Executive Summary

<Jessica to write after meeting>UNC Chapel Hill had a very targeted goal of expanding provisioning on their campus and a plan to use midPoint to do it. One member of their team had significant experience with the structure and politics of the university as well as experience working within the InCommon community, so the team was able to scope their project to a reasonably small set of additional functionality. As a large research university with a hospital, their main challenges were around ensuring they understood and met the security requirements as well as collaborating effectively with other teams on campus. The team was able to meet their goals for the project and are running midPoint in production.

Solution Summary

Track: Lifecycle Lifecycle Management

Trusted Access Platform Components:  MidPointmidPoint, COmanage

Project Team:  Ethan Kromhout , Jan Tax, Shumin Li, Chad Redman, Celeste CopelandCommunity Collaborators: Paul Caskey, Keith Hazelton(UNC Chapel Hill), Jan Tax  (UNC Chapel Hill), Shumin Li  (UNC Chapel Hill), Chad Redman  (UNC Chapel Hill), Celeste Copeland  (UNC Chapel Hill), Paul Caskey (Internet2), Keith Hazelton (Internet2), enhanced access to Evolveum was critical

The Environment: large Large R1 university , with a large health sciences program and hospital, therefore the security posture tends to be robust , and there are some requirements for security environment environment that other schools might not need to deal with

Benefits to Organization: 

• The IdM team will gain an extensible provisioning system that can be expanded to additional resources and projects, benefiting their future capabilities and thus those of the CISO. The cloud infrastructure team will gain a capability to build users and groups in G Suite and GCP for future expansion of those offerings. 
• Evaluating different approaches to modernizing guest management is of current interest to the IdM team. COmanage is a possible approach that aligns with Incommon partner institutions.
• Customers have repeatedly sought a solution to centralized provisioning and deprovisioning, that they can use to add and remove local accounts.  This would be the start of a service that could be expanded to many other groups around campus to solve these issues.

The Project

Problem Statement:

UNC needs an extensible provisioning engine that can be used for an array of resource targets. We also need to provision G Suite and Google Cloud Platform (GCP) for campus groups.

Impact Statement:

For the Identity Team, faster and easier integration of new provisioning resource targets. For campus affiliates, automated access to provisioned resources without manual requests and approval delays.

Scale and Scope:

...

The provisioning capability will be limited to central IT evaluation and use during the CSP phase of the project. The scale is expected to be limited to central IT and users and groups closely engaged with central IT.

The Solution

We will be  implementing midPoint as a provisioning engine during this project as it has wide adoption in the Collaboration Success Program (CSP) cohort, and is easily extensible via open source connectors. Support for midPoint is available from CSP SMEs, the vendor, consulting agencies, and peers.

The Result

Initial Plan:

...

Project Plan / Roadmap: November 30th 2019

Internal Communications Plan: January 15th 2020

Sandbox: December 15th 2019

MVP: March 15 2020

Actual Implementation:

The project went reasonably well, because the project plan and roadmap was successful reasonable, but the structured communication plan didn't existsandbox happen. Completion of the sandbox environment was two weeks late on getting built due to delays in support from other internal groups, but it was up by 2020.

One delay was that we needed to learn what all was needed for security assessment, . It was expected that it would be a lot and take a while,, but took even longer than expected.

Conclusions &

...

Lessons Learned

Original Success Metrics:

• A production instance of the provisioning engine, managed by the identity management group, and running in our standard operations matrix for enterprise applications.
• Publishing of groups in our production G Suite tenant based on authorized groups in Grouper, and via the new provisioning engine.
• Association of GCP permissions with the G Suite groups above.
• Gain understanding of COmanage capabilities and overlap with other Trusted Access Platform components.
• Recommendation document for the CIO on the use of COmanage for some of our guest management and invitation flows.

Conclusions and Lessons Learned

We did pretty well on most of these the success metrics until the last one , didn't happen, big ones are donewhich didn’t happen. All of the big ones were met and we are running, everything in production.

The project required us to think a lot about internal collaborations, and we struggled with how to keep this a team effort within UNC, . It easy and counterproductive for people to work on their own, especially with the work from home with COVID that happened at the end. The team collaborative work sessions with goals on what to do went really well & were longer than expected, . On campus we had a large screen , with one person typing, and the team did collaborative troubleshooting, However, this didn't translate well to remote work, it is much easier to multi-task multitask on a Zoom call and lose focus than in a room with other people.

The scope of the project was about right, ; it didn't sound that ambitious, but local hurdles were expected, . It was the appropriate scope for 3-4 months , and important to size the project to the length of the CSP, be . Be gentle with yourself that because you won't get 100% of your time to devote to CSP,  and you won't get everything get what that you want donemay have felt a little short, you . You need to find a chunk of work to have something that feels like an accomplishment, but a small enough project to complete before you get pulled off to something else.

Ethan's 10 years of experience , at UNC for 10 years and were helpful since he already had an idea of the internal politics, and being a SME on other TAP components helped with scope and what we could get done in a reasonable amount of time.