Cloud ID Management of North Carolina Department of Public Instruction (SEC102) | AWS re:Invent 2013


Published on

(Presented by Identity Automation) Identity Automation has worked with the North Carolina Department of Public Instruction since April 2013 to provide a cloud-based identity management service for all employees, students, parents and guests of the State’s K12 organizations. In this session, Identity Automation will discuss how the service was used to synchronize identities with target systems, provide federation services as well as end-user self-service and to delegate administration functionality.

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Cloud ID Management of North Carolina Department of Public Instruction (SEC102) | AWS re:Invent 2013

  1. 1. Cloud Identity Management for North Carolina Department of Public Instruction Troy Moreland – Founder & CTO, Identity Automation Samuel Carter - Systems Architect, Friday Institute November 14, 2013
  2. 2. Who should attend this session? • Anyone interested in Identity Management as a Service • Managers/Architects responsible for Identity Management for their organization • Software companies interested in taking their products to the cloud with AWS • Cool people!
  3. 3. Background
  4. 4. Who is Identity Automation? • We are a software company specializing in identity, data and access management • We have commercial and public sector customers but our specialty is education • Our products manage over 3.6 million user accounts across US and Canada • The average customer size is 20k identities
  5. 5. Identity Automation Product Overview • ARMS – Access Request Management System – Self-service and delegation tool • DSS – Data Synchronization System – Identity, data and configuration management tool • FIMS – Federated Identity Management System – SAML Identity Provider • FMS – Folder Management System – Identity-driven storage management for Windows
  6. 6. Logical Solution Overview
  7. 7. Current Implementations • Traditional Methodology – On-premises installation – Turnkey services – Multiple support options • Customer Responsibilities – Provide hardware (physical or virtual) – Hire/train staff – Ongoing maintenance
  8. 8. Requirements
  9. 9. What is the NCEdCloud? • NCEdCloud is the initiative responsible for providing cloud based services to all school districts (LEAs) and charter schools within the state of North Carolina • NCEdCloud IAM is the name for the Identity and Access Management service provided by Identity Automation
  10. 10. What were the goals of NCEdCloud IAM? • Provide school district employees, students, parents and guests with a single login to all NCDPI sponsored systems as well as other cloud systems that are utilized by numerous districts (including charter schools) • Provide self service capabilities to all end users and delegation capabilities to all district administrators
  11. 11. What does NCEdCloud IAM actually do? • Using data from authoritative systems, it creates identities (accounts) for all users and keeps them up-todate. Single identity supports multiple affiliations • Synchronizes identities to target systems • Provides Identity Provider (IdP) for SAML-based authentication and assertion • Provides interface for self service and delegation of identities • Provides real-time metrics regarding availability, performance and usage
  12. 12. How many users are we talking about? • • • • 250,000 Faculty/Staff 1,500,000 Students ~3,000,000 Guardians ? Guests Planning for up to 10 million active users…
  13. 13. How type of systems are being integrated? • • • • • • • • Student Information Systems HRMS Cloud email Directory Services Content Services Library Management Systems Cloud Web Content Filter Cloud Support System We are adding 10 new systems per year!
  14. 14. What were some of the other constraints? • NCDPI didn’t want to host the solution • NCDPI didn’t want to hire new employees • NCDPI wanted to pay all-inclusive, annual subscription • NCDPI required elastic architecture to meet growth • NCDPI required highly available solution • NCDPI required delegation for their Cloud Help Desk
  15. 15. Evaluation
  16. 16. What will we do for infrastructure? • We already have the software we need but nowhere to run it. • To buy, host and maintain the required hardware was estimated to cost us more than the full 3-year budget allotted for this service • It was estimated to take us 10 – 12 months to complete install and configure an infrastructure to meet the needs of this service • In the end, we are a software company, not a hardware company
  17. 17. Can we get assurance of data security? • Personally Identifiable Information (PII) MUST be stored within the US – Certified by AWS • Only US citizens may access data – Certified by AWS • Infrastructure vendor must be SOC 2 “certified” – AWS maintains this plus many others ( • In short, showing NCDPI we were working with AWS gave them the “warm fuzzy” required to move forward. We could have never done this on our own in time.
  18. 18. So why the AWS cloud specifically? • Industry Leader – Gartner Group Magic Quadrant • More Service Offerings – No other vendor compared with regards to the number of services offered by AWS. This was compelling for what we need now and what we can do in the future • Out-of-the-Box Integration – Our products speak the “web services” language. For AWS, web services *is* the product, not something that gets added after the fact
  19. 19. Solution
  20. 20. What AWS services are utilized? • • • • • • • Amazon Route 53 Amazon VPC AWS IAM Amazon RDS Amazon SES Amazon SNS Amazon CloudWatch • Amazon EC2 – Windows 2012 – Amazon Linux • Elastic Load Balancing • Amazon S3 • Amazon CloudFront
  21. 21. Typical End User Session
  22. 22. What is unique from AWS perspective? • Auto-scaling via API • Provisioning to IAM
  23. 23. What are future plans? • Implement Chaos Monkey • More automated monitoring – i.e., kill or restart application when not responding • Create AWS adapter for DSS
  24. 24. Results
  25. 25. Did AWS save us money? • We didn’t hire anyone to specifically maintain infrastructure • We didn’t acquire physical hosting space (minimum of three) • We didn’t buy any hardware • We didn’t implement new service with ISP • We didn’t have to manage/coordinate the buildout of new facilities
  26. 26. Did AWS save us time? • We estimate that the build-out would have taken us 10-12 months. Development environment was built in a day. • Test environment took about 2 weeks to complete (due to learning by trial-and-error). • Production environment was ready to go in 5 days!! – – – – – Utilizing three Availability Zones Multi-AZ Amazon RDS instance HA Windows (AD) instances HA elastic Amazon EC2 instances of our appliances (across all AZs) Four sets of Elastic Load Balancing instances (across all AZs)
  27. 27. Did AWS add any other value? • Built-in compatibility with our products – We automate management of IAM users and groups – We automate auto-scaling of our application instances based on custom triggers – We pull information from AWS and place it into our reporting solution for centralized dashboards • Enterprise Support – Enables us to meet the our SLA requirements with the State – Constantly helping validate our infrastructure design – Dedicated team has kept us from having to hire more staff
  28. 28. Demonstration
  29. 29. Please give us your feedback on this presentation SEC102 As a thank you, we will select prize winners daily for completed surveys!