Princeton University The Cast Dan Oberst Director of

Princeton University The Cast Dan Oberst, Director of OIT Enterprise Services…………Big Hat: No Cattle Donna Tatro, Manager of Collaboration Services…………. Makes It Happen Bill Sproule, Lead Technical, Analyst, CSG………………Mr. PKI Lee Varian, OIT Systems Architect……Knows Where the Bodies are Buried Ted Bross, Manager, OIT Data Integration………………Digs up the Bodies Meghan Weeks, Library Systems Analyst ………. Unindicted Co-Conspirator CREN/Mellon PKI Meeting 12/01/2001

Identity, Authentication, Authorization l l Campus Community: anyone w/univ. relationship LDAP: Faculty, Staff, Students (subset of CC) ¡ l Separate databases: ¡ l NIS (deprecated), LDAP & Kerberos (direct & via PAM) NT 4/AD, People. Soft, Oracle Attributes: ¡ ¡ l Alumni (Advance & LDAP), Library (superset of LDAP) Authentication: ¡ l NIS and NT derive from LDAP netid field LDAP: Status (Fac/Staf/Stud/etc. ); OU (Dept), Home. Dept (Num. ) (Planned) Certs: DN (name & email) only Access Control: ¡ . Princeton. EDU domain, (library) Proxy, VPN, special ID/PW December 1, 2001 Princeton University CREN/Mellon PKI Workshop

Current applications linked into database/directory/repository: l Remote access ¡ l Email (inc. AUTH SMTP) ¡ l cached NIS crypt files Myriad local apps: ¡ l LDAP Library proxy, web apps ¡ l NT 4 AD/Kerberos V Directory self-service update ¡ l NIS Kerberos/LDAP via PAM NT file & print VPN ¡ l LDAP telnet/ftp/ssh ¡ l NIS e. g. time collection, Student Grades, resume tracking, etc. - LDAP NOT linked: Peoplesoft, Oracle, local Blackboard users December 1, 2001 Princeton University CREN/Mellon PKI Workshop

Planned initial uses for certificates? l JSTOR l Boise Cascade (web ordering) l Inter-office signatures/encryption l Web. ISO authentication l Administrative Application Single. Signon December 1, 2001 Princeton University CREN/Mellon PKI Workshop

Current state of PKI deployment? l Servers running in test deployment l Vendor: i. Planet CMS 4. 2 ¡ Registration Authority ¡ Certificate Authority ¡ Key Escrow Authority l Hardware: Sun Solaris l Considering “junk cert” Open. LDAP server ¡ Students/Mobile/Short-lived ¡ Anonymous December 1, 2001 Certs Princeton University CREN/Mellon PKI Workshop

Content providers l Broad range (Lexis/Nexus, Journals, Encyclopedias, etc. ) l Currently restricted to. Princeton. EDU ¡ or via web proxy or VPN or special ID l Difficulties ¡ E. g. December 1, 2001 using proxy and VPN: no VPN client, setup, line speed, etc. Princeton University CREN/Mellon PKI Workshop

Readiness to issue certificates to select group of 200 faculty/staff? l (Hardware) Systems are in place ¡ Legal framework (CPS, etc. ) nearly so l Need to identify candidate users l Biggest effort : setting up certs ¡ Works l best for laptop users Cert mobility problem l Support issues ¡ e. g. lost cert, forgotten PW, different computer, etc. December 1, 2001 Princeton University CREN/Mellon PKI Workshop