IAMUCLA Overview The UCLA Enterprise Messaging User Group

IAMUCLA Overview @ The UCLA Enterprise Messaging User Group Meeting March 13, 2008

What is IAMUCLA? Identity & Access Management @ UCLA Who wants to access a resource? (Authentication) Does the person have permission? (Authorization)

Before IAMUCLA Class Web Sites Departmental Intranet Discussions URSA Service Requests Budgeting Research Proposal Tracking Applications kept separate user identity data User logs into each application separately using different logon IDs Permissions managed separately in individual applications … and others

Phase I: Identity and Authentication • Campus-wide Credential • UCLA Logon • Enterprise Directory • Consolidated Repository for Person Identity Data • Supports authentication and authorization decision • Web Single Sign-On • ISIS • Shibboleth – The future • Unified Directory Data • Official Email Address

IAMUCLA Architecture, Take One My. UCLA Travel Express Financial Web Reports RATS many other web apps URSA ISIS/Shibboleth: Web Single Sign-On User logs in using UCLA Logon ID ED supplies user identity data Enterprise Directory Permissions managed separately in individual applications

Credentialing Account creations are verified with ED identity Data; created accounts are written to ED in real time. Visitor also uses the same selfprovisioning tool to create a low level of assurance “guest” account visitors and affiliates logon. ucla. edu employee student ED receives initial identity data for UCLA members from the mainframe (near real time) Employee uses the self-provisioning tool to create logon ID once she becomes an employee Student is prompted to create UCLA Logon during SIR Enterprise Directory URSA UID, SIS, PPS

Over 200 Web Apps Use ISIS • • • • • • • • • URSA My. UCLA My. Housing RATS (Animal Protocols) Effort Reporting System OFSR Web Merits CBIG DAT Bruin. Card CCLE UCLA Jobs: People. Admin Counselor Desktop CLICC Laptop Checkout Construction Mgt Database Online TSR Gradebook Online Journal Entry Transfer of Funds ATS network account provisioning ASUCLA Computer Store Online My. Events My. FAO ISSR Data Archives Data Delivery CTS Directory Update System COMIT Duplicate W 2 -Forms Non-Payroll Expenditure Adjustment Post Audit Notification (PAN) Bruin. Post Emergency Email Notification System Bruin. Buy Web Reports Digital Library Programs • • • • • • • • • SEAS Online SEAS Email Forwarding Wireless Network Registry Equipment Management UCLA Student Calendar UCLA Grid Portal UCLA Library Catalog UCLA in LA UCLA Library Public Wiki OID TEC Transcript System UCLA Knowledge Base Express TFT Intranet Gradebook Data Warehouse Reporting (Cognos) QDB Support and Administration APO Dossier Action Tracking My. CLICC Laptop Checkouts CTS Personnel Action Request Vo. IP Self-Provisioning Administration Wireless Network Registry CTS Project. Trak Confluence JIRA My. DMA ESLPE • • • • • • • Music Library: Digital Audio Reserves • … and many more … Video. Furnace: @ Instructional Media Lab OPRS Psychology IT & Help. Desk Portals Registrar’s Office Service Request Student Records Web Registrar’s Office Transcript System UCLA Restricted Network Access Administration UCLA Res. Net DMCA Admin STC Software Download UCLA Sakai Social Sciences Class Scheduler PDP Portal Social Sciences Subversion Browser SSC Ticket System Student Legal Service Case Tracking Student Health Online Services Transportation Services Vo. IP Web. Dialer Course. Web@HSSEAS RNet Web Reports AIS Password Management Tools COR Faculty Grants Program Bruin Walkers Web. IRB Schoenberg Practice Room Reservation Now. Print – Web-based Printing On Demand ESCRO File. Share UCLA Student Calendar Life Sciences Dossier Web Site Undergraduate Scholarship Application Work-Study Job Bulletin for Employers Summer Financial Aid Portal

Phase II: Permission Management • Deploy enterprise-wide, 24 x 7 permissions management system • Provide cross-campus integration for all applications • Create custom delegation tools • Provide support for local integration

Enterprise Permission Management Benefits • Simplifies and standardizes • Roles can be consistently established and maintained across campus • Full auditability – who has access to what & when • Instantaneous ability to revoke or change at-risk access across campus • Streamlines the provisioning workflow • Permits more granular access & revocation • Reduces sharing of logons and passwords

IAMUCLA Architecture My. UCLA Financial Web Reports RATS many other web apps Travel Express URSA ISIS/Shibboleth: Web Single Sign-On User logs in using UCLA Logon ID ED delivers user identity, groups, and permissions data via Shibboleth manages permissions once Permission Management Tools Enterprise Directory and replicates the same permissions data to non-web systems

At a Threshold New applications are emerging with new and large communities of users • CCLE – Faculty & Students • DAT – Faculty & Staff • IWE – Students & Parents • GRID – Researchers at UCLA & other campuses • Clinical Research – Physicians & Students • Research collaboration – Faculty & Students at UCLA and other campuses A window of opportunity for a new way to handle permissions

Project Impacts Strategic • Underpins collaboration, group processes, interdisciplinary research and education, inter-industry and inter-institutional interactions • Opens but manages the extension of campus resources to important associate members of the university Compliance • Significantly improves ability to meet audit requirements • Better reporting on access to FERPA and SB 1386 protected data • Reduced risk of major security/access breach System Lifecycle Necessity • Critical mass of current projects represents opportunity to integrate now

Project Impacts Customer/User Impact • Affects all UCLA faculty, students, staff • Also affects parents, researchers and students at other campuses, etc. Workload Impact • Reduced staff time handling provisioning/de-provisioning tasks • Self-service delegation reduces access delays, improves user-experience • Central support reduces developer overhead in projects; Improves help desks' ability to solve a user problem on "first call“ Financial/Fiscal Impact • Not implementing now forces all applications to expend resources to invent their own permission management schemes separately. • Retrofit will be far more costly.

Questions?