Cloud Identity Management for

North Carolina Department of Public Instruction

Troy Moreland – Founder & CTO, Identity Automation

Samuel Carter - Systems Architect, Friday Institute

November 14, 2013

Who should attend this session?

• Anyone interested in Identity Management as a

Service

• Managers/Architects responsible for Identity

Management for their organization

• Software companies interested in taking their

products to the cloud with AWS

• Cool people!

Background

Who is Identity Automation?

• We are a software company specializing in

identity, data and access management

• We have commercial and public sector

customers but our specialty is education

• Our products manage over 3.6 million user

accounts across US and Canada

• The average customer size is 20k identities

Identity Automation Product Overview

• ARMS – Access Request Management System – Self-service and delegation tool

• DSS – Data Synchronization System – Identity, data and configuration management tool

• FIMS – Federated Identity Management System – SAML Identity Provider

• FMS – Folder Management System – Identity-driven storage management for Windows

Logical Solution Overview

Current Implementations

• Traditional Methodology – On-premises installation

– Turnkey services

– Multiple support options

• Customer Responsibilities – Provide hardware (physical or virtual)

– Hire/train staff

– Ongoing maintenance

Requirements

What is the NCEdCloud?

• NCEdCloud is the initiative responsible for

providing cloud based services to all school

districts (LEAs) and charter schools within the

state of North Carolina

• NCEdCloud IAM is the name for the Identity and

Access Management service provided by

Identity Automation

What were the goals of NCEdCloud IAM?

• Provide school district employees, students, parents and guests with a single login to all NCDPI sponsored systems as well as other cloud systems that are utilized by numerous districts (including charter schools)

• Provide self service capabilities to all end users and delegation capabilities to all district administrators

What does NCEdCloud IAM actually do?

• Using data from authoritative systems, it creates identities (accounts) for all users and keeps them up-to-date. Single identity supports multiple affiliations

• Synchronizes identities to target systems

• Provides Identity Provider (IdP) for SAML-based authentication and assertion

• Provides interface for self service and delegation of identities

• Provides real-time metrics regarding availability, performance and usage

How many users are we talking about?

• 250,000 Faculty/Staff

• 1,500,000 Students

• ~3,000,000 Guardians

• ? Guests

Planning for up to 10 million active users…

How type of systems are being integrated?

• Student Information Systems

• HRMS

• Cloud email

• Directory Services

• Content Services

• Library Management Systems

• Cloud Web Content Filter

• Cloud Support System

We are adding 10 new systems per year!

What were some of the other constraints?

• NCDPI didn’t want to host the solution

• NCDPI didn’t want to hire new employees

• NCDPI wanted to pay all-inclusive, annual subscription

• NCDPI required elastic architecture to meet growth

• NCDPI required highly available solution

• NCDPI required delegation for their Cloud Help Desk

Evaluation

What will we do for infrastructure?

• We already have the software we need but nowhere to run it.

• To buy, host and maintain the required hardware was estimated to cost us more than the full 3-year budget allotted for this service

• It was estimated to take us 10 – 12 months to complete install and configure an infrastructure to meet the needs of this service

• In the end, we are a software company, not a hardware company

Can we get assurance of data security?

• Personally Identifiable Information (PII) MUST be stored within the US – Certified by AWS

• Only US citizens may access data – Certified by AWS

• Infrastructure vendor must be SOC 2 “certified” – AWS maintains this plus many others (aws.amzon.com/compliance)

• In short, showing NCDPI we were working with AWS gave them the “warm fuzzy” required to move forward. We could have never done this on our own in time.

So why the AWS cloud specifically?

• Industry Leader – Gartner Group Magic Quadrant

https://aws.amazon.com/resources/analyst-reports/

• More Service Offerings – No other vendor compared with regards to the number of services

offered by AWS. This was compelling for what we need now and what we can do in the future

• Out-of-the-Box Integration – Our products speak the “web services” language. For AWS, web

services *is* the product, not something that gets added after the fact

Solution

What AWS services are utilized?

• Amazon Route 53

• Amazon VPC

• AWS IAM

• Amazon RDS

• Amazon SES

• Amazon SNS

• Amazon CloudWatch

• Amazon EC2 – Windows 2012

– Amazon Linux

• Elastic Load Balancing

• Amazon S3

• Amazon CloudFront

Typical End User Session

What is unique from AWS perspective?

• Auto-scaling via API

• Provisioning to IAM

What are future plans?

• Implement Chaos Monkey

• More automated monitoring – i.e., kill or restart

application when not responding

• Create AWS adapter for DSS

Results

Did AWS save us money?

• We didn’t hire anyone to specifically maintain infrastructure

• We didn’t acquire physical hosting space (minimum of three)

• We didn’t buy any hardware

• We didn’t implement new service with ISP

• We didn’t have to manage/coordinate the build-out of new facilities

Did AWS save us time?

• We estimate that the build-out would have taken us 10-12 months. Development environment was built in a day.

• Test environment took about 2 weeks to complete (due to learning by trial-and-error).

• Production environment was ready to go in 5 days!! – Utilizing three Availability Zones

– Multi-AZ Amazon RDS instance

– HA Windows (AD) instances

– HA elastic Amazon EC2 instances of our appliances (across all AZs)

– Four sets of Elastic Load Balancing instances (across all AZs)

Did AWS add any other value?

• Built-in compatibility with our products – We automate management of IAM users and groups

– We automate auto-scaling of our application instances based on custom triggers

– We pull information from AWS and place it into our reporting solution for centralized dashboards

• Enterprise Support – Enables us to meet the our SLA requirements with the State

– Constantly helping validate our infrastructure design

– Dedicated team has kept us from having to hire more staff

Demonstration

Please give us your feedback on this

presentation

As a thank you, we will select prize

winners daily for completed surveys!

SEC102