Middleware Deployment Issues Jack Suess CIO UMBC jack umbc

Middleware Deployment Issues Jack Suess, CIO, UMBC jack@umbc. edu http: //umbc. edu/~jack

UMBC Institutional Profile University of Maryland, Baltimore County. • Established 1966. Enrollment is 11, 200. • Carnegie designation of Research/Extensive • Centralized administration and IT services with strong faculty governance structure • Heavy IT emphasis, about 25% of students in IT related majors. • Locally developed SIS/HR system. Recently signed on to implement Peoplesoft. Using Directory Services for Application Information 2

What we will discuss • The business factors driving this initiative • How we got involved in developing directory services • The directory development team and process • Development and deployment of new applications using the directory service • Creation of a single sign on web authenticator • Integrating Web. CT and Blackboard course management tools • Questions Using Directory Services for Application Information 3

Business Factors Driving the Development of Directory Services Fall 1999. Finished with Y 2 K. • UMBC decided we would begin discussions to replace our SIS, HR and Finance systems. • UMBC started two online graduate programs and began planning for a third program. We needed to add more web -based self-service applications, especially account generation. • We had successfully deployed our web portal, my. UMBC and were thinking about how we may extend it to alumni, parents, and prospective students. • Fall 1999, saw Web. CT usage plateau, discussions with faculty pointed at need to make it “easier” to use course tools. Using Directory Services for Application Information 4

Directory Services@UMBC • Internally we had decided that the indecision over our SIS/HR plans made using those databases directly a mistake. We felt LDAPbased directory services offered us more flexibility and we didn’t have to worry about overload on transaction systems • Dec. 1999, UMBC applied and was selected to participate in the I 2 “middleware” initiative. • UMBC created a middleware team to plan directory development. • March 2000, purchased Innosoft directory server and began development Using Directory Services for Application Information 5

Directory Development Team and Process • As then Director of OIT, I was the project sponsor and evangelist for middleware • A technical lead was identified and the project team created. – Members represented all areas of IT – Need to educated team on directory services – Sharp differences on what directory platform to use – I 2 middleware group was helpful in framing issues for consideration • I worked with VP’s and Vice Provost’s to get support for project and access to data Using Directory Services for Application Information 6

Development and Deployment Phase 1 • Phase 1 – September 2000 • Decided to load all students in SIS who have applied UMBC to date, ~275000 • Decided early on that directory data would not be authoritative or updated directly by end-users. Updates to SIS/HR done through my. UMBC and propogated back to directory through database change logs • Where duplicate data exists in HR/SIS we used most recent entry as “current” • Identified need for a common web-based authentication system, we created a service we call webauth. Using Directory Services for Application Information 7

Development of Webauth • Modeled after Kerberos, cookies function as tickets and web services use redirects to get service tickets. Here is how it works. – Client authenticates to webauth and gets a ticketgranting cookie (TGC), applications use this to get service cookies for applications. – Applications connect to service, if they don’t have a TGC the service redirects them to the webauth server with an encoded redirect that can get them “back” to the service after getting a service ticket – Created apache module to replace basic auth service – Created Java and Perl interfaces – Available upon request but consider I 2 shibboleth Using Directory Services for Application Information 8

• UMBC Directory Applications • Brought up directory-enabled account generation and management system • Web-based, allows delegation of control over different functions to groups/people based on roles and needs. Helpdesk can now reset passwords and quotas. • Self-service, students can now select username and password without coming onto campus • Supports user email redirection and lookup • Integrated. Blackboard and Web. CT to use our username/password and autoenroll Using Directory Services for Application Information 9

Blackboard Integration • Great product but…. . • July 2000, UMBC purchased a level 3 contract from Blackboard. Paid them to read our webauth cookie and retrieve authenticated username. UMBC wrote Java classes for them to call. Brought this up January 2001. – Extract users twice a day from directory and batch load into Blackboard. For fall 2001 we will automatically enroll students into their course – Had problems authenticating students coming in through some ISP’s. Tracked this to the way ISP’s play tricks with caching servers, we had to revamp java classes. – Had to figure out how to provide “guest” access. Using Directory Services for Application Information 10

Iplanet to AD Integration • Summer 2001 began work on linking i. Planet directory to Microsoft AD • Provide login access to labs running Windows 2000 • Reverse engineered Microsoft AD account entries to get this to work • Windows 2000 fully deployed in all labs January 2002 Using Directory Services for Application Information 11

Blackboard Phase 2 Fall 2002 • Developed group containers for people that track course enrollments • For fall 2002 we will have students autoregistered into their blackboard courses by connecting BB to LDAP for updating course enrollments • We use course containers for other services like limiting lab access to students in particular classes Using Directory Services for Application Information 12

Peoplesoft Plans • Bringing Finance 8. 4, HR 8, EPM 8. 3 in July 2003. SA development will then start with deployment done by 8/2005 • Recently begun testing of using LDAP for authentication and managing user profiles in 8. 4 with good results. Using Directory Services for Application Information 13

Results • The directory service has been our most reliable service, at least 99. 99% uptime. • These self-service applications have revamped the way we support users and the services we provide. • Automated Blackboard connections were well received by faculty. • Using a directory allowed us to utilize our institutional data in an academic context. The staff that did this would never be able to directly access and update our legacy SIS tables. Using Directory Services for Application Information 14

Leadership Style Using Directory Services for Application Information 15

Leadership Style: Role of CIO Developing an Enterprise Directory is akin to implementing an ERP project. The role of the CIO is similar: • Executive leadership • Developing campus support • Change management • Managing expectations Using Directory Services for Application Information 16

Leadership Style: Executive Leadership • Unlike ERP, a CIO can’t expect other executives to “sponsor” middleware. • A CIO must make the case, meaning justifying the ROI, of middleware • Identify the tangible benefits from middleware that matter to your campus • Make certain you treat this as a major project with a well-defined system development life cycle (SDLC) Using Directory Services for Application Information 17

Leadership Style: Developing Campus Support Laying the groundwork: • Meet privately with key leaders and explain middleware and discuss what it means to their unit. Include faculty leaders in this • Use the bully pulpit a CIO has to discuss the project with faculty, staff, and executives • Don’t forget to build consensus in your internal IT organization Using Directory Services for Application Information 18

Leadership Style: Change Management Like ERP, middleware cuts across divisions and requires broad support Create a sense of urgency to the project, why is it important? It isn’t possible to over-communicate Identify ways to involve stakeholders in the decision making process Make certain you develop some quick wins Using Directory Services for Application Information 19

Leadership Style: Managing Expectations and Budget Like ERP, middleware development is an ongoing process: • A well-written project plan with quick wins defined at appropriate intervals is key to managing expectations and budget • Life-cycle budgeting needs to be identified • Middleware’s benefit is often found in productivity gains or through self-service. Identify ways to measure this ahead of time. Using Directory Services for Application Information 20

Leadership Style: IT Architecture I feel IT Architecture needs to become a cornerstone of strategic planning Your architecture should provide a framework for evaluating scenarios and options Middleware is a one of the key pieces of a successful IT architecture plan Using Directory Services for Application Information 21

Leadership Style: Final Comments CIO’s are responsible for IT architecture, of which, middleware is a fundamental component. No one else will do this for you. Every campus has leaders that must be brought on board for major projects, seek them out. Make certain you develop formal plans, identify quick wins, and communicate the benefits. Using Directory Services for Application Information 22