Identity M anagement in the Environment of Mendel University in Brno

1. Identity Managementin the Environment ofMendel University in Brno Milan Šorm

2. Contents • University in numbers • Historical identity management • Ideal solution • University information system • Current implemented situation • Known problems • Results • Future ideas SDI 2007, ZČU v Plzni

3. University in numbers • Medium-sized university • 12 000 students • 2 000 employees • 2 000 other users in campus • 4 faculties, 80 departments • 5 000 prepared network connections • 3 500 PCs • 50 user servers SDI 2007, ZČU v Plzni

4. Historical identity management • No centralized identity management • No policy for • building servers • interconnecting department networks • accessing network environment • creating accounts • connection information services to netword • More than 20 admins • Totally decentralized SDI 2007, ZČU v Plzni

5. Ideal solution • One account credentials for one user • Setup policy for connecting all PCs, servers and services to netword environment • One place to define AAA for all services • Minimize number of network admins • Centralized storage for data and profiles • Single sign on • Maximum HA SDI 2007, ZČU v Plzni

6. University information system • In last 7 year we reconstruct all small IT services and production ISs to one central complex information system with integrated data warehouse • This information system can be source of all information about our users and their credentials, rights, roles etc. • Unique source of informations SDI 2007, ZČU v Plzni

7. University information system Public informationportal SDI 2007, ZČU v Plzni

8. University information • General object qualify principle • We can describe any group of objects (users, computers, departments, segments, roles, rights etc.) and identify them by IDs • We can put these groups to relations and prepare source of all AAA informations • All of these informations are dynamic • Example: • students and schedules SDI 2007, ZČU v Plzni

9. Current implemented situation • Many meetings with server and service administrators and IT departments lead to setup one policy in • creating account (UIS based, algorithmized) • setting groups, rights, quotas through Technology subsystem in UIS by power users (owners, specialists) • accessing network and creating new services is maintained through central IT department SDI 2007, ZČU v Plzni

10. Current implemented situation Services LDAP replicas Primary LDAP server University IS Datawarehouse SDI 2007, ZČU v Plzni

11. Current implemented situation • UIS prepare all data for identity management in central data warehouse (Oracle 10g) • Application logic stored in DW (PL/SQL) create and update primary LDAP server (OpenLDAP) with all credentials • LDAP push data to LDAP replicas • All IT services are connected to one or more LDAP replicas for AAA services SDI 2007, ZČU v Plzni

12. Current implemented situation • All faculty and university services are connected to this AAA infrastructure • For accessing network you need: • registered computer through computer authorization in UIS Technology subsystem • account in AAA infrastructure for accessing network (eduroam connector, dormitories net connector, public network access during conferences etc.) SDI 2007, ZČU v Plzni

13. Current implemented situation • Consolidation of IT services • centralized e-mail distributing system • centralized file server services systém • standardization of classrooms installations • UIS know for each user his personalized policy: • where user read e-mails • desktop information • fileserver connections … SDI 2007, ZČU v Plzni

14. Current implemented situation • Classroom computers access central server farm for roaming Windows or Linux profile • These profile has defined scripts for attaching other resources • E-mail is passed through distribution server which run antispam and antivir and distribute e-mails to user favourite e-mail server • Samba or AD solution • Linux PAM solution SDI 2007, ZČU v Plzni

15. Current implemented situation • Information about allowed classrooms is stored in LDAPand Samba/Linux classroom servers or stations use them for managing login process • All other information (home directory, roaming profile, other resources) is accessed through dynamically created profile and scripts called from this profile SDI 2007, ZČU v Plzni

16. Current implemented situation • Many other IT services access central LDAP • UIS web interface • Catering service (Anete Kredit) • Network accessing service (eduroam, Faro) • VPN concentrator • HelpDesk software • Impromat copy centre • Old e-learning services • Services on faculties SDI 2007, ZČU v Plzni

17. Known problems • Changing passwords (only through UIS) • Two profiles (Linux, Windows) • Absence of SAP connector • Not all things are online (e.g. e-mail groups, destroying of accounts…) • No implementation of single sign on • Less security due to only one account credentials SDI 2007, ZČU v Plzni

18. Results • One login, one password, one account system, no account administrator • Only 2 central administrator on university • Very popular for basic user • Very popular for technology owners • Many statistics information • Only start point on long journey for mobile work at university SDI 2007, ZČU v Plzni

19. Other results • Implemented also for our customers: • Slovak Technical University (26 000 users) • Technical University in Zvolen (6 000 users) • Škoda Auto University (1 000 users, in progress) • Current situation: • changed to central information systém • activated primary LDAP generation • first replicas installed • some services connected SDI 2007, ZČU v Plzni

20. Future ideas • Single sign on • Mobile profile through VPN • Adding printing profiles to LDAP • User friendliness interface for administrators • Using of virtual desktop infrastructure • Using of some other identity tokens (cards, USB flash drives, tokens) • Building PKI over this solution SDI 2007, ZČU v Plzni

21. Thank for your attention.Any questions? SDI 2007, ZČU v Plzni