Download Middleware Implementation Case Studies

Middleware Implementation
Case Studies
Tom Barton, The University of Memphis
Renee Woodten Frost, Internet2 & UMich
Louise Miller-Finn, Johns Hopkins University
Outline of Presentation
• Renee will introduce the concept of Core
Middleware and the reasons for implementation
• Tom will give an overview of the structure of an
Enterprise Directory Service and identify some
issues currently facing the U of Memphis.
• Louise will detail the Johns Hopkins model for an
Enterprise Directory Service.
• Renee will summarize some additional related
Internet2 Middleware Initiative activities.
28 June 2001
2
Core Middleware
Identity - unique markers of who you (person, machine,
service, group) are
Authentication - how you prove or establish that you are
that identity
Directories - where an identity’s basic characteristics are
kept
Authorization - what an identity is permitted to do
PKI - emerging tools for security services
28 June 2001
3
Organizational Drivers
• Federal government
• E-enterprise functions
• Service expectations
• Resource allocation pressures
• Collaboration
28 June 2001
4
Benefits to the Institution
• Economies for central IT - reduced account management,
better web site access controls, tighter network security...
• Economies for distributed IT - reduced administration,
access to better information feeds, easier integration of
departmental applications into campus-wide use...
• Improved services for students and faculty - access to
scholarly information, control of personal data, reduced
legal exposures...
• Participation in future research environments - Grids,
videoconferencing, etc.
• Participation in new collaborative initiatives - DoD,
Shibboleth, etc.
28 June 2001
5
Costs to the Institution
• Modest increases in capital equipment and staffing
requirements for central IT
• Considerable time and effort to conduct campus
wide planning and vetting processes
• One-time costs to retrofit some applications to
new central infrastructure
• One-time costs to build feeds from legacy source
systems to central directory services
• The political wounds from the reduction of
duchies in data and policies
28 June 2001
6
Nature of the Work
• Technology
– Establish campus-wide services: name space,
authentication
– Build an enterprise directory service
– Populate the directory from source systems
– Enable applications to use the directory
28 June 2001
7
Nature of the Work
• Policies and Politics
– Clarify relationships between individuals and
institution
– Determine who manages, who can update and
who can see common data
– Structure information access and use rules
between departments and central administrative
units
– Reconcile business rules and practices
28 June 2001
8
Enterprise Directory Service:
What Is It?
• Anti-stovepipe architecture that can provide
authentication, attribute, & group services to
applications.
• Adds value by improving cost/benefit of online
services and by improving security.
• A new & visible flow of administrative data.
When someone finally begins to understand what
you’re talking about, they react to the prospect of
change.
28 June 2001
9
Managed Objects
• Objects that describe:
–People
–Groups
–Aliases, Roles, Affiliations
–Network devices
–Security policies
–Network services
–Org structure
• The object classes and source data to populate them
are determined by the applications to be directory
enabled.
28 June 2001
10
Enterprise Directory Service:
How To Build One
•
Determine application-driven
requirements for authentication, attribute,
and group services and then design these
four stages to meet the requirements:
1.
2.
3.
4.
28 June 2001
Data Sources
Metadirectory Processes
Directory Services
Applications
11
UoM Core Middleware Stages
Data sources
Metadirectory processes
2
BuildUser
Directories Applications
3
qi-oper
utils
tigerlan
NDS
UMDI
whitepages
cardswipe
web
authN
qiSynch
Ph
web
authZ
LDAP DS
IDs
HRS
1
Ph Rebuild
& AMP
SIS
address
books
misc
actions
IMAP/POP
mail
web
mail
RADIUS
calendar
FRS
28 June 2001
wireless
dialup
mass
messaging
SMTP
AUTH
mail
routing
12
Notes re: UoM Core Middleware Stages
•
•
•
Data Sources: Attribute selection; negotiation for
access; determination of data access policy; familiarity
with semantics of desired data elements & business
processes that maintain them.
Metadirectory Processes: Management of identity;
transformational & business logic (resource
provisioning); derived attributes & structures (eg, uid’s,
email attributes, state variables, org structure groups &
attributes, …).
Directory Services: Loading & replicating; access
controls for directory information; schema extensions to
support applications; indexing & performance
management; synchronizing other consumers of
directory info.
28 June 2001
13
Notes re: UoM Core Middleware Stages
Applications. Some boxes represent classes of apps.
Tigerlan (800 seats of computer labs); white pages (people
search); Library proxy access; postoffice & calendar account
building; manage mail account (vacation, quota, …); various
web-based utilities for LSPs; ResNet autoregistration; secure
discussion groups; campus pipeline; UoM “address book”
integrated into email clients; IMAP/POP/web accessible
emailboxes; calendar; email routing; off-campus email relay
provided only to authenticated users; mass email; dialup &
wireless authentication & authorization; card swipe
facilitated account self-maintenance; automated account &
resource management (“misc actions” in the slide).
28 June 2001
14
Notes re: UoM Core Middleware Stages
Applications - upcoming: WebCT; data warehouse;
suite of applications directly managed by AD; shell
account, home directory & personal web page access;
FASTLane (Faculty & Staff LAN); storage &
distribution of digital certificates, a key element of PKI;
PIN synchronization??; new UoM ID card based
applications??; authentication of Library patrons??
28 June 2001
15
Issues With Current Data Sources
HRS:
• All accounts paid from,
not just primary
department.
SIS:
• Select students from
current, future, and
previous term and add’l
data elements to support
2nd generation group
messaging.
• Pull instructor data too.
28 June 2001
ADS (Alumni): initiate
DRA (Library): initiate
Async (Clientele):
• New web based account
self-maintenance to
replace card swipes.
• “Challenge” Qs & As for
identification in non faceto-face circumstances.
16
Issues With the Current Metadirectory
• NDS update channel is too slow
• Ancient, frozen technology (especially Ph)
• Anticipate new policy regarding account &
resource management, especially to handle
off-campus students & alumni.
• 9 years of spaghetti
• Tightly bound to particular source and
directory technologies.
28 June 2001
17
Issues With Current Directories
• Must bring Active Directory into this
infrastructure.
• Need better representations & procedures
for non-people objects: static groups;
dynamic groups; org structure related
groups, roles, and people attributes;
affiliations & other “correlated” info.
• Need to include new types of metadirectory
consumers such as list processors
28 June 2001
18
MetaDirectory Data Flow Overview
• Provide complete SOR data-to-directory path;
• Push the data through one cycle to kickoff development
process; (prime the pump)
– Review first iteration, and prepare next iteration with
updates;
• Each iteration flushes more detail to the requirements in a
rapid application development process adding data,
business rules and/or policy changes;
• Document and store standard deployment procedure;
• Each iteration provides intense unit testing followed by QC
test cycle, then move to production
28 June 2001
19
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End Business
Rules and
Processing
Prepare and export
data for directory
Directory Loading
Directory Status
View
Oracle
Repository
Directory Files
(Add, Change,
Delete)
SIS
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
20
Stage 1 – Analyze Data Sources
• Identify Data Sources
– Where do the data feeds originate; what data
fields are required; Provide Standard Data
Collection Model
– What is the frequency of the data feed; require
fixed length fields and records;
• Define database load procedure and produce
audit log
28 June 2001
21
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database
Load
Back End Business
Rules and
Processing
Prepare and export
data for directory
Directory Loading
Directory Status
View
Oracle
Repository
Directory Files
(Add, Change,
Delete)
SIS
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
22
Stage 2 – Database Requirements
• Define the input tables to represent the clients’ data; define
key fields to tie tables together;
• Document and store common database procedures;
• Provide data model using Entity Relationship tool (e.g.
ERWin);
• Provide standard database templates for reuse;
• Provide audit log
28 June 2001
23
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End
Business Rules
and Processing
Prepare and export
data for directory
Directory Loading
Directory Status
View
Oracle
Repository
Directory Files
(Add, Change,
Delete)
SIS
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
24
Stage 3 – Back End Processing (BEP)
• Develop procedures (PLSQL) to process high
level business rules;
• Create intermediate tables with directory records;
• Implement ER diagrams that define table fields;
• Store common procedure templates for reuse;
• Provide audit log;
28 June 2001
25
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End Business
Rules and
Processing
Prepare and
export data
for directory
Directory Loading
Directory Status
View
SIS
Oracle
Repository
Directory
Files
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
26
Stage 4 – Database Table Export
• Provide export file in fixed field, fixed record format;
• Develop status field processing using eye catcher (e.g.
‘ADD’, ‘DELETE’, ‘UPDATE’, ‘NOCHANGE’)
• Document export procedure and standard field values;
• Create and store common export procedure template;
• Produce activity log
28 June 2001
27
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End Business
Rules and
Processing
Prepare and export
data for directory
Directory
Loading
Directory Status
View
SIS
Oracle
Repository
Directory
Files
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
28
Stage 5 – Directory Import
• Process export files using generic (PERL) script to
import/update enterprise directory;
– Keep code free of business rules;
• Create and store common script template for
reuse;
• Provide web base report interface to track activity
and status;
• Provide audit log
28 June 2001
29
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End Business
Rules and
Processing
Prepare and export
data for directory
Directory Loading
Directory Status
View
Oracle
Repository
Directory Files
(Add, Change,
Delete)
SIS
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
30
Stage 6 – Directory Status
• Provide audit log of directory activity;
– Create and store common report template;
– Generate standard web based activity report;
• Provide backup/recovery procedure;
• Provide replication service;
28 June 2001
31
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End Business
Rules and
Processing
Prepare and export
data for directory
Directory Loading
Directory Status
View
Oracle
Repository
Directory Files
(Add, Change,
Delete)
SIS
Enterpise
Directory
Alumni
Stage 7
Application
Database
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Web Enabled
Front End
Authen
Stage 8
MetaDirectory
Data Flow
32
Stage 7 – Front End Processing (FEP)
• Define and deploy access control (ACL);
– Define JHI policy for the global user, the person, and the
administrator;
– Develop and document scope and visibility to the directory
attributes;
• Develop and deploy common web enabled directory
access (a common ‘look and feel’ to the front end);
– Use a common set of development tools (e.g. ColdFusion);
• Apply front end application level business rules
(more specific rules than the back end process);
28 June 2001
33
Stage 1
Stage 2
Stage 3
Stage 4
Stage 5
Stage 6
Payroll (5)
Database Load
Back End Business
Rules and
Processing
Prepare and export
data for directory
Directory Loading
Directory Status
View
Oracle
Repository
Directory Files
(Add, Change,
Delete)
SIS
Enterrpise
Directory
Alumni
Stage 7
Application
Database
Web Enabled Front
End Authentication
Badging
Libraries
Directory Update
Log to Data
Sources
Directory Update
Holding Area
28 June 2001
Stage 8
MetaDirectory
Data Flow
34
Stage 8 – Directory Updates
• Provide a log dataset of directory activity
(updates, deletes, etc.);
• Provide standard procedure for data owners to pull
the activity log;
• Design and implement a standard record layout
using a status field and a audit trailer record;
28 June 2001
35
Summary
•Don’t underestimate the need to keep
repeating the message
•Support from the top is critical
•Continual auditing: data feeds will
disappear or show up corrupted
•Hire the best, otherwise you will waste
much time and $$$
•Maintain KISS principle
28 June 2001
36
Questions and Answers
28 June 2001
37
Related I2 Directory Activities
• Early Harvest / Early Adopters http://middleware.internet2.edu/earlyharvest/
http://middleware.internet2.edu/earlyadopters/
• LDAP Recipe http://www.georgetown.edu/giia/internet2/ldaprecipe/
• eduPerson –
http://www.educause.edu/eduperson
• Directory of Directories –
http://middleware.internet2.edu/dodhe
28 June 2001
38
Related I2 Middleware Activities
• Shibboleth –
http://middleware.internet2.edu/shibboleth/
• PKI – HEPKI-PAG, HEPKI-TAG
http://www.educause.edu/hepki/
• PKI Labs
http://middleware.internet2.edu/pkilabs/
• Vidmid –
http://middleware.internet2.edu/video/
28 June 2001
39
For More Information
• Tom Barton
[email protected]
• Renee Woodten Frost
[email protected]
• Louise Miller-Finn
[email protected]
28 June 2001
40