Scope:
As the second half of the Project “BitKOO Strategic Alliance”, the identity management (IdM) solution, Keystone, is to be integrated with the ASU infrastructure. The vision for Keystone is to deliver the university’s IT services a means recognized by industry of enforcing appropriate identity, access, management and administration policy. As regards the University’s strategic objectives, IT is a key enabler. The IdM project will enable many of the strategic imperatives:
- Engaging in world-class research and securing future research funding will be strongly linked to our ability to participate in a federated model for collaborative research;
-
Improved accessibility to resources will improve the students’ learning experience at ASU;
-
Streamlined access to services not only within but also from outside ASU will enhance the sense of community, benefit community relations and contribute to making ASU an institution of choice for students and staff in an increasingly competitive higher education landscape;
-
Reducing costs of licensing and administration will contribute to the financial and sustainability agenda.
In addition, this IdM solution has the capability of being leveraged leveraged to manage more effectively access to other university services and facilities, eg library services, buildings while extending ASU ‘s ability to establish identity and access management processes across ASU and provide unified, consistent and standard business processes and technology to support an individual’s relationship with ASU.
The mechanisms that serve identity and access management of IT services can also be With IT infrastructure and business changes around the unified ASU now complete, the foundation is in place for the next step in identity management at ASU. With buyin from departments, colleges, and university associated institutions, the need for more streamlined processes and the support of strategic objectives the goal of a University wide, technologically advanced in the identity management will be realized.
Objectives:
The high level project objectives described below fall in the following main areas of focus:
- User/account provisioning and de-provisioning
- Full and granular access control over and above EDNA current capabilities.
-
Access control/management
- Wider application of Single Sign-On
- Password/authentication management
- Alignment with federated model as enabler for research collaboration.
Single Sign On POC:
A standard username and password credential set has been in use at ASU for a number of years in the form of ASURITE. UTO has gradually increased the range of services that use EDNA as the authentication mechanism for permitting a user access to a service or resource only. Where possible, and usually as part of the natural upgrade cycle, university applications have been migrated to the use of this same sign-on mechanism in place of local proprietary methods, each with their own maintenance overheads.
With the implementation of BitKOO, UTO can further the common sign-on scenario by creating mechanisms for credentials to be safely passed from one application to another resulting in students and faculty who access these services only needing to present their credentials once.
With extended Single Sign-On comes increased risk to data should the ‘master key’ be compromised. However, this project will allow for consideration of raising levels of assurance in applications that currently may not have strong authentication built in by strengthening the authentication mechanisms for Single Sign-on through the use of more than one factor of authentication. Hence, this project will also implement an appropriate strategy for password/authentication management in terms of type, format, refresh etc.
Currently, inconsistencies exist in user/account provisioning and de-provisioning. For instance, variable delays are experienced before a new staff member is provisioned with a ASURITE ID and access to basic networked services (eg email, My Documents, file shares, printing, internet). Also, much of this process is manually driven for staff through the use of forms and other mechanisms. There are also inconsistencies in the type of ASURITE ID’s provisioned. This project aims to streamline this process and introduce automation, ultimately being managed through a single self-service application for the majority of cases.
