Emory University Case Study I2 Day Camp

Transcription

1 Emory University Case Study I2 Day Camp November 5, 2010 John Ellis & Elliot Kendall

2 About Emory Facts & Figures Private university in suburban Atlanta ~ 13,000 undergrads, 7,000 grads Professional schools, including Medical, Law, Business, Public Health schools ~ 24,000 employees, including those from our academic medical center (hospitals and clinics) Centralized IT, but many strong departmental IT groups 2

3 IT Foundation Standard Approach for Directory Services (ID Management, Authentication, Authorization) Synchronize existing directories (e.g., LDAP and Active Directory) so that phone and lookups can occur for all University and Healthcare staff, irrespective of location. Synchronize approach for assigning network IDs across the Academic and Healthcare Enterprise. Migrate existing network IDs and synchronize password credentials and expiration policies. 3

4 IT Foundation Identity Management Select identity management vendor; develop a phased-in approach for implementing priority modules such as provisioning and single sign-on. Completion Target Dates: Proof of Concept by the end of October Business case presented to IT Governance by January

5 IT Foundation Governance and Prioritization for IT Initiatives Create a set of timely, transparent processes for IT governance and prioritization clearly aligned with the missions of Emory. Create a common business case template that can be used across Healthcare and the Academic enterprise. Develop reporting mechanisms that allow committees to understand performance of application and project portfolios. 5

6 Governance IT Executive Sponsors / Ways and Means Committee Academic Enterprise Healthcare Enterprise Capital Evaluation Team Finance Human Resources Information Technology Steering Team Student Services Instructional Technology Emory Hospitals Administrative Team Healthcare Finance Committee VP -IT review The Emory Clinic Management Group Development and University Relations Research & High Performance Computing IS Decision Team Technology Infrastructure and Policy The Emory Clinic Management Group Emory Hospitals Administrative Team Healthcare Management Group Annual Budget Business Case Process New Request Business Case Process Capital Budget Business Case Process New Request Business Case Process Common Business Case Template Common Business Case Template Overall University governance, funding bodies and processes IT -specific governance, funding bodies and processes 6

7 Organizational Waves Governance Transparent, aligned with enterprise mission UTS Combined telecom and applica:on divisions SSO/ Fed Shibboleth deployed in produc:on NetCom Consolidated network and phone across Emory CIO Single Central IT structure across Emory Enterprise Common solu:ons across the enterprise (IdM, Exchange) InCommon AEer Iden:ty Manager deployment, joined InCommon, completed first POP ITIL & PM Frameworks for process improvements 2010 Efficiency More capacity available for strategic ini:a:ves Alignment Transi:on from founda:on and opera:onal focus to services and business alignment Strategic Emory IT aligned as a strategic business partner 20xx Consolida&on Founda&on Opera&onal Excellence Innova&on 7

8 SSO History Siteminder In 2008, Emory had been using Siteminder for number of years Complex, difficult to maintain, difficult to use, and expensive Very low adoption rate No benefits from "single" sign-on Most sites used direct LDAP connections 8

9 SSO Choice With an eye towards federation Wanted to provide better SSO service, improved security Did detailed comparison of popular options: CAS, CoSign, Siteminder, OpenSSO, Shibboleth, etc. Shibboleth distinguished by federation support 9

10 Shibboleth Chosen Proof of Concept deployed first Shibboleth is complex, but well documented Most implementation time spent re-reading docs, packaging software Completely successfully in a few months, ahead of schedule Commercial contract implementations also available 10

11 Shibboleth in production Our implementation Deployment on shared JBoss app cluster somewhat challenging Clustering multiple nodes with Terracotta inelegant but straightforward In production and stable on around half a dozen apps Additional apps on hold pending JBoss upgrade to fix bug inherited from old version of Tomcat 11

12 Challenges Need to support common attributes for federation eduperson, EPPN, etc. Two LDAP infrastructures. User education understanding SSO Sign-off issues 12

13 What s Next Proof of concept federated authentication with Georgia Tech Gartner integration InCommon Wiki 13

14 Click to add title? Ques&ons 14