UT Shield

Identity and Access Management

The University of Texas at Austin

New Authentication Integrations

Step 1: Understand the Concepts

When considering the development or acquisition of a new software product, it is important to understand some core identity management concepts.

For example: What is the different between AuthenticationAuthentication Authentication is the act of determining that a person is who they claim to be. For more information, see our Concepts page. and AuthorizationAuthorization Authorization refers to the act of determining whether an authenticated user is allowed to access a specific resource or take a specific action. For more information, see our Concepts page.? (Importantly, Enterprise Authentication provides authentication, not authorization.) What is the difference between the UT Electronic Identifier (UT EIDUT EID The University of Texas Electronic Identity (UT EID or EID) is the public records identifier for principals at the university. See our Concepts page for more information.), the eduPersonPrincipalName (ePPNePPN The eduPersonPrincipalName (ePPN) (format: <eid>@utexas.edu) is an attribute which is part of the eduPerson LDAP schema.), and the Institutional Identifier (IIDIID The Institutional Identifier (IID) (format: <eid>@eid.utexas.edu) is designed for use with cloud-based services whose usernames are e-mail addresses. When used as an email address, will forward to the user’s email address on record. Guest-class EIDs do NOT have IIDs unless they have been granted a special entitlement.)? Which identifier should you request?

Prior to submitting an integration request, review and become familiar with the following documentation:

Additionally, you may find it helpful to review this entire page prior to submitting any requests.

Step 2: Review the Requirements

Vendor Requirements

Prior to purchasing a vendor solution, please review our Vendor Requirements to ensure that your solution will work with our Identity Provider (IdPIdP An Identity Provider (IdP) is a software tool or service that offers user authentication as a service. The IdP manages the user's primary authentication credentials and issues assertions derived from those credentials. At UT Austin, the primary IdP used to authenticate the UT EID and EID Password is Enterprise Authentication, which is managed by the IAM Team. For more information, see our Concepts page.).

Metadata Requirements

Your SAMLSAML Security Assertion Markup Language (SAML) is a standard, XML-based language for exchanging authentication and authorization data between identity providers and service providers. This standard is currently used by Enterprise Authentication (as well as hundreds of service providers that integrate with our identity provider). Service Provider (SPSP A Service Provider (SP) is the server/system which hosts the resource. In this context, you (or your vendor) are configuring the SP that provides a service to your customers. Your SP will integrate with our IdP. For more information, see our Concepts page.) will generate metadata which provides our IdP with instructions on how to interact with your SP. Please ensure that your metadata can meet our Customer Metadata Requirements.

State Requirements

In accordance with Texas Government Code § 2054.0593 cloud computing services must comply with Texas Risk and Authorization Management Program (TX-RAMP) requirements. External vendors are strongly encouraged to become TX-RAMP certified.

Step 3: Submit a Request

Please note that the typical turnaround time to onboard a new authentication integration is 4 – 6 weeks. This may increase to 10 – 12 weeks during times of high demand (e.g., before the start of a new semester).

Submit an Integration Request

If you are working with a 3rd party vendor, you may provide them with a vendor-friendly questionnaire . (You will use their response to fill out the above Integration Request form.)

Step 4: Await the Approvals

After review, the IAMIAM Identity and Access Management (IAM) is a set of policies, processes, and technologies designed to ensure that the right individuals (identities) have the right access to resources within an organization. IAM involves managing and securing digital identities, controlling access to systems and data, and maintaining the confidentiality, integrity, and availability of information. Team will facilitate the following on your behalf:

Step 5: Configure, Test, and Verify

Once the ISOISO The Information Security Office (ISO) is the University’s information security team. has approved your integration documentation, we will assign your request to one of our integration engineers who will work with you to configure, test, and verify your integration.

Configuration

We have published the most basic technical information you’ll need on Authentication Integration Technical Details.

Testing

While the IAM Team will assist with configuration and troubleshooting, you and your department are ultimately responsible for testing your integration and verifying that it meets your needs.

FAQs

We answer many common questions in our ServiceNow knowledge articles. Some examples:

For more helpful information, see our ServiceNow knowledge articles.

Questions

If you have any questions throughout this process, please e-mail us at iam-integrations@utlists.utexas.edu.