Why are we doing this?


Problem Statement:

UNC needs an extensible provisioning engine that can be used for an array of resource targets. We also need to provision G Suite and Google Cloud Platform (GCP) for campus groups.

Impact Statement:

For the Identity Team, faster easier integration of new provisioning resource targets. For campus affiliates, automated access to provisioned resources without manual requests and approval delays.

How do we judge success? Success metrics

  • A production instance of the provisioning engine, managed by the identity management group, and running in our standard operations matrix for enterprise applications.
  • Publishing of groups in our production G Suite tenant based on authorized groups in Grouper, and via the new provisioning engine.
  • Association of GCP permissions with the G Suite groups above.
  • Gain understanding of COmanage capabilities and overlap with other Trusted Access Platform components.
  • Recommendation document for the CIO on the use of COmanage for some of our guest management and invitation flows.
What are possible solutions?We will be  implementing midPoint as a provisioning engine during this project as it has wide adoption in the Collaboration Success Program (CSP) cohort, and is easily extensible via open source connectors. Support for midPoint is available from CSP SMEs, the vendor, consulting agencies, and peers.
High-level timeline

Proj Plan / Roadmap: November 30th 2019

Internal Communications Plan: January 15th 2020

Sandbox: December 15th 2019

MVP: March 15 2020

Issues trackingJIRA

Stakeholder Impact

Who is the customer and how does this help them?

The IdM team will gain an extensible provisioning system that can be expanded to additional resources and projects, benefiting their future capabilities and thus those of the CISO. The cloud infrastructure team will gain a capability to build users and groups in G Suite and GCP for future expansion of those offerings. 

Evaluating different approaches to modernizing guest management is of current interest to the IdM team. COmanage is a possible approach that aligns with Incommon partner institutions.

Why will the customer want this?Customers have repeatedly sought a solution to centralized provisioning and deprovisioning, that they can use to add and remove local accounts.  This would be the start of a service that could be expanded to many other groups around campus to solve these issues.
Scale and scopeThe provisioning capability will be limited to central IT evaluation and use during the CSP phase of the project. The scale is expected to be limited to central IT and users and groups closely engaged with central IT.