Initiative Report for IT CIO: Identity Management/Single Sign-on Trident Setup and Training

Transcription

1 Initiative Report for IT CIO: Identity Management/Single Sign-on Trident Setup and Training Summary: This initiative is to request funding for setup and training of the identity management appliance, Trident HE. This initiative will provide the funding necessary to accelerate the installation and setup of this appliance which has already been approved and purchased. Description Identity management is a necessity in this cyber-age, and a requirement for businesses and educational institutions alike. Identity theft has become common place in the world today and ensuring the safety of our students and employees is not only important, but our responsibility as an employer and educational institution. Beyond this responsibility, there is the added benefit to our students and staff to allow for single sign-on features through an identity management system. Once the system is fully setup and configured, a student or employee of Lane will be able to login once and gain access to all of the services/functions/software that they should have access to WITHOUT having to login to each of these services/functions/software. For example: A registered student would login once and immediately have privileges to go to their portal account, their Moodle account, and any other account that they were setup for without having to login to each time. A department admin would login once and immediately have privileges to go to their portal account, banner, expresslane, groupwise, etc. In addition, identity management provides a single place for changes to addresses, names, titles, etc. and ensures that these changes are propagated to all systems. This project is a multi-phase project, so single sign-on to all services will be further down the road. But, during the initial phase, we will be able to provide single sign-on for most of the primary services used by students and employees. Not to mention the added benefit of SECURE access to our accounts - protecting our identities while using Lane services. Questions and Answers How is the initiative linked to the Unit Plans most recently submitted? 1. How does it continue the achievement of those goals? 2. If this is a continuation of an initiative started last year, make sure that relationship is clear.

2 How is this initiative linked to the efficiencies and productivities plans you had last year? 1. How does it continue the achievement of these plans? 2. If this is a continuation of an efficiency or productivity plan started last year, make sure that relationship is clear. This initiative is tied to project work began last year when the Trident appliance was purchased. This initiative will continue this project by providing the funding necessary to complete the installation and phase 1 of this multi-stage project. Describe the resources needed: Primarily, we need vendor support to get the system setup and configured. Infrastructure Preparation (Review by AIS) o Create Trident VM o Create RDBMS instance o Create Dev AD Instance o Create Dev LDAP Instance Facilitate AIS Access (Review by AIS) o Configure VPN/Network Access o Win Server RDP/admin Access o Configure SSH/sudo Access to Linux Servers o Upload credentials to passpack o Verify AIS Access Detailed Specification/Use Cases (Review by AIS) o To include provisioning/de-provisioning use cases as controlled by the BEIS messages coming from Banner. = $7, Development Environment Installation Create Virtual hosts: o TridentHE o Bonita Self-Service o CAS/Shib SSO Install Trident Components o Create RDBMS schema/initial data o Install JRE 1.7 o Install Apache WebServer o Install Apache Tomcat o Deploy Trident wars o Configure Logging o Configure Security o Configure Tomcat

3 o Configure Apache Reverse Proxy Install Connectors o LDAP o BEIS = $7, Trident Configuration Basic Configuration o Password Policies o Authentication Policies o Create Access Roles o Associate Resources Authoritative Sources o Install/Configure BEIS Sync Connector o Develop BEIS Transform Script o Develop CSV Transform Script o Install/Configure Sync from CSV Connector Managed Connections o LDAP Configure Connection Attribute Policies = $15, Bonita Self-Service Workflows Installation o Create Oracle/Mysql Bonita repository o Install Bonita Server o Install Trident Self-Service application and workflows Customization o Brand for Lane Community College o Change Verbiage as required o Modify claim lookup if required Target Resources o Self-Service application enables the user to self-manage their credentials and automatically updates ALL resources managed by Trident. = $7, CAS/Shibboleth SSO Create CAS/Shib host VM Install SSL Certs Install CAS Install Shib Configure CAS for LDAP authentication (assumption LDAP/AD is password store)

4 Configure Shib for LDAP attribute resolver (assumption LDAP/AD is attribute store) Configure Groupwise + CAS (assumption, Groupwise has CAS agent) Configure GoogleApps + Shib Document setup and Create operational howto= $ Test Prepare Test Plan Test o Seed Trident from CSV sync o Process updates from Banner via BEIS o Observe and verify proper functionality as per MS-2 configuration including deprovisioning o Adjust as necessary= 5, Transfer of Technology: Provide a complete walk through of the Installation, Configuration, and Groovy scripts used in the project.= $3, Services Total (Not To Exceed) $61, Request: Technology Fee (INS) $61, What specific measurable program outcomes do you expect to achieve with this initiative? The outcomes should be specific enough to be measurable. Also, outline the method that will be used to determine the results. The outcome of this initiative will be the installation, setup, and configuration of an identity management/single sign-on system at Lane. This system will improve the student and employee system access experiences at Lane while ensuring identity protection for the Lane community. It also provides the foundational provisioning platform for the launch of student . Department Priority: 3 Unit Resources: Programming and Developer staff time while be provided to assist with the installation, setup, and configuration of the system plus maintaining and supporting the system once it is up and running.

5 Funding Request: Carl Perkins Funding Request: Curriculum Development Funding Request: Technology Fee 1. Category of request Maintain existing technology Increase student access to technology New technology Please type in the category of the request in the field below. New Technology 2. Campus location Main Campus Downtown Center Florence Cottage Grove CLC (list specific locations) Please type in the location of the request in the field below. All Lane Locations 3. Names of the person(s) with more information (if needed): Bill Schuetz Russ Carr Kyle Schmidt Barbara Barlow Powers 4a. Budget ORGN b. Budget PROG How many students will benefit per year?

6 All Lane students will benefit every year. 6. Describe the benefit? Security of identity while using Lane services Ease of access - login once to gain access to all needed services COMPUTER HARDWARE $ COMPUTER SOFTWARE $ STAFFING $ INSTALLATION $ LICENSING $ Can this initiative be partially funded? Yes COMPUTER HARDWARE $ (CH) Explanation of effect of partial funding: COMPUTER SOFTWARE $ (CS) Explanation of effect of partial funding: STAFFING $ (S) Explanation of effect of partial funding: INSTALLATION $ (I) Explanation of effect of partial funding: Some aspects of the quote provided may be covered by internal staff, in which case the overall costs to Aegis Identify Services would be minimized. Otherwise, the full amount would be needed.

7 LICENSING $ (L) Explanation of effect of partial funding: