UT Shield

Identity and Access Management

The University of Texas at Austin

IAM Announcements

Below is an archive of all major IAM announcements.

, Filed Under: Announcements, Authentication, Enterprise Authentication Changelog

News from the Transition to Enterprise Authentication Project – October 2019

Enterprise AuthenticationAuthentication Authentication is the act of determining that a person is who they claim to be. For more information, see our Concepts page. is LIVE

The implementation of the new Enterprise Authentication service is complete, and the service is now live in production.

The Identity and Access Management (IAMIAM Identity and Access Management (IAM) is a set of policies, processes, and technologies designed to ensure that the right individuals (identities) have the right access to resources within an organization. IAM involves managing and securing digital identities, controlling access to systems and data, and maintaining the confidentiality, integrity, and availability of information.) team is now undertaking the first phase of a project to migrate over 800 integrations from UTLogin to Enterprise Authentication. Transition managers are working to schedule customer transitions with the goal to have all UTLogin transitions complete by the end of 2020 and retire UTLogin in December 2020. The transition focus will then shift to transitioning UT Shibboleth customers.

Ready to Integrate with Enterprise Authentication?

If you are an existing UTLogin customer and have not been contacted by a transition manager, please reach out to the team by emailing iam-integrations@utlists.utexas.edu .

New IAM authentication customers can find information about the integration process and initiate a new integration by visiting https://iamservices.utexas.edu/integration/.

All customers are welcome to visit the Enterprise Authentication ServiceNow page to find more information including answers to frequently asked questions.

Resources

Want to know more about Enterprise Authentication? Visit the Enterprise Authentication ServiceNow page and/or review some of these commonly asked-about topics:

You may also be interested in our other ServiceNow Knowledge Articles.

Connect with the Enterprise Authentication Team

For questions or comments, send an email to entauthn@utlists.utexas.edu.

, Filed Under: Announcements, Authentication, Enterprise Authentication Changelog

ITS Campus Solutions is Consolidating to Standards-Based Enterprise Authentication

What is changing and why?

The Identity and Access Management (IAMIAM Identity and Access Management (IAM) is a set of policies, processes, and technologies designed to ensure that the right individuals (identities) have the right access to resources within an organization. IAM involves managing and securing digital identities, controlling access to systems and data, and maintaining the confidentiality, integrity, and availability of information.) team is deprecating the agent-based authenticationAuthentication Authentication is the act of determining that a person is who they claim to be. For more information, see our Concepts page. model and adopting standards-based web authentication.

For UT servers and applications using UTLogin, this will involve transitioning to a new Enterprise Authentication service, which provides Security Assertion Markup Language (SAMLSAML Security Assertion Markup Language (SAML) is a standard, XML-based language for exchanging authentication and authorization data between identity providers and service providers. This standard is currently used by Enterprise Authentication (as well as hundreds of service providers that integrate with our identity provider). 2).

The goal of this change is to provide a standards-based authentication method. SAML 2 represents established industry standards, which the majority of software vendors support. Additionally, having fewer authentication methods means a better single sign-on experience and faster integrations.

The IAM team will begin contacting UTLogin customers to develop transition plans in June 2019.

How will this affect me?

For most people who use protected websites and applications, the transition to Enterprise Authentication will not require any attention or action. There may be small changes to the look and feel of the login screens; but, overall, the login process will be the same. Some end users may be asked to authenticate multiple times as our authentication customers migrate to the new service.

This change primarily impacts individuals who manage servers and web applications that use UTLogin. In order to focus on the transition to Enterprise Authentication, the IAM Team will no longer provision new Web Policy Agents (WPAs). Support for existing WPA and SAML customers will not be affected.

The IAM team has been working to develop processes to support transitioning customers to Enterprise Authentication. This includes documentation, training, and outreach. These efforts will continue and become more detailed over the coming months.

Questions?

Review our project page: Transition to Enterprise Authentication Project

Please send questions to: entauthn@utlists.utexas.edu

, Filed Under: Announcements, Authentication, Directory Services, Multi-Factor Authentication, TED Release Notes, UTLogin Release Notes

Upcoming configuration freeze dates for IAM services

What is changing and when?

To reduce the chance of system instability during the Workday go-live period, the Identity and Access Management (IAMIAM Identity and Access Management (IAM) is a set of policies, processes, and technologies designed to ensure that the right individuals (identities) have the right access to resources within an organization. IAM involves managing and securing digital identities, controlling access to systems and data, and maintaining the confidentiality, integrity, and availability of information.) team will not make configuration changes, perform new integrations, or create new service accounts between October 14, 2018 and December 2, 2018 for the following service offerings:

  • Shibboleth
  • Two-factor authenticationAuthentication Authentication is the act of determining that a person is who they claim to be. For more information, see our Concepts page.
  • uTexas Enterprise Directory (TEDTED The uTexas Enterprise Directory (TED) is the University’s enterprise directory. See uTexas Enterprise Directory (TED) in the service catalog for more information.)
  • UTLogin

Actions required:

Please submit your configuration requests by September 26, 2018 to ensure your request is processed ahead of the freeze.

Additional information:

If you have an urgent request during the freeze, you may request an exception by following the process published in ServiceNow here.

Questions?

Please send questions to: help@its.utexas.edu.

, Filed Under: Announcements, Authentication, UTLogin Release Notes

UTLogin Stability Roadmap – June 2017

Colleagues,

As you may be aware, UTLogin provides centralized authenticationAuthentication Authentication is the act of determining that a person is who they claim to be. For more information, see our Concepts page. services for more than 250 campus applications and processes more than 55 million authentication requests annually. As with all Identity & Access Management (IAMIAM Identity and Access Management (IAM) is a set of policies, processes, and technologies designed to ensure that the right individuals (identities) have the right access to resources within an organization. IAM involves managing and securing digital identities, controlling access to systems and data, and maintaining the confidentiality, integrity, and availability of information.) services, our goal is for UTLogin to be reliable, secure, and easy-to-use. In the past year, we have not met the reliability expectations of campus (and ourselves) as UTLogin has experienced a number of outages.

I apologize for the disruption these issues have caused you, your customers, and your business processes. We are committed to addressing the root causes of these issues and restoring UTLogin to stable operations.

Although the IAM team has implemented fixes and mitigations after each service outage, new issues with different immediate causes continue to appear, pointing to a deeper set of problems that need to be addressed. After analyzing the 20 UTLogin service incidents that occurred from June 2016 to May 2017, we believe that the overall instability issues are caused by a combination of three major factors:

  • Customizations and Non-Standard Configuration – The OpenAM vendor product upon which UTLogin is based was heavily customized during implementation to meet unique UT Austin requirements, directly causing some issues and making diagnosis of other issues more difficult.
  • Aging System Components – The software components of the UTLogin system are at or reaching end-of-life, limiting support options and making issues harder to diagnose and address.
  • Changing Demands on UTLogin – The number and complexity of systems integrated with UTLogin have greatly increased, introducing new demands on the system.

The IAM team has developed a roadmap to address these issues and return UTLogin to stability:

  • Action 1: Stabilize the Current Environment – Put the current system in “critical fix only” mode, strictly manage configuration changes, and stop unproductive investment of time chasing down issues in the current environment. (Status: Complete)
  • Action 2: Simplify & Standardize UTLogin – Upgrade system components to current supported versions, remove customizations and non-standard configurations, minimize external dependencies, and review and simplify the authentication policy model. (Status: In progress. Expected completion for Requirements and Design: September 2017; Implementation timeline will depend on the Design.)
  • Action 3: Measure & Report Progress – Monitor key performance indicators (KPIs) and report progress toward improving stability to UTLogin customers and stakeholders. (Status: In progress. Expected completion for KPI reporting: July 2017)

You can read the complete the UTLogin Stability Roadmap here: http://links.utexas.edu/byjfjw.

We appreciate your continued support as we work to keep the University’s online environment safe and secure. If you have any questions, please send them to utlogin@utlists.utexas.edu.

Sincerely,

Mario

—
MARIO A. LEAL, Jr., Senior IT Manager
The University of Texas at Austin  |  ITSITS Information Technology Services (ITS) Applications  |  512-471-6954  |  utexas.edu

, Filed Under: Announcements, Authentication, UTLogin Release Notes

Changes to How You Modify Your UTLogin Realm

In order to enhance the stability of UTLogin, the Realm Policy Manager (RPM) was disabled on Thursday, June 9, 2017.

The UTLogin RPM allowed realm administrators to manage and make changes to their own realms. Unfortunately, it was determined that the mechanism by which these changes took place could, under certain circumstances, cause production outages among all UTLogin customers. Thus, the decision was made to disable RPM functionality.

If you would like to request a change to your realm, you may do so using the UTLogin Realm Change Request form.

The UTLogin team is currently working hard on making a number of infrastructural changes, software updates, and re-thinking some architectural best practices to stabilize the UTLogin service. We anticipate being able to restore the delegated administrative functions of the RPM in the future, though possibly in a different form.

To keep up-to-date on UTLogin releases, please ensure that you are subscribed to our utlogin-announce mailing list and keep an eye here for future release news.