TIER ROADMAP UPDATE WORKING TOGETHER TO DEVELOP THE PATH

Transcription

1 TIER ROADMAP UPDATE WORKING TOGETHER TO DEVELOP THE PATH Ann West (Internet2) Steve Zoppi (Internet2) James Jokl (University of Virginia) Warren Curry (University of Florida)

2 Topics for Today TIER Overview TIER Development Update Focus on Packaging API and Registry Components TIER Mid-Program Survey Closing Comments 25 April 2017

3 What is TIER all about? Sustain components that we've developed together. Fill the gaps by providing a set of integrated components that addresses IAM as a whole. Address community requirements across the components. Developing, maintaining community and corporate partnerships

4

5 COmanage Grouper Shibboleth Grouper

6 Trust and Identity / TIER Development Update GLOBAL SUMMIT / APRIL 25TH 2017

7 TIER Development Update Component Packaging API and Data Structures Extensibility Security 25 April

8 TIER Development Update Component Packaging Not Beta just Not Rigorously Tested Shift of Community Bias (Docker and/or VM) Instrumentation of Beacon 25 April

9 TIER Development Update API and Data Structures APIs Entity Registry MidPoint Versus COmanage Registry 25 April

10 TIER Development Update Extensibility CAR [Consent Services] (NSTIC, Duke, Internet2) Packaged as an optional component Demonstrates Community Contribution 25 April

11 TIER Development Update Security Leveraging the community Skills and Resources Expensive and Skilled Resources Required 25 April

12 TIER Component Packaging for Ease of Installation and Operation JAMES JOKL

13 TIER Packaging Mission Make TIER products Simple to deploy Easy to operate Easy to maintain Deliver solution TIER staff will support implementation and longterm maintenance of packaged components Goals Identify and work with common subcomponents Solve current issues Example: Shibboleth ease of use with InCommon Simplify, streamline Administrative tools, scripts, GUIs, Out-of-the-box configuration Be prepared for the future [ 13 ]

14 Packaging Process: Two Parallel Work Streams Discover enhancement opportunities Survey to identify Pain points and needs Computing environment: current & future Results ~80 questions Responses from ~60 institutions Analyze and build technical solutions Preconfigure / enhancement of existing installers Virtual machines Containers [ 14 ]

15 TIER Packaging Highlighted Survey Results Packaging Preferences [ 15 ]

16 TIER Packaging Highlighted Survey Results Campus use of Docker containers [ 16 ]

17 Packaging Goals for Current TIER Release Complete packaging build automation process Packaged containers match current component versions Transition build process to TIER staff Enhance component setup automation Add packaging instrumentation [ 17 ]

18 Packaging Instrumentation Goals Track TIER adoption Help us follow trends Data Collected Component Version IP address JSON Beacon You can opt-out [ 18 ]

19 Future Pipeline: Shibboleth Configuration Initial Configuration CANARIE installer Operational Configuration Manage most day-to-day configuration via a GUI Entity attribute based configuration Code will become part of Shibboleth 3.4 Configuration distribution [ 19 ]

20 Future Packaging Pipeline TIER Docker VM container configuration options Internal configuration Mounted configuration TIER Stand-alone Docker containers Other Virtual Machine environments Transition documentation [ 20 ]

21 Current Release: Packaging Status Release components are ready for Testing Production use Documentation and Download D You can help by testing and deploying [ 21 ]

22 TIER Packaging Highlighted Survey Results Shibboleth Configuration [ 22 ]

23 Packaging Summary A lot has been accomplished Dedicated set of volunteers Excellent work by TIER staff and commercial partner Weekly calls If you have interest in this space, please join us Timing and needs are hard to predict from simple survey results Timing for native Docker support Virtual machine environments targeted at non- Docker campuses Deployment / integration documentation Testing and deployment Remains difficult to find the number of testers / deployers that we need [ 23 ]

24 TIER Registry, Data Structures and Connective APIs WARREN CURRY WITH AN ASSIST FROM KEITH HAZELTON IN ABSENTIA

25 The TIER Registry and the TIER Data Structures and APIs Working Groups are working hard and attempting to prepare for a transformative future in IAM Edison s electric light did not come about from the continuous improvement of the candle -Oren Harari If I had asked people what they wanted, they d have told me a faster horse! -Henry Ford [ 25 ]

26 TIER Architecture [ 26 ]

27 The Business View [ 27 ]

28 Identity Repository Person Repository Data Classes to compose a USER Entity Registry - person and non-person objects that require access management functionality and interface to that functionality. As it turns out a certain very few attributes are minimally needed. Entity Groups and Privileges Grouper Implementation Guide defining groups of securable entities from the systems of record Basis Groups, transformational abstractions into Reference Group forms then relating these to form Application related permission ODS, master data, person hub - a unified person or entity data concept an institution elects to manage independent of IAM. Workgroup thinking evolved to a THIN REGISTRY [ 28 ]

29 Identity Repository Client (Thing that calls an API Service) Client registration Client permission to use API Client has unique identifier Client authenticates Client authorizations Client to Service relationship Use case client w/o person. Use Client Registry Use Groups [ 29 ]

30 The Foundations of TIER Infrastructure RESTful APIs are the primary interfaces between TIER IAM Components and between TIER Components and External Systems Messaging may be used as a valid alternative to restful API. TIER-defined Resources are shared and manipulated by either of these approaches. The API/Messaging first approach is a key element supporting campus autonomy If you want to keep your identity registry, just expose its functionality as implementations of TIER APIs, it will then plug and play with other TIER components Supports selective adoption of TIER components and hybrid infrastructure models [ 30 ]

31 Grouper Deployment Guide What if instead of every institution having its own special sauce there was broad agreement on access management strategies, vocabulary, and assumed capabilities? What if, we could drive federation deeper into institutional identity and access management (IAM) practices and more easily enable highvalue collaboration Why - The goal of this document is to help you come up to speed on Grouper concepts, how they relate to identity and access management, and how they can be deployed to implement effective access control in a wide variety of situations. Who - This guide is targeted at both technical staff and managers responsible for identity and access management who are seeking detailed deployment and operational information on a TIER compatible Grouper deployment. Standard TIER Group Structure etc: Grouper configuration, administrative access control groups, loader jobs basis: groups used exclusively by the IAM team to build reference groups ref: reference groups institutional meaningful cohorts truth with natural language bundle: sets of reference groups used in policy for many services app: enterprise applications access control policy specific policy for a service org: delegated authority, ad-hoc groups, org owned apps or reference groups test: test folder for system verification [ 31 ]

32 TIER Provisioning and Deprovisioning An Example Authorization Flow reflects the TIER Grouper Structures The workgroup provisioning demo at the booth leverages components together employing TIER concepts! Data Repository Grouper in TIER standard Shibboleth Authentication and Auth Based on a provisioned LDAP Provisioning to: A web app Canvas LMS Evolve this demo to a more widely available resource demo workbench. [ 32 ]

33 Closing Comments

34 In Particular, Thanks to... Arizona State University * Boston University * Carnegie Mellon University * Case Western Reserve University * Duke University * Harvard University * Indiana University * Lafayette College * Louisiana State University * New York University * Northwestern University * The Ohio State University * Old Dominion University * Oregon State University * Purdue University - Main Campus * Rice University * University of Arizona * University of California - Berkeley * University of California - Merced * University of Chicago * University of Florida * University of Hawaii - Manoa * University of Illinois - Urbana-Champaign * University of Maryland - Baltimore County * University of Maryland - College Park * University of Miami * University of Michigan - Ann Arbor * University of Missouri - Columbia * University of Nebraska - Lincoln * University of North Carolina - Chapel Hill * University of Notre Dame * University of Virginia * University of Wisconsin - Madison * Washington University - Saint Louis

35 Results: Software and Deliverables Component/ Service in Prod Prior to 2015 Today Deliverables/ Components Number of References Shibboleth InCommon Federation Grouper 9 21 COmanage 2 2 Packaging Questions 12 Registry Requests 16 API Work Very Promising 9 API Questions 2 Provisioning Requests 9 Sustaining Key Software is good 7

36 TIER Development Community Workshop use cases/ requirements Community Developed Specifications Process Open source Iterative dev, test, review Assumes collaboration & tight integration with campus teams Campus Functional Review &Testing Internet2 Automated Testing Internet2 Contracted Software Development

37 Putting it All Together TIER Program needs to look forward, but must fit into diverse environments today Desire for commercial grade services and documentation TIER progressing on stable integrated platform API and Registry Components to be delivered in fall Provide feedback to your colleagues on the working groups to speed the delivery of functionality

38 TIER Homework Achieving Tier Goals Requires the Community to Help Itself Operations Environment TIER Development Cycle Reviewing TIER and Providing Feedback Starting Discussions on Campus 38

39 Thank You! Warren Curry - whcurry@ufl.edu Jim Jokl jaj@virginia.edu Ann West awest@internet2.edu Steve Zoppi szoppi@internet2.edu 39