Survey Strategy and Goals
The intent of this survey is to collect information from a variety of institutions within higher education about their current strategies for dealing with test accounts/identities, and what gap(s) they see between the tools they currently have at their disposal and what would meet their needs. Our aim is to then share the results of the survey and perhaps spark some discussion about various testing strategies.
Please contribute!
Below are the beginnings of the survey, containing questions that have been thought of by members of the MACE-Dir Working Group. If you have any comments, suggestions, corrections, additional questions, etc. that you feel are appropriate, please feel free to edit this document directly. We only ask that you comment on any changes you make so that we can keep track of the rationale for changes as they are made.
Survey Draft
1. Please briefly describe your identity management environment - directories, authentication system, authorization system, number of entries, person registry, etc.
2. Do you have a separate test environment?
2a. What types of identities do you maintain in the test environment - for example - trouble shooting ids, testing ids, training ids? Please describe.
2b. How are these identities provisioned and deprovisioned in the test environment?
2c. Are all developers on campus allowed to use the test environment or just the central IT department developers?
2d. Is the test environment a copy of production or does it have randomly generated entries? Please describe further.
2e. What doesn't work about your current test environment?
3. What types of identities do you maintain in the production environment - for example - trouble shooting ids, testing ids, training ids? Please describe.
4. Do you allow production accounts or identities to be taken over to assist in trouble-shooting?
5. Do you have a separate identity management system for developers to use when developing applications? (As opposed to when the application moves into the test stage.)
6. What practices are followed for protecting sensitive information in non-production directories or registries?
7. Any other comments/ideas?