IAM Announcements

What is changing and when?

To reduce the chance of system instability during the Workday go-live period, the Identity and Access Management (IAM) team will not make configuration changes, perform new integrations, or create new service accounts between October 14, 2018 and December 2, 2018 for the following service offerings:

• Shibboleth
• Two-factor authentication
• uTexas Enterprise Directory (TED)
• UTLogin

Actions required:

Please submit your configuration requests by September 26, 2018 to ensure your request is processed ahead of the freeze.

Additional information:

If you have an urgent request during the freeze, you may request an exception by following the process published in ServiceNow here.

Questions?

Please send questions to: help@its.utexas.edu.

Colleagues,

As you may be aware, UTLogin provides centralized authentication services for more than 250 campus applications and processes more than 55 million authentication requests annually. As with all Identity & Access Management (IAM) services, our goal is for UTLogin to be reliable, secure, and easy-to-use. In the past year, we have not met the reliability expectations of campus (and ourselves) as UTLogin has experienced a number of outages.

I apologize for the disruption these issues have caused you, your customers, and your business processes. We are committed to addressing the root causes of these issues and restoring UTLogin to stable operations.

Although the IAM team has implemented fixes and mitigations after each service outage, new issues with different immediate causes continue to appear, pointing to a deeper set of problems that need to be addressed. After analyzing the 20 UTLogin service incidents that occurred from June 2016 to May 2017, we believe that the overall instability issues are caused by a combination of three major factors:

• Customizations and Non-Standard Configuration – The OpenAM vendor product upon which UTLogin is based was heavily customized during implementation to meet unique UT Austin requirements, directly causing some issues and making diagnosis of other issues more difficult.
• Aging System Components – The software components of the UTLogin system are at or reaching end-of-life, limiting support options and making issues harder to diagnose and address.
• Changing Demands on UTLogin – The number and complexity of systems integrated with UTLogin have greatly increased, introducing new demands on the system.

The IAM team has developed a roadmap to address these issues and return UTLogin to stability:

• Action 1: Stabilize the Current Environment – Put the current system in “critical fix only” mode, strictly manage configuration changes, and stop unproductive investment of time chasing down issues in the current environment. (Status: Complete)
• Action 2: Simplify & Standardize UTLogin – Upgrade system components to current supported versions, remove customizations and non-standard configurations, minimize external dependencies, and review and simplify the authentication policy model. (Status: In progress. Expected completion for Requirements and Design: September 2017; Implementation timeline will depend on the Design.)
• Action 3: Measure & Report Progress – Monitor key performance indicators (KPIs) and report progress toward improving stability to UTLogin customers and stakeholders. (Status: In progress. Expected completion for KPI reporting: July 2017)

You can read the complete the UTLogin Stability Roadmap here: http://links.utexas.edu/byjfjw .

We appreciate your continued support as we work to keep the University’s online environment safe and secure. If you have any questions, please send them to utlogin@utlists.utexas.edu .

Sincerely,

Mario

—
MARIO A. LEAL, Jr., Senior IT Manager
The University of Texas at Austin  |  ITS Applications  |  512-471-6954  |  utexas.edu

In order to enhance the stability of UTLogin, the Realm Policy Manager (RPM) was disabled on Thursday, June 9, 2017.

The UTLogin RPM allowed realm administrators to manage and make changes to their own realms. Unfortunately, it was determined that the mechanism by which these changes took place could, under certain circumstances, cause production outages among all UTLogin customers. Thus, the decision was made to disable RPM functionality.

If you would like to request a change to your realm, you may do so using the UTLogin Realm Change Request form.

The UTLogin team is currently working hard on making a number of infrastructural changes, software updates, and re-thinking some architectural best practices to stabilize the UTLogin service. We anticipate being able to restore the delegated administrative functions of the RPM in the future, though possibly in a different form.

To keep up-to-date on UTLogin releases, please ensure that you are subscribed to our utlogin-announce mailing list and keep an eye here for future release news.