kuali identity management: introduction and implementation options
DESCRIPTION
Jasig - Spring 2010 Wednesday, March 10, 2010 8:30 am. Kuali Identity Management: Introduction and Implementation Options. Kuali Identity Management: Introduction and Implementation Options. Eric Westfall Indiana University [email protected] Dan Seibert - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/1.jpg)
Kuali Identity Management:Introduction and Implementation
Options
Jasig - Spring 2010Wednesday, March 10, 20108:30 am
![Page 2: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/2.jpg)
2
Kuali Identity Management:Introduction and Implementation Options
Eric Westfall
Indiana University
Dan Seibert
University of California, San Diego
![Page 3: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/3.jpg)
KIM Introduction
Implementing Kuali Identity Management at your Institution
![Page 4: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/4.jpg)
4
What is KIM?
• A module of Kuali Rice• Common Interface and Service Layer• Integrated Reference Implementation• Set of User Interfaces• KIM is not just “Identity Management”,
it’s also “Access Management”
![Page 5: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/5.jpg)
5
What KIM is Not
• A Full-Fledged Identity Management System• Provisioning• Hooks to update other systems• Duplication Management
• An Identity Aggregator• An Authentication Implementation
![Page 6: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/6.jpg)
Why Did We Create KIM?
![Page 7: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/7.jpg)
7
Motivations
• Expansion of Kuali• Common Identity Management API• Consistent Authorization Implementation
![Page 8: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/8.jpg)
8
What we did not want
KFS KC
KS
IDM IDM
IDM
![Page 9: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/9.jpg)
9
What we did want
KFS KC
KS
KIM
![Page 10: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/10.jpg)
10
Design Considerations
• Existence of Other IdM Solutions• Legacy/Existing Implementations• Replaceable Services• Separation of Concerns• Service Bus• Maintenance GUIs
![Page 11: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/11.jpg)
KIM Terminology
![Page 12: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/12.jpg)
12
KIM Terminology
• Namespace• Entity• Principal
• Principal ID• Principal Name
• Person• Entity Type
![Page 13: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/13.jpg)
13
KIM Terminology
• Group• Role
• Qualifier
• Permission / Permission Template• Responsibility / Responsibility Template
![Page 14: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/14.jpg)
KIM Services
![Page 15: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/15.jpg)
15
Components
• Service Interface API• Reference Implementation• Functional Maintenance User Interfaces
![Page 16: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/16.jpg)
16
KIM Core Services
• Identity Service• Group Service• Role Service• Permission Service• Responsibility Service• “Authentication” Service
![Page 17: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/17.jpg)
17
Other KIM Services
• Identity Management Service• Role Management Service• Person Service• Identity Archive Service• “Update” Services
![Page 18: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/18.jpg)
18
KIM Service Architecture
![Page 19: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/19.jpg)
19
Remember…
• The primary goal of KIM was to build a service-oriented abstraction layer for Identity and Access Management
• Integration with other IDM services was acknowledged, expected, and designed for!
![Page 20: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/20.jpg)
20
KIM Integration
Rice Databas
e
Identity Service
Responsibility Service
Permission Service
Group Service
Role Service
KIM Service Layer
Reference Implementations
OpenRegistry?
![Page 21: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/21.jpg)
Integrating KIM with other IdM products
Implementing Kuali Identity Management at your Institution
![Page 22: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/22.jpg)
22
KIM Integration
Integration with various Identity Management Systems
![Page 23: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/23.jpg)
23
with
• CAS – Authentication system for Single Sign On (SSO)
• Two ways to integrate:1. CAS Server2. Rice Client Application
• Integration with Rice Client application will be the most likely integration scenario
![Page 24: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/24.jpg)
24
CAS – Server Integration
• Implement a custom CAS AuthenticationHandler which interfaces with the KIM services or database
• Kuali already provides such an implementation in it’s Subversion repository
• kuali-cas project
![Page 25: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/25.jpg)
25
CAS – Rice Client Integration
• Integrate the CAS client with:1. Kuali Rice Standalone Server2. A Kuali Rice client application
• KIM provides an “AuthenticationService” which is used to inform the Rice framework about the authenticated principal
• Default implementation simply reads REMOTE_USER• Sufficient for CAS integration
![Page 26: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/26.jpg)
26
CAS – Setup
• Simply configure the standard CAS servlet filters in your web.xml as you would normally• AuthenticationFilter• Cas20ProxyReceivingTicketValidationFilter• HttpServletRequestWrapperFilter
• The usernames entered into the CAS login must match the principal names in your KIM implementation
![Page 27: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/27.jpg)
27
with
• Microsoft Active Directory provides “LDAP-like” directory services among other network services
• We will concentrate on groups defined in ADS and how they can be integrated with the KIM GroupService
• This particular usage has been implemented at Indiana University
![Page 28: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/28.jpg)
28
ADS – KIM Group Requirements
• Should be able to use ADS groups in addition to the out-of-the-box KIM group store
• Groups must have a unique ID• Groups are also uniquely identified by a
combination of Namespace and Name• Group membership can be nested
![Page 29: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/29.jpg)
29
ADS Group Integration – Implementation
• ADS groups are assigned a namespace of “ADS” which allows the GroupService to determine how to load the Group
• ADS groups have an ID assigned to them consisting of “ADS” and the group name• i.e. ADS:MyAdsGroupName
![Page 30: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/30.jpg)
30
ADS Group Integration – GroupService
• Override the GroupService so that it loads groups from both ADS (via LDAP) and the KIM database• IF - id starts with “ADS” or namespace equals “ADS”, query ADS• ELSE - delegate to reference implementation
• Various operations need to be customized including operations to load GroupInfo objects as well as checking Group membership
• Also customize the Group Lookup screen so that it can search for Groups in ADS
![Page 31: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/31.jpg)
31
Integrating KIM with LDAP
• LDAP Integration Efforts• University of Arizona• San Joaquin Delta College• UC Davis
• Using CAS to connect to LDAP
![Page 32: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/32.jpg)
32
KIM with LDAP (UofA example)
• Identity information is available in UA’s Enterprise Directory Service (EDS)
• Uses Spring LDAP as an adapter layer between Spring and LDAP datasource
• Uses KIM ParameterService to map between KIM and LDAP attributes
• Implement / Override KIM IdentityService• In order to use the KIM GUI’s properly, the
UIDocumentService is also overridden
![Page 33: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/33.jpg)
33
KIM with LDAP (UofA example)
• Setup Spring LDAP module• <bean id=”contextSource” …• <bean id=”authenticationSource” …• <bean id=”springSecurityAuthenticationSource ” …• <bean id=”ldapTemplate ” …
![Page 34: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/34.jpg)
34
KIM with LDAP (UofA example)
• Rice ParameterService maps EDS attributes to KIM KIM Class Attribute Name EDS Attribute Name
KimPrincipalInfo principalId uaid
KimPrincipalInfo entityId uaid
KimPrincipalInfo principalName uid
KimEntityNameInfo lastName sn
KimEntityNameInfo firstName givenName
KimEntityEmployementInformationInfo employeeId employeeId
KimEntityEmployementInformationInfo email employeeEmail
…
![Page 35: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/35.jpg)
35
KIM with LDAP (UofA example)
The Spring LDAP integration and Kuali Rice ParameterService are injected into the EdsPrincipalDaoImpl instance.
<bean id=”edsPrincipalDao”
class=”edu.arizona.kim.dataaccess.impl.EdsPrincipalDaoImpl”>
<property name=”ldapTemplate” ref=”ldapTemplate ” />
<property name=”parameterService” ref=”parameterService”/>
<property name=”kimConstants” ref=”azKimConstants ” />
</bean>
The EdsPrincipalDaoImpl is an implementation of PrincipalDao whichconnects to EDS and maps the principal and entity information into KIMdomain objects.
![Page 36: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/36.jpg)
36
KIM with LDAP (UofA example)
Implement and Override KIM Services• kimIdentityService
• getPrincipal()• getPrincipalByPrincipalName()• lookupEntities()• GetEntityDefaultInfo()• …
• UiDocumentService• loadEntityToPersonDoc()• saveEntityPerson()
![Page 37: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/37.jpg)
37
with
• Intra-campus Web SSO• Federated Access to a Rice application• KIM as an Identity Provider (IdP)• Using Shibboleth Attributes for KIM
authorization
![Page 38: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/38.jpg)
38
with Federated Authentication
Shibboleth Login Process
![Page 39: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/39.jpg)
39
with Federated Authentication
Protecting a Rice application as a Service Provider (SP)• A web server and openssl must be available first• Add Shibboleth filters to the web server.• Metadata defines the attributes to be passed
between the Identity Provider and Service Provider.• Override KIM Authentication Service
![Page 40: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/40.jpg)
40
with Federated Authentication
Metadata Example:<AttributeRule
Name=“urn:mace:dir:attribute-def:eduPersonPrincipalName”
Header=“REMOTE_USER”
Alias=“eppn”>
<AnySite>
<AnyValue/>
</AnySite>
</AttributeRule>
![Page 41: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/41.jpg)
41
with
KIM as an Identity Provider• Prerequisites: SSL certificate, source of SAML Metadata• Install Shibboleth IdP• Load SAML Metadata• Configure KIM as the User Authentication Mechanism• Implement kimAuthenticationService to authenticate the user
and provide the appropriate attributes.
![Page 42: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/42.jpg)
42
with Authorization Attributes
Using Shibboleth Attributes for KIM Authorization
• Entity Attributes• Group• Roles• Permissions / Responsibilities
![Page 43: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/43.jpg)
43
with
KIM / Grouper Collaboration
![Page 44: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/44.jpg)
44
with
Adapter OverviewCustom Implementation of KIM Services using Grouper Client API• GroupService• GroupUpdateService• IdentityService
![Page 45: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/45.jpg)
45
with
Installation• grouperClient.jar• grouperKimConnector.jar• grouper.client.properties• Override kimGroupService and
kimIdentityService
![Page 46: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/46.jpg)
46
with
How to override a KIM service<beans xmlns=http://www.springframework.org/schema/beans
…
<bean id="kimGroupService" class="edu.internet2.middleware.grouperKimConnector.group.GrouperKimGroupServiceImpl"/>
</beans>
![Page 47: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/47.jpg)
47
with
• Recall…• Earlier we stated that KIM is NOT an identity aggregator• Well, Microsoft Identity Lifecycle Manager (ILM) is!
• Current branding of this tool is Forefront Identity Manager
• Indiana University has used this tool as part of our Kuali Identity Management implementation
• Essentially synchronizes identities from multiple sources into our KIM database
![Page 48: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/48.jpg)
48
Microsoft Identity Lifecycle Management
![Page 49: Kuali Identity Management: Introduction and Implementation Options](https://reader035.vdocuments.us/reader035/viewer/2022070405/56813e77550346895da8978c/html5/thumbnails/49.jpg)