(Presented by Identity Automation) Identity Automation has worked with the North Carolina Department of Public Instruction since April 2013 to provide a cloud-based identity management service for all employees, students, parents and guests of the State’s K12 organizations. In this session, Identity Automation will discuss how the service was used to synchronize identities with target systems, provide federation services as well as end-user self-service and to delegate administration functionality.

1. Cloud Identity Management for
North Carolina Department of Public Instruction
Troy Moreland – Founder & CTO, Identity Automation
Samuel Carter - Systems Architect, Friday Institute
November 14, 2013

2. Who should attend this session?
• Anyone interested in Identity Management as a
Service
• Managers/Architects responsible for Identity
Management for their organization
• Software companies interested in taking their
products to the cloud with AWS
• Cool people!

3. Background

4. Who is Identity Automation?
• We are a software company specializing in
identity, data and access management
• We have commercial and public sector
customers but our specialty is education
• Our products manage over 3.6 million user
accounts across US and Canada
• The average customer size is 20k identities

5. Identity Automation Product Overview
• ARMS – Access Request Management System
– Self-service and delegation tool
• DSS – Data Synchronization System
– Identity, data and configuration management tool
• FIMS – Federated Identity Management System
– SAML Identity Provider
• FMS – Folder Management System
– Identity-driven storage management for Windows

6. Logical Solution Overview

7. Current Implementations
• Traditional Methodology
– On-premises installation
– Turnkey services
– Multiple support options
• Customer Responsibilities
– Provide hardware (physical or virtual)
– Hire/train staff
– Ongoing maintenance

8. Requirements

9. What is the NCEdCloud?
• NCEdCloud is the initiative responsible for
providing cloud based services to all school
districts (LEAs) and charter schools within the
state of North Carolina
• NCEdCloud IAM is the name for the Identity and
Access Management service provided by
Identity Automation

10. What were the goals of NCEdCloud IAM?
• Provide school district employees, students,
parents and guests with a single login to all
NCDPI sponsored systems as well as other
cloud systems that are utilized by numerous
districts (including charter schools)
• Provide self service capabilities to all end users
and delegation capabilities to all district
administrators

11. What does NCEdCloud IAM actually do?
• Using data from authoritative systems, it creates
identities (accounts) for all users and keeps them up-todate. Single identity supports multiple affiliations
• Synchronizes identities to target systems
• Provides Identity Provider (IdP) for SAML-based
authentication and assertion
• Provides interface for self service and delegation of
identities
• Provides real-time metrics regarding availability,
performance and usage

12. How many users are we talking about?
•
•
•
•
250,000 Faculty/Staff
1,500,000 Students
~3,000,000 Guardians
? Guests
Planning for up to 10 million active users…

13. How type of systems are being integrated?
•
•
•
•
•
•
•
•
Student Information Systems
HRMS
Cloud email
Directory Services
Content Services
Library Management Systems
Cloud Web Content Filter
Cloud Support System
We are adding 10 new systems per year!

14. What were some of the other constraints?
• NCDPI didn’t want to host the solution
• NCDPI didn’t want to hire new employees
• NCDPI wanted to pay all-inclusive, annual
subscription
• NCDPI required elastic architecture to meet growth
• NCDPI required highly available solution
• NCDPI required delegation for their Cloud Help
Desk

15. Evaluation

16. What will we do for infrastructure?
• We already have the software we need but nowhere
to run it.
• To buy, host and maintain the required hardware
was estimated to cost us more than the full 3-year
budget allotted for this service
• It was estimated to take us 10 – 12 months to
complete install and configure an infrastructure to
meet the needs of this service
• In the end, we are a software company, not a
hardware company

17. Can we get assurance of data security?
• Personally Identifiable Information (PII) MUST be stored
within the US
– Certified by AWS
• Only US citizens may access data
– Certified by AWS
• Infrastructure vendor must be SOC 2 “certified”
– AWS maintains this plus many others (aws.amzon.com/compliance)
• In short, showing NCDPI we were working with AWS
gave them the “warm fuzzy” required to move forward.
We could have never done this on our own in time.

18. So why the AWS cloud specifically?
• Industry Leader
– Gartner Group Magic Quadrant
https://aws.amazon.com/resources/analyst-reports/
• More Service Offerings
– No other vendor compared with regards to the number of services
offered by AWS. This was compelling for what we need now and
what we can do in the future
• Out-of-the-Box Integration
– Our products speak the “web services” language. For AWS, web
services *is* the product, not something that gets added after the
fact

19. Solution

21. What AWS services are utilized?
•
•
•
•
•
•
•
Amazon Route 53
Amazon VPC
AWS IAM
Amazon RDS
Amazon SES
Amazon SNS
Amazon CloudWatch
• Amazon EC2
– Windows 2012
– Amazon Linux
• Elastic Load
Balancing
• Amazon S3
• Amazon CloudFront

22. Typical End User Session

23. What is unique from AWS perspective?
• Auto-scaling via API
• Provisioning to IAM

24. What are future plans?
• Implement Chaos Monkey
• More automated monitoring – i.e., kill or restart
application when not responding
• Create AWS adapter for DSS

25. Results

26. Did AWS save us money?
• We didn’t hire anyone to specifically maintain
infrastructure
• We didn’t acquire physical hosting space
(minimum of three)
• We didn’t buy any hardware
• We didn’t implement new service with ISP
• We didn’t have to manage/coordinate the buildout of new facilities

27. Did AWS save us time?
• We estimate that the build-out would have taken us 10-12
months. Development environment was built in a day.
• Test environment took about 2 weeks to complete (due to
learning by trial-and-error).
• Production environment was ready to go in 5 days!!
–
–
–
–
–
Utilizing three Availability Zones
Multi-AZ Amazon RDS instance
HA Windows (AD) instances
HA elastic Amazon EC2 instances of our appliances (across all AZs)
Four sets of Elastic Load Balancing instances (across all AZs)

28. Did AWS add any other value?
• Built-in compatibility with our products
– We automate management of IAM users and groups
– We automate auto-scaling of our application instances based on
custom triggers
– We pull information from AWS and place it into our reporting
solution for centralized dashboards
• Enterprise Support
– Enables us to meet the our SLA requirements with the State
– Constantly helping validate our infrastructure design
– Dedicated team has kept us from having to hire more staff

29. Demonstration

30. Please give us your feedback on this
presentation
SEC102
As a thank you, we will select prize
winners daily for completed surveys!