Identity Management: What it is, isn t and what it can do for you. Tom Golson, TAMU IT

Transcription

1 Identity Management: What it is, isn t and what it can do for you Tom Golson, TAMU IT

2 Agenda Identity management, from a high level TAMU IT s history in Identity Management Brief overview of Dell ONE Identity Manager Plans for the evolution of Identity at Texas A&M University Cautions and Warnings Questions

3 What is Identity Management? Identity and Access Management consists of Policies Processes, and Technologies put in place for the purpose of establishing Subject digital identities and controlling access to digital resources.

4 That sounds easy enough... Identity and Access Management is NOT just account provisioning or password management. For Identity and Access Management, stakeholders, data owners (Registration Authorities) and identity consumers have to work together and agree on the the data to aggregate and the practices for reflecting Identity to downstream services.

5 When approached holistically Identity and Access Management enables Security Compliance Outreach Personalization Decision making Identity reduces the friction between customers and services.

6 How it began at Texas A&M University Starting in 1999 as a username and address for Identity was an IT project focused on until The NetID Formal efforts began to engage stakeholders and the LDAP Working Group was formed 2010 The NetID and Identity activities expanded into Active Directory 2014 Identity Agent programs began

7 Technically: 1999

8 Technically: 2011

9 And That s When We Knew Identity and Access Management was precariously perched Dozens of data sources Processed by hundreds of applications Directly provisioning 10 targets Indirectly provisioning dozens of targets through data feeds and uploads to customers Staffing couldn t increase Helping customers integrate identity was almost impossible

10 Enter Dell ONE Dell ONE is an Identity Management suite The core, Identity Manager is: Object mapping and libraries Workflow Job execution Synchronization Connectors & provisioners TAMU IT also purchased: Password Manager Data governance Cloud Access Manager

11 Dell ONE Block Diagram

12 Freeing up resources Texas A&M University genuinely has an advantage: Established governance processes managed out of the Identity Office Strong working relationships with data owners and data consumers

13 To Deliver Process and relationship mean: Consensus around persistent, unique identifiers has been established The Identity Team has a deep understanding of the data and the limitations of the data

14 Real Value So we can now Stop writing applications and Focus on integrating: Identity creation Provisioning Deprovisioning Group membership

15 Crawl, Walk, Run, Run, Sprint 16 years of Identity and Access Management infrastructure doesn t turn on a dime But we have an extremely aggressive schedule Kickoff in January Dev installation complete by end of February Model data aggregation by end of April Parallel loading of Identity Store by end of June Manage TAMU IT dev directories by end of July Current provisioning/deprovisioning replaced by end of September

16 Uncharted Territory When the process of aggregating identity data and reflecting that into TAMU IT directories is complete, it isn t quite home free Migrate TAMU IT customer-facing services ( into the Dell ONE portal Migrate web services to Dell ONE native services or re-factor

17 But hopefully in parallel Dell ONE delegation for provisioning federated Active Directories Provide major organizational units access to Identity data for the purposes of: Minimizing the number of credentials our customers have to manage Expanding the umbrella of compliance Improving the security posture of the entire organization Campus member access also means improving the Identity Store by exposing group functionality

18 Data Governance Module The Dell ONE Data Governance module offers Self-service requests for access to participating Active Directory file and resource shares Includes audit trails for specific resources And audits of resources for individuals

19 Cloud Access Manager CAS and Shibboleth have been great but have limitations Sharepoint s non-standard SAML implementation Applications requiring complex response transforms (data or protocol) An opportunity to make central credential management (expiry, security) available to new categories of applications Social identities for low assurance populations

20 But Buyer Beware The history of Identity and Access program migrations is littered with failures It is not possible to vet, in advance, every use case It will be at least six months before any meaningful conversations about community opportunities can happen

21 Questions? Or feel free to me at tgolson_at_tamu.edu