Multicampus Middleware

1. Multicampus Middleware Opportunities and Challenges for multicampus systems, federations, and consortia

2. Multicampus taxonomy • Centrally managed set of campuses • or at least centrally funded… • Federated campuses • e.g. sharing common administrative resources • Consortia • shared contracting for common resources • Inter-segmental student, faculty & resource sharing (?)

3. Some of the Issues • Consistent “identity management”, e.g. • Is a given entity recognized everywhere? • Need for common ID# (not same as EPPN) • Directory issues, e.g. • Need a systemwide “enterprise directory” • Authoritative versus derivative • Are common elements defined similarly? • Common authentication • Common resource sharing

4. Common authentication? • Does my AuthN at one campus get me to services on another campus? • If PKI, common hierarchy or …? • are cert profiles compatible • Including extensions… • If different authentication technologies are used, are they roughly equally strong? • PINs vs certs vs UID/Pwd

5. Common authorization? • Is there a common set of business rules for administrative systems? • Is there a common definition of “member of the community” • How is this documented and/or managed? • Is there a common definition of “student”? • Etc. • Can we retrofit legacy systemwide apps?

6. Shibboleth • Does the Shibboleth model simplify intra-institutional or systemwide scenarios? • Simplifies the common auth problem • Allows for significant autonomy • Sets stage for use with external resources • Incents development of directories • May ease political challenges

7. Drivers • Shared library resources • Employee self-service systems • Distance education • Common administrative systems • E-commerce

8. Inhibitors • Autonomy vs common good • Legacy • Politics • Funding • …

9. Observations • Many campuses are adding to eduPerson • Are the new elements similar? • Need for “cookbook” for PKI & directories • Need advice on authorization strategies • Alternative to single directory might be a referral tree from a systemwide root • Doesn’t solve the single entry problem • “If you’re going to do it, do it our way.”