IAM Modernization Updates

(July 2024 Updates)

Discovery Work

We are currently evaluating and implementing solutions to replace outdated or nonexistent technologies for our provisioning, registry, and entitlement management processes.

• Provisioning: Automating the process of creating, modifying, and deactivating user accounts and access rights.
• Registry: Maintaining a centralized and accurate record of all identities within the organization.
• Entitlement Management: Ensuring users have appropriate access to resources based on their roles and affiliations.

Grouper – implementation

This is an open-source solution built by and for higher education institutions. This tool allows us to pull data from many, disparate sources and create roles and groupings which we can assign access and privileges.

We are currently implementing Grouper into our production environment. This will serve as a central engine for providing access to services by creating groupings of individuals to provision discrete privileges.

COmanage

COmanage is another open-source solution built initially to manage federated research access (identities from many different institutions). It was many capabilities in terms of its ability to function as a registry. This would replace our existing Person Registry and potentially our provisioning engines – ATAMS and Populator.

We have been working on a proof-of-concept of COmanage this Spring and will be finishing that work mid-Summer. Some of the activities of the included creating plug-ins to provision to LDAP, Grouper, and Active Directory; consuming identity data from upstream systems SIS, HR, and FIS; creating and managing identity data; enrolling “guest” or sponsored affiliate accounts.

Cirrus

Cirrus Identity has a suite of products initially developed at Univ of California Berkeley. The solutions provide deal with making authentication a more seamless process for end-users: using external logins (Facebook, LinkedIn, Google) and providing a proxy for institutions who have multiple authentication services (CAS, Shibboleth, Entra, etc.).

One concept the IAM team is testing is the idea of identity management as the system of record of core identity data. Typically, all identities originate from either HR, FIS, or SIS. However, a person’s identity-data – first name, last name, preferred names, email – are not HR or SIS-specific; they’re related to the person not the persona. We are looking at ways for IAM to be the central storage of core identity data that is then decorated with HR-related or SIS-related information (manager, title, school, program).

We are looking to use Cirrus’ external login capabilities for people to create an initial identity record with the identity registry. Think job applicants or student applicants. If the person is hired or admitted, the identity data would be augmented with the appropriate data from HR, SIS, etc.

midPoint

midPoint is a commercial product offered for free to higher education. Unicon offers a hosted version of the product. midPoint serves as a registry and provisioning engine.

We have signed the agreements for midPoint and are looking to start a POC later this summer.

Sailpoint

SailPoint is leading identity governance platform that helps organizations manage user access to systems and data, ensuring compliance and security through automated identity lifecycle management and access controls. It provides features like access certification, policy enforcement, and role management to streamline and secure identity governance processes.

We have engaged in numerous conversations and demos with SailPoint, culminating in a facilitator-led exploration of their offering, during which we examined use cases and scenarios that we provided

Architectural Work

In addition to the pilots and proofs-of-concept, the team has engaged in multiple architectural discussions to design a future state for authentication, provisioning and entitlement management. Key recommendations from those sessions included:

• Divesting certain services from LDAP (eList, Directory).
• Migrating our existing LDAP to new, supported infrastructure.
• Utilizing a central provisioning engine instead of daisy-chaining provisioning activities.
• Exploring the use of Microsoft CAS hubs to streamline federated authentication management.
• Considering identity as a system of record rather than merely a consumer of identity data.
• Conducting a thorough assessment of entitlement management opportunities from all areas of the university.