The Role of an AAI in Campus System Integration +46705778807 - - PowerPoint PPT Presentation

the role of an aai in campus system integration
SMART_READER_LITE
LIVE PREVIEW

The Role of an AAI in Campus System Integration +46705778807 - - PowerPoint PPT Presentation

The Role of an AAI in Campus System Integration +46705778807 Torbjrn Wiberg CIO, Ume Universitet EuroCAMP, Ljubljana 060403 The Reason to Deploy an AuthN and AuthZ Infrastructure - AAI The introduction of By the way: web


slide-1
SLIDE 1

The Role of an AAI in Campus System Integration

+46705778807

Torbjörn Wiberg CIO, Umeå Universitet EuroCAMP, Ljubljana 060403

slide-2
SLIDE 2

060403

  • T. Wiberg, Umeå Univ

2

The Reason to Deploy an AuthN and AuthZ Infrastructure - AAI

  • The introduction of

web interfaces to applications, and of self services, drives the cost of user management up into the sky!

  • This fact alone

motivates an AAI!

  • By the way:

An AAI shall provide

  • Authentication
  • Authorization and
  • Enterprise information

(Attribute Release)

  • services to the

university and its partners

slide-3
SLIDE 3

060403

  • T. Wiberg, Umeå Univ

3

Planning for a new study programme

  • Programme planning committee
  • eMail account, project “wiki”
  • meeting room
  • New cources – Course spec group
  • draft, processed
  • Planning committee suggesta a new

programme

  • Project Support System
  • eMail List Server
  • Facilities Reservation System
  • Financial system
  • Calendar server,
  • Course Specification System
  • possibly with external
  • Content Management System
  • Workflow System
  • Goal Systems for publishing
  • ...
slide-4
SLIDE 4

060403

  • T. Wiberg, Umeå Univ

4

Observations

  • A lot of systems involved, perhaps 50
  • There is a need to share data between them
  • A lot of users
  • it could be “anyone”
  • ... mostly simple self service privileges
  • if you are a member of ...
  • The involved applications need
  • AuthN, AuthZ and Attribute Release Services
slide-5
SLIDE 5

060403

  • T. Wiberg, Umeå Univ

5

We need an AAI

  • Identity management for networked entities
  • people, systems, org. units, courses, projects
  • AuthN
  • Single signon through a webiso
  • AuthN of communicating entities – certificates
  • Privilege management
  • Mgmt of privilege info shall be done by those who

have the authority to delegate or appoint

slide-6
SLIDE 6

060403

  • T. Wiberg, Umeå Univ

6

We need an AAI ... cont

  • AuthZ
  • when ids are centralised the implicit right to use

a system has to be replaced by explicit access control

  • to keep costs of privilege mgmt down, most authz

has to be based on general enterprise information

slide-7
SLIDE 7

060403

  • T. Wiberg, Umeå Univ

7

Expected Results

  • Lower costs for user mgmt (80kEur/yr -> 20)
  • Better control of who is a user with what

rights in our systems

  • Cheap to build and deploy simple enterprise

applications

slide-8
SLIDE 8

060403

  • T. Wiberg, Umeå Univ

8

... if you can formulate your business rules!

  • What defines an active student?
  • How is an organisational unit established?
  • What authority has a guest professor, or a

professor on sabbatical?

  • What happens when you no longer have an

employment contract?

  • ...
slide-9
SLIDE 9

060403

  • T. Wiberg, Umeå Univ

9

We are reengineering our business processes

  • IT support for a process invariably results in

a “need” to use the AAI

  • Cheap to adapt a system to use the webiso
  • 28-40 hours
  • Excpectation to add system specific

information to the enterprise repository

  • discuss how enterprise data can be used
  • Expectation to be in the meta directory
slide-10
SLIDE 10

060403

  • T. Wiberg, Umeå Univ

10

We are in the middle of all this!

  • I am not here alone
  • Magnus Andersson, Magnus Söderlund, and Roland

Hedberg are also here

  • We are trying to agree on a component based

national Meta Directory reference model

  • There is no rational reason why we shall use

different approaches

  • Pål Axelsson, Roland Hedberg are also here
  • See swami.se
slide-11
SLIDE 11

060403

  • T. Wiberg, Umeå Univ

11

MetaDirectory Architecture