso and enterprise directory systems Can also be configured to provide its own SSO capability, eliminating the need for an external SSO system Service provider (SP) Java works with Apache or IIS Where are you from? (WAYF)
11 MSU East Lansing, MI Shibboleth IdP CIC Chicago, IL Shibboleth SP CICme Sentinel/ Kerberos OpenDS msueduperson PSU State College, PA Shibboleth IdP PSU user MSU user PSU s SSO PSU s directory
12 Shibboleth at MSU IdP Shibboleth v x twilight June 30, 2010 Authentication Kerberos SSO Sentinel Attribute server OpenDS-based private LDAP directory msueduperson, eduperson, eduorg SPs Versions 2.x and 1.3 supported Interest as a local SSO solution Federation capability icing on the cake
13 MSU Shib SPs ANGEL course management system EZProxy access to library-licensed electronic resources Storemedia media server forums.msu.edu msu campus-wide discussion forums photos.msu.edu UR s stock photo store Departmental: ATS s Confluence wiki Biochemistry Chemistry HPCC s wiki Supported as an authentication method in our web hosting service
14 Partner projects Penn State ANGEL course Microsoft DreamSpark student software downloads CIC s CICme Sharepoint site In the works: Tower travel -- travel portal Aliquant benefits portal SAML 1.1 Proposed: StudentsOnly/StudentUniverse.com student travel portal
15 Issues Adoption Application integration required Limited (but growing?) support for Shibboleth or SAML among external entities Trust relationship required Policy infrastructure internal and external Identity verification and levels of assurance Questions about SSO and authentication in general Centralized vs. distributed IdM, access control
16 Plans Implement Shibboleth for more applications Begin to leverage federation capability by establishing partnerships Identity verification and InCommon Silver LOA Considering how to implement support for additional factors to allow stronger authentication for higher security applications Provisioning modernization/middleware Build out the Shibboleth attribute server
17 Resources Shibboleth InCommon MSU s Participant Operating Practices Internet2/MACE i t t2 d /MACE/ NMI-EDIT SWITCH Federation AAI info:
18 Resources, cont d Educause net@edu Identity Management Working Group Educause/Internet2 CAMP Workshops edu/camp NIST SP InCommon Identity Assurance Framework IAAF_1.0_Final.pdf Fi
19 Contact Info Jim Green Manager, Identity Management Phone: (517)
Federated Identity Management and Shibboleth. Noreen Hogan Asst. Director Enterprise Admin. Applications
Federated Identity Management and Shibboleth Noreen Hogan Asst. Director Enterprise Admin. Applications Federated Identity Management Management of digital identity/credentials (username/password) Access
Federated Identity: Leveraging Shibboleth to Access On and Off Campus Resources
Federated Identity: Leveraging Shibboleth to Access On and Off Campus Resources Paul Riddle University of Maryland Baltimore County EDUCAUSE Mid-Atlantic Regional Conference January 16, 2008 Copyright
A Shibboleth View of Federated Identity. Steven Carmody Brown Univ./Internet2 March 6, 2007 Giornata AA - GARR
A Shibboleth View of Federated Identity Steven Carmody Brown Univ./Internet2 March 6, 2007 Giornata AA - GARR Short Section Title Agenda Assumptions and Trends Identity Management and Shibboleth Shibboleth
Masdar Institute Single Sign-On: Standards-based Identity Federation. John Mikhael ICT Department [email protected]
Masdar Institute Single Sign-On: Standards-based Identity Federation John Mikhael ICT Department [email protected] Agenda The case for Single Sign-On (SSO) Types of SSO Standards-based Identity Federation
USING ESPRESSO [ESTABLISHING SUGGESTED PRACTICES REGARDING SINGLE SIGN ON] TO STREAMLINE ACCESS
![USING ESPRESSO [ESTABLISHING SUGGESTED PRACTICES REGARDING SINGLE SIGN ON] TO STREAMLINE ACCESS](/thumbs/27/10578280.jpg "USING ESPRESSO [ESTABLISHING SUGGESTED PRACTICES REGARDING SINGLE SIGN ON] TO STREAMLINE ACCESS")
USING ESPRESSO [ESTABLISHING SUGGESTED PRACTICES REGARDING SINGLE SIGN ON] TO STREAMLINE ACCESS Andy Ingham (UNC-Chapel Hill) NASIG Annual Conference, June 4, 2011 What I hope to cover Problem statement
Single Sign On at Colorado State. Ron Splittgerber
Single Sign On at Colorado State Ron Splittgerber Agenda Identity Management Authentication Authorization The Problem The Solution: Federation Trust Between Institutions Trust Between Institution and Federal
Federation At Fermilab. Al Lilianstrom National Laboratories Information Technology Summit May 2015
Federation At Fermilab Al Lilianstrom National Laboratories Information Technology Summit May 2015 About Fermilab Since 1967, Fermilab has worked to answer fundamental questions and enhance our understanding
Identity and Access Management for Federated Resource Sharing: Shibboleth Stories
Identity and Access Management for Federated Resource Sharing: Shibboleth Stories http://arch.doit.wisc.edu/keith/apan/ apanshib-060122-01.ppt Keith Hazelton ([email protected]) Sr. IT Architect,
Authentication Methods
Authentication Methods Overview In addition to the OU Campus-managed authentication system, OU Campus supports LDAP, CAS, and Shibboleth authentication methods. LDAP users can be configured through the
IAM, Enterprise Directories and Shibboleth (oh my!)
IAM, Enterprise Directories and Shibboleth (oh my!) Gary Windham Senior Enterprise Systems Architect University Information Technology Services [email protected] What is IAM? Identity and Access
Identity and Access Management (IAM) Roadmap DRAFT v2. North Carolina State University
Identity and Access Management (IAM) Roadmap DRAFT v2 North Carolina State University April, 2010 Table of Contents Executive Summary... 3 IAM Dependencies... 4 Scope of the Roadmap... 4 Benefits... 4
Integrating Multi-Factor Authentication into Your Campus Identity Management System
Integrating Multi-Factor Authentication into Your Campus Identity Management System Mike Grady, Unicon David Walker, Internet2 (both associated with the Internet2 Scalable Privacy Project) Agenda Multi-Context
E-LibUkr portal: Case study of Shibboleth and EZProxy in Ukraine.
E-LibUkr portal: Case study of Shibboleth and EZProxy in Ukraine. Yaroshenko Tetiana, yaroshenko[@]ukma.kiev.ua Introduction The Kyiv Mohyla Foundation of America and the National University of Kyiv Mohyla
Step-by-Step guide for SSO from MS Sharepoint 2010 to SAP EP 7.0x
Step-by-Step guide for SSO from MS Sharepoint 2010 to SAP EP 7.0x Sverview Trust between SharePoint 2010 and ADFS 2.0 Use article Federated Collaboration with Shibboleth 2.0 and SharePoint 2010 Technologies
Multi-Factor Authentication, Assurance, and the Multi-Context Broker
Multi-Factor Authentication, Assurance, and the Multi-Context Broker IAM Online April 30, 2014 Keith Wessel, University of Illinois, Urbana-Champaign David Langenberg, University of Chicago David Walker,
Authentication Integration
Authentication Integration VoiceThread provides multiple authentication frameworks allowing your organization to choose the optimal method to implement. This document details the various available authentication
Using Shibboleth for Single Sign- On
Using Shibboleth for Single Sign- On One Logon to Rule them all.. Kirk Yaros Director, Enterprise Services Mott Community College 1 Agenda Overview of Mott Overview of Shibboleth and Mott s Project Review
Shibboleth and Library Resources
Shibboleth and Library Resources InCommon Library/Shibboleth Project What is the Library/Shibboleth Project? Established 2007 Five universities + Internet2 Campus IT, Library IT, Librarians Adding Shibboleth
Applying Data Governance in Identity Management: To Serve and Protect"
Applying Data Governance in Identity Management: To Serve and Protect" Brendan Bellina Identity Services Architect Information Technology Services University of Southern California [email protected]" Distributed
Federated Identity Management
Federated Identity Management SWITCHaai Team [email protected] Agenda 2 What is Federated Identity Management? What is a Federation? The SWITCHaai Federation Interfederation Evolution of Identity Management
HOL9449 Access Management: Secure web, mobile and cloud access
HOL9449 Access Management: Secure web, mobile and cloud access Kanishk Mahajan Principal Product Manager, Oracle September, 2014 Copyright 2014, Oracle and/or its affiliates. All rights reserved. Oracle
Web app AAI Integration How to integrate web applications with AAI in general?
Web app AAI Integration How to integrate web applications with AAI in general? Lukas Hämmerle [email protected] Zurich, 8. February 2009 6 Goal of this presentation 1. List the general requirements
From centralized to single sign on
The LemonLDAP::NG project Abstract LemonLDAP::NG is a modular WebSSO (Web Single Sign On) software based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the
Designing IT Platform Collaborative Applications with Microsoft SharePoint 2003 Workshop
Designing IT Platform Collaborative Applications with Microsoft SharePoint 2003 Workshop Course 8036: Two days; Instructor-led Microsoft Certified Professional Exams No Microsoft Certified Professional
Federated AAA middleware and the QUT SSO environment
Federated AAA middleware and the QUT SSO environment Bradley Beddoes Senior Network Programmer AAA eview Project Manager [email protected] Shaun Mangelsdorf Network Programmer [email protected]
Shibboleth Identity Provider (IdP) Sebastian Rieger [email protected]
Shibboleth Identity Provider (IdP) Sebastian Rieger [email protected] Gesellschaft für wissenschaftliche Datenverarbeitung mbh Göttingen, Germany CLARIN AAI Hands On Workshop, 25.02.2009, Oxford
Single Sign-On: Reviewing the Field
Outline Michael Grundmann Erhard Pointl Johannes Kepler University Linz January 16, 2009 Outline 1 Why Single Sign-On? 2 3 Criteria Categorization 4 Overview shibboleth 5 Outline Why Single Sign-On? Why
Shibboleth N-Tier Support. Chad La Joie [email protected]
Shibboleth N-Tier Support Chad La Joie [email protected] Agenda Use Case Terminology Shibboleth Solution Future Effort Resources 2 Use Case Current use case comes from University of Chicago University
Development and deployment of integrated attribute based access control for collaboration
Development and deployment of integrated attribute based access control for collaboration Collaborations and Virtual Organizations IdM is a critical dimension of collaboration, crossing many applications
Identity Management in Liferay Overview and Best Practices. Liferay Portal 6.0 EE
Identity Management in Liferay Overview and Best Practices Liferay Portal 6.0 EE Table of Contents Introduction... 1 IDENTITY MANAGEMENT HYGIENE... 1 Where Liferay Fits In... 2 How Liferay Authentication
OpenSSO: Simplify Your Single-Sign-On Needs. Sang Shin Java Technology Architect Sun Microsystems, inc. javapassion.com
OpenSSO: Simplify Your Single-Sign-On Needs Sang Shin Java Technology Architect Sun Microsystems, inc. javapassion.com 1 Agenda Enterprise security needs What is OpenSSO? OpenSSO features > > > > SSO and
Easy as 1-2-3: The Steps to XE. Mark Hoye Services Portfolio Consultant
Easy as 1-2-3: The Steps to XE Mark Hoye Services Portfolio Consultant September 25, 2015 Objective / Agenda Objective Provide relevant information about Banner XE Provide a framework for understanding
Provisioning and Deprovisioning 1 Provisioning/De-provisiong replacement 1
Item Count Provisioning/Deprovisioning Automated Deprovisioning 1 Automated on/off boarding from an authoritative source AUTOMATED [DE-]PROVISIONING 1 Removal of resources at the appropriate time 1 Timeliness
Middleware integration in the Sympa mailing list software. Olivier Salaün - CRU
Middleware integration in the Sympa mailing list software Olivier Salaün - CRU 1. Sympa, its middleware connectors 2. Sympa web authentication 3. CAS authentication 4. Shibboleth authentication 5. Sympa
Shibboleth User Verification Customer Implementation Guide 2015-03-13 Version 3.5
Shibboleth User Verification Customer Implementation Guide 2015-03-13 Version 3.5 TABLE OF CONTENTS Introduction... 1 Purpose and Target Audience... 1 Commonly Used Terms... 1 Overview of Shibboleth User
Three Campus Case Studies: Managing Access with Grouper
Three Campus Case Studies: Managing Access with Grouper IAM Online March 13, 2013 Speakers: Paul Donahue and Keith Hazelton, University of Wisconsin-Madison Sébastien Gagné, University of Montreal Rahul
AAI for Mobile Apps How mobile Apps can use SAML Authentication and Attributes. Lukas Hämmerle [email protected]
AAI for Mobile Apps How mobile Apps can use SAML Authentication and Attributes Lukas Hämmerle [email protected] Berne, 13. August 2014 Introduction App by University of St. Gallen Universities
Toward campus portal with shibboleth middleware
Toward campus portal with shibboleth middleware Eisuke Ito and Masanori Nakakuni [email protected] u.ac.jp, Kyushu University nak@fukuoka u.ac.jp, Fukuoka University Outline 1. Background 2. Shibboleth 3.
INTEGRATION GUIDE. IDENTIKEY Federation Server for Juniper SSL-VPN
INTEGRATION GUIDE IDENTIKEY Federation Server for Juniper SSL-VPN Disclaimer Disclaimer of Warranties and Limitation of Liabilities All information contained in this document is provided 'as is'; VASCO
Shibboleth Configuration from 100,000 Feet, in 15 Minutes or Less! Steve Thorpe Systems Programmer / Analyst MCNC
Shibboleth Configuration from 100,000 Feet, in 15 Minutes or Less! Steve Thorpe Systems Programmer / Analyst MCNC Helpful Skill Sets Include Basic Knowledge Of: Your OS: Linux or Windows Experience using
CERN Single Sign On. http://cern.ch/login. Emmanuel Ormancey CERN IT/IS. CERN IT Department CH-1211 Genève 23 Switzerland www.cern.
CERN Single Sign On http://cern.ch/login Emmanuel Ormancey CERN IT/IS Agenda History CERN Authentication Main goals Authentication methods Demo overview Technical background Identity provider Service providers
Best Practices for Libraries and Library Service Providers
Best Practices for Libraries and Library Service Providers These best practices were developed by the InCommon Library Consortium in 2009. The consortium was formed to explore various potential solutions.
Agenda. How to configure
[email protected] Agenda Strongly Recommend: Knowledge of ArcGIS Server and Portal for ArcGIS Security in the context of ArcGIS Server/Portal for ArcGIS Access Authentication Authorization: securing web services
Federated Identity Management
Federated Identity Management SWITCHaai Introduction Course Bern, 1. March 2013 Thomas Lenggenhager [email protected] Overview What is Federated Identity Management? What is a Federation? The SWITCHaai Federation
The Role of Federation in Identity Management
The Role of Federation in Identity Management August 19, 2008 Andrew Latham Solutions Architect Identity Management 1 The Role of Federation in Identity Management Agenda Federation Backgrounder Federation
Logout in Single Sign-on Systems
Logout in Single Sign-on Systems Sanna Suoranta, Asko Tontti, Joonas Ruuskanen, Tuomas Aura IFIP IDMAN, London, UK, 8-9.4.2013 Logout in Single Sign-on Systems Motivation Single sign-on (SSO) systems SSO
Standards and Guidelines for. Information Technology. Infrastructure, Architecture, and Ongoing Operations
Standards and Guidelines for Information Technology Infrastructure, Architecture, and Ongoing Operations This document describes applicable standards and guidelines for the university's policy on Information
The Case For InCommon Not Just for the Big Guys
The Case For InCommon Not Just for the Big Guys Session Goal To provide attendees with a better understanding of the challenges encountered by IUP that led to federated identity management exploration
Secure the Web: OpenSSO
Secure the Web: OpenSSO Sang Shin, Technology Architect Sun Microsystems, Inc. javapassion.com Pat Patterson, Principal Engineer Sun Microsystems, Inc. blogs.sun.com/superpat 1 Agenda Need for identity-based
Extend and Enhance AD FS
Extend and Enhance AD FS December 2013 Sponsored By Contents Extend and Enhance AD FS By Sean Deuby Introduction...2 Web Service SSO Architecture...3 AD FS Overview...5 Ping Identity Solutions...7 Synergy
globus online Integrating with Globus Online Steve Tuecke Computation Institute University of Chicago and Argonne National Laboratory
globus online Integrating with Globus Online Steve Tuecke Computation Institute University of Chicago and Argonne National Laboratory Types of integration Resource integration Connect campus, project,
Business and Process Requirements Business Requirements mapped to downstream Process Requirements. IAM UC Davis
Business and Process Requirements Business Requirements mapped to downstream Process Requirements IAM UC Davis IAM-REQ-1 Authorization Capabilities The system shall enable authorization capabilities that
Enterprise Portal Built by and for Higher Education
www.apereo.org/uportal Enterprise Portal Built by and for Higher Education Now Responsive for All Devices along with Native App Experience There is a growing demand for higher education institutions to
Shibboleth Authentication. Information Systems & Computing Identity and Access Management May 23, 2014
Shibboleth Authentication Information Systems & Computing Identity and Access Management May 23, 2014 For every question an answer: Why should I care about SAML? What is a Shibboleth? What is a Federation?
How to leverage SAP NetWeaver Identity Management and SAP Access Control combined solutions
How to leverage SAP NetWeaver Identity Management and SAP Access Control combined solutions Introduction This paper provides an overview of the integrated solution and a summary of implementation options
Identity. Provide. ...to Office 365 & Beyond
Provide Identity...to Office 365 & Beyond Sponsored by shops around the world are increasingly turning to Office 365 Microsoft s cloud-based offering for email, instant messaging, and collaboration. A
Federated Identity for Cloud Computing and Cross-organization Collaboration
Federated Identity for Cloud Computing and Cross-organization Collaboration Steve Moitozo Strategy and Architecture SIL International 20110616.2 (ICCM) Follow me @SteveMoitozo2 2 Huge Claims You want federated
Evaluation of different Open Source Identity management Systems
Evaluation of different Open Source Identity management Systems Ghasan Bhatti, Syed Yasir Imtiaz Linkoping s universitetet, Sweden [ghabh683, syeim642]@student.liu.se 1. Abstract Identity management systems
Federated Identity- and Access Management for the Max-Planck Society
Federated Identity- and Access Management for the Max-Planck Society Organisational Aspects & Funding Prof. Dr. Ramin Yahyapour Christof Pohl, Andreas Ißleiber GWDG Gesellschaft für wissenschaftliche Datenverarbeitung
How To Manage A Project Management Information System In Sharepoint
SharePoint 2010 for Project Management Course SP03; 3 Days, Instructor-led Course Description Leverage Microsoft SharePoint to increase the success rate of your projects and meetings in this SharePoint
Three Case Studies in Access Management
Three Case Studies in Access Management IAM Online June 10, 2015-2 pm EDT Andy Morgan, Oregon State University Mandeep Saini, GÉANT Albert Wu, UCLA Moderator: Tom Barton, University of Chicago Fit for
Single Sign-On for the UQ Web
Single Sign-On for the UQ Web David Gwynne Infrastructure Architect, ITIG, EAIT Taxonomy Authentication - Verification that someone is who they claim to be - ie, only the relevant user
PKI: Public Key Infrastructure
PKI: Public Key Infrastructure What is it, and why should I care? Conference on Higher Education Computing in Kansas June 3, 2004 Wes Hubert Information Services The University of Kansas Why? PKI adoption