Friends of Penn State - FPS

1. Friends of Penn State - FPS James A. Vuccolo Lead Research Programmer Advanced Information Technologies (AIT) in Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS)

2. Agenda • Introduction • The Development Process • Using FPS • Upcoming Features • Application Providers • Wrap-Up

3. Introduction

4. Names Informal Authentication External Authentication FPS ITSEA FOPS Friends of Penn State

5. What FPS IS • The Friends of Penn State Account System is a digital identity management system designed to be used by application providers from within the Penn State community to establish and manage an end-user’s identity who does not have a Penn State Access Account. (Most likely for Web-based applications.) • It is a database that holds various attributes about a person, including contact info AND a means for authentication. • It provides a set of APIs which establish and manage account information.

6. What FPS is NOT • It is NOT a set of end-user applications. • It’s a database, Kerberos V (K5) KDC, and APIs. • It is NOT for organizations or companies outside of the Penn State community to use for their applications. • It enables people outside the Penn State community to access applications from within the Penn State community.

7. The Development Process

8. Assemble a Team • FPS team members include representatives from: • Administrative Information Systems (AIS) • Academic Services and Emerging Technologies (ASET) • Advanced Information Technologies (AIT) • Consulting and Support Services (CSS)

9. Interview Stakeholders • Stakeholder • A person/group who has a vested interest in FPS for use in their Web-based applications. • Each organization was interviewed to determine what their needs are relative to FPS. • Who are they? • Office of Undergraduate Admissions, College of Agricultural Sciences, Alumni Association, Penn State Great Valley, University Library, Office of Human Resources (OHR), Outreach & Cooperative Extension (O&CE), PA State Data Center, Office of the University Registrar, Office of Student Aid, Office of the University Bursar, Undergraduate Education, World Campus and eCommerce

10. What Did We Ask? • Indicate the number of users you intend to serve in the next 3,5, and 10 years. • What type of user identity is needed for your application(s)i.e., userid/password, personal cert., Penn State Id+ number, etc.?  • Indicate examples of data that would need to be stored and whether this data would be stored in our database (userid, emailaddress, address,...)? • Do you anticipate the migration of your users between theexternal and internal (production cell) authentication realms?  • Indicate what determines an inactive account and the length oftime in which data for this account should remain online. • Do you need specific APIs to a access the central data store toretrieve information about the user? • Do you interface with other universities and/or organizationswhere identity must be exchanged? • What authentication method is sufficient/needed now and in the future? • Do you have a need for different classifications of accounts?

11. Design • After the stakeholder interviews the project team was able to do the following: • Derive FPS requirements • Determine the technology to be used to satisfy the requirements • Design the data store to be used to store user attributes • Determine what software would be developed

12. Requirement Categories • General • Authentication • Database • Graphical User Interface (GUI) • Security • Application Programming Interface (API) • Migration • Stakeholder Specific

13. Selected Technology • Authentication • Process for determining whether someone or something is, in fact, who or what it is declared to be. • MIT Kerberos V (K5) • Authorization • Process of giving someone permission to do or have something • IBM DB2 Database • IBM Directory Server (IDS) LDAP Server

14. What is Kerberos? • Kerberos is: • “…a network authentication protocol. It is designed to provide strong authentication for client/server applications using secret-key cryptography” • http://www.mit.edu/kerberos/www/ • Components • Key Distribution Center (KDC) • Master (located in Computer Building) • Slave (located offsite) • Clients • Application Servers

15. Database Design

16. Architecture Native Kerberos Kerberos Propagation CLIENTS LDAP Replication FPS API • fops.offsite.psu.edu • Slave KDC • LDAP Replica • fps.psu.edu • Master KDC • LDAP Master • DB2 Database • Apache SSL Web Server

17. Technology Summary

18. Implement • CGI Programs (https://fps.psu.edu/) • Create identity, change password, reset password, remove identity, update information and check identity • HTTPS POST APIs (XML output) • Create identity, change password, reset password, authenticate identity, set data, get data, certify identity, un-certify identity, lock identity, unlock identity, sign identity, un-sign identity, remove identity, get all data and remove role • Help Desk Consultants Interface

19. Test • Testing was performed in the following areas: • Verification and validation of FPS CGIs and APIs • Propagation of data from the Master to the Slave KDC • Creation and maintenance of information in the LDAP server

20. Using FPS

21. Obtaining An Account • Migration • People who leave the University (e.g. graduates) will be migrated automatically to the external realm. • FPS accounts holders who establish a formal relationship with Penn State (e.g. an applicant who registers) will be migrated automatically to the internal realm. • Web Site • Those who would like to have an FPS account can go to the FPS Web site (https://fps.psu.edu/) to create an account for themselves.

22. Developing Applications • Interested groups who want to develop applications should do the following: • Consult the FPS project site at http://www.psu.edu/fpsproject/ • Contact the FPS development team at fps@psu.edu to discuss their specific application

23. Using APIs • FPS APIs can be used with the following languages: • Perl • Java • C • ASP • Smalltalk

24. A Sample API <html> <head><title>Test Create</title></head> <body> <form name=“auth_identity” method=“post” action=“https://fps.psu.edu/api/auth_identity.cgi”> <input type=“hidden” name=“userid” value=“jav5002> <input type=“hidden” name=“password” value=“someval”> <input type=“hidden” name=“group_id” value=“1”> <input type=“hidden” name=“in_fields” value=“userid,password”> <input type=“hidden” name=“min_flds” value=“userid,password”> <input type=“submit” name=“s” value=“submit”> </form> </body> </html>

25. A Sample API (cont’d) <?xml version="1.0" encoding="utf-8" ?>-<authentication> <status>SUCCESS</status> <realm>external</realm> <personID>243649</personID> <roleList/> </authentication>

26. What Are Roles? • Attributes that are assigned to a user • User paid using a credit card. • A picture ID was checked. • Identity was migrated from the internal realm. • A signature for a Penn State Access Account exists on file. • Notary • Enables access account holders to assign specific roles to an FPS identity

27. Upcoming Features • Unified Lab Consultants Interface • Automated migration of identities from the internal to external realm • Will happen before identity is locked in the internal realm • Migration of identities from the external to the internal realm • Example: when an applicant becomes a paid accept

28. Application Providers • World Campus • Automated Registration System • Courses.worldcampus.psu.edu • ANGEL • All auth via FPS server • CWC • Campus Advisory Committee Members • Admissions • Student Application

29. Application Providers (cont’d) • Graduate School • AIS/Registrar • Transcripts Application • Dairy and Animal Science • Web based extension activities • Great Valley • Information kiosk • DLT • http://etda.libraries.psu.edu/

30. Wrap-Up • Questions? • Comments!