educause midwest regional march 24, 2003 copyright ann west 2003. this work is the intellectual...

EDUCAUSE Midwest Regional March 24, 2003

Copyright Ann West 2003. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Middleware: Addressing the Top IT Issues on Campus

Renee Woodten FrostInternet2 and University of Michigan

Midwest Regional EDUCAUSE March 26, 2003


Outline

• Set the context

• Define middleware

• Outline the Top 10 issues

• Discuss the relevancy of middleware

• Introduce NMI-EDIT

• Highlight available resources and educational opportunities


What is IT being asked to do?

• One stop for university services (portal) integrated with course management systems

• Email-for-life• Automatic creation and deletion of computer

accounts• Submit and/or update information online• Browser or desktop preferences follow you


More on the “to do” list

• Multi-campus scanning electron microscopes• Integrated voicemail, email, and faxmail for

Advancement staff• Secure PDA and wireless support• All-campus email announcements (spam)• Expensive library databases shared with other

schools in the system• …


What do all of these have in common?

• Are the people using these services who they claim to be?

• Are they a member of our campus community?

• Have they been given permission?

• Is their privacy being protected?


What is middleware?

• Suite of campus-wide security, access, and information services– Integrates data sources and manages

information about people and their contact locations

– Establishes electronic identity of users– Uses administrative data to assign affiliation

and gives permission to use services based on that role


Definitions: Identifiers

• Identifiers– your electronic names– Multiple names and corresponding information in multiple

places

– Single unique identifier for each authorized user

– Names and information in other systems can be cross-linked to it• Admin systems, library systems, building systems


Definitions: Authentication

• Authentication – links the physical you to an electronic identifier– Password authentication most common

– Security need should drive authentication method

– Distance learning and inter-campus applications


Definitions: Authorization

• Authorization services – allowing you to use services– Affiliated with the school (role)

– Permitted to use the services based on that role


Definitions: Enterprise Directory Services

• Enterprise Directory services - where your electronic identifiers are reconciled and basic characteristics are kept– Very quick lookup function

– Phone number, address, campus identifiers

– Machine address, voice mail box, email box location


What is Middleware?

• specialized networked services that are shared by applications and users

• a set of core software components that permit scaling of applications and networks

• tools that take complexity out of application integration• a second layer of the IT infrastructure, sitting above the

network • a land where technology meets policy• the intersection of what networks designers and

applications developers each do not want to do


Map of Middleware Land


Core Middleware

Middleware makes “transparent use” happen, providing consistency, security, privacy and capability

• Identity - unique markers of who you (person, machine, service, group) are

• Authentication - how you prove or establish that you are that identity

• Directories - where an identity’s basic characteristics are kept

• Authorization - what an identity is permitted to do• Public Key Infrastructure (PKI) - emerging tools for

security services


2002 EDUCAUSE Current Issues Survey

• Criteria– Important for strategic success– Potential significance in next year– Most time consuming for leaders– Most resource intensive

• 10 issues most significant


The Top Ten Issues

• Administrative Systems/ERP• IT Funding• Faculty Development, Support, and Training• IT Strategic Planning• Security Management• Online Student Services• Teaching and Learning Strategies• Distance Education• Maintaining Network Infrastructure• Emerging Network Technologies• (Portals)


Threads Woven Throughout

• Money and Time• Integration• Policy Enforcement• Enhanced Security• Ease of Use• Capability to Iterate and Deploy Faster• Privacy management


Money and Time

• Consolidated access management– Fewer staff for more applications

– Fewer information repositories to manage

– Fewer accounts to manage

– Automated creation and deletion of accounts


Integration

• Leverage existing infrastructures– Data

• Unique identifier is mapped to application-dependent identifiers

– Network• Integrated sign-on

– Services • Administrative and Course Management Systems


Policy Enforcement

• Access follows institutional policy and legal requirements– Business changes reflected in access

• Dismissed students/staff have access to all services and buildings immediately revoked


Enhanced Security

• Consolidation of Access – Status/role change alters service mix

– Use of same identifier enhances auditing

– Access to critical applications is concentrated

• More security minded


Ease of Use

• Directory-enabled applications– Reduce faculty need to update class rosters

• Consolidated authentication– Reduces the number of userids/passwords

• Move updating of information to ultimate data owner– Students update address information or

destination of their forwarded email


Capability to Iterate and Deploy Faster

• Use same authentication and identity infrastructure for new services

• Extend services to new groups by adding to the directory

• One group of staff responsible for implementing business rules


Privacy management

• Increasing need both to pass information about people for access and to protect privacy– Must have a central policy structure and

related technical infrastructure for privacy management

• Library applications where both authorized access and anonymity is critical


Next Steps

• Develop project plan

• Decide on unique namespace

• Review application and directory requirements

• Pick initial target applications

• Design and populate the directory with big picture in mind

• Deploy directory and enable applications


NMI-EDIT Consortium

• Funded by the NSF Middleware Initiative (NMI)

• Enterprise and Desktop Integration Technologies Consortium– Internet2 – primary on grant and research– EDUCAUSE – primary on outreach– Southeastern Universities Research Association (SURA) – primary on NMI Integration Testbed

• Higher-ed, government, corporate, research, and international participation


NMI-EDIT: Goals

• Much as at the network layer, create a ubiquitous common, persistent and robust core middleware infrastructure for the Research &Education community

• In support of inter-institutional and inter-realm collaborations, provide tools and services (e.g. registries, bridge PKI components, root directories) as required


NMI-EDIT: Core Middleware Scope

• Identity and Identifiers – namespaces, identifier crosswalks, real world levels of assurance

• Authentication – campus technologies and policies, inter-realm interoperability via PKI, Kerberos

• Directories – enterprise directory services architectures and tools, standard object classes, inter-realm and registry services

• Authorization – permissions and access controls, delegation, privacy management

• Integration Activities – common management tools, use of virtual, federated and hierarchical organizations


Enterprise MiddlewareEducational Opportunities

• Pre-conference Seminars and track sessions at EDUCAUSE Annual and Regional Meetings

• Campus Architectural Middleware Planning Workshops– CAMP, Boulder CO – June 4-6, 2003

• CIO and Technical staff• Best practices in middleware deployment• Check the www.nmi-edit.org site for announcement or past

conference proceedings

– Advanced CAMP, Boulder CO – July 9-11, 2003• Highly technical• Research topics


On-line Resources Available• Introductory Technical and Management Documents

– Sample Middleware Business Case and Writer’s Guide– Identifiers, Authentication, and Directories: Best Practices for

Higher Education– Identifier Mapping Templates and Campus Examples– And more….

• See Enterprise Directory Implementation Process Site coming in April on www.nmi-edit.org

• For more information, contact Ann West [email protected] or send mail to [email protected]


Questions?

Renee Woodten Frost

Internet2/University of [email protected]