Palm Beach County – Case Study

Craig Lessard

SIM Project Manager

Palm Beach County Information System Services

Charles A. Radi, Sr.

Principal Architect

Novell, Inc.

Peter Hodge

Account Executive

Novell, Inc.

PBC SIM Project Overview

Scope of SIM project in phases

Key SIM components and services

Current status / future plans

Lessons learned

Goals and objectives

Palm Beach County Interesting Facts

Carved out of Dade County in 1909

3 billion dollar industries are Tourism, Agriculture and Construction. High Tech is 4th largest industry

45+ miles of shoreline, and 2,578 sq. miles is larger than Rhode Island or Delaware

1,183,197 citizens as of 2002

Average temperature is 75 degrees

Often referred to as “Golf Capital of the World”

Palm Beach County Defined…

Approximately 8000 users from many agencies both local and state sharing a common network

Board of County Commissioners

Clerk of the Circuit Court

Property Appraiser

Tax Collector

Supervisor of Elections

Public Defender

State Attorney

Key Deliverables:

Identification of B2E/SIM Goals and issues

Identification of B2E/SIM Solutions

Alignment of initiative investments to business capabilities and tactical initiatives

High-level technical architecture

Roadmap & next steps for Solution

Benefits:

Confirms goals and organizational definition and direction of initiatives

Identifies high value opportunities

Creates clarity of business justification

Positions for better ROI

Focuses team on early results

Ensures organizational alignment

Creates momentum

Provides highlevel costs for the solution

Novell SIM Approach Methodology

Workshop

Requirements

Assessment

Design

Development/

Deployment

Maintenance/

Support

Workshop objectives

The key objective of the Workshop is to determine the best course of action for implementing SIM and B2E solutions

To achieve this, the following goals were pursued:

Raise awareness and understanding of the issues and opportunities in the B2E/SIM space

Gain consensus among management team of the key issues facing Palm Beach County around B2E/SIM

Identify opportunities to improve operating effectiveness

Identify possible cost avoidance opportunities

Identify possible productivity enhancing opportunities

Identify proactive and practical timelines, resource requirements next steps, and highlevel costs

Develop a high-level business-driven technical architecture

Enhance security

Reduce administrative costs

Increase user productivity and efficiency

Establish a common directory for all users

Ensure data integrity and consistency

Automate identity management and resource provisioning

Improve monitoring, alerting and auditing capabilities

Provide white pages and org chart directory of employees

Simplify application and resource access

Customer Goals Identified by Workshop

Best Practices implementation

Keep it simple and supportable

Enforce data quality going forward

Include everyone

Management Goals for SIM

Gigi – Goals for SIM Solution

Single point of administration for identity data

Delegated administration and self service

Streamlined provisioning and de-provisioning of services and resources

Simplified enforcement of security policies

Improved audit reporting

Accurate user information

Comprehensive white pages for employee search

Dynamic email distribution lists

Improved user productivity and satisfaction

Creates single directory of all identity data

Links and synchronizes directories CountyWide

Enables enterprise wide delivery of applications

Streamlines administration of security / passwords

Increases both employee and administrative productivity

Reduces cost for provisioning, security and auditing

Provides Key Short and Long Term Benefits

Scope of SIM Project in Phases

Current State of Directory Services in PBC

WUD AD

& Exchange

PBIA AD

& Exchange

Library AD

& Exchange

Clerk

Banner HR

ePZ&B

ePZ&B

PBX

VPN

CCRT

OID

PBC_NDS

4600 Users

Tax Collector

Banner HR

Advantage

FTP

RADIUS

Public Safety AD

BCC Custom

HR App

EIS

PBCFL.US

ENG

eDirectory 8.5x

Crystal

Reports

GroupWise

Community

Services AD

Messaging Server

Messaging Server

Messaging Server

Messaging Server

Oracle Internet

Directory OID

Clerk of Courts

SCT Banner

Oracle 8.1.7

Property App

SCT Banner

Oracle 8.1.7

PBC BCC

E.1.S HR App

Oracle 8.1.7

Oracle

Oracle

PBIA.ORG

PBIA.ORG

PBIA.ORG

PD_15

NDS 6.09

Manual Provisioning and Updates,

No Synchronization,

Manual Auditing Function

PBC_NDS

Production Tree

PBC Enterprise Directory Services Architecture Phase I

PBCFL.US

Messaging Server

DirXML

DirXML

DirXML

DirXML

DirXML

LDAP Server

LDAP Server

PBC NOS

Tree

PBC_NDS

eDirectory

8.7.3

eGuide Internal

White Pages

Org Chart

Self Service

eGuide External

White Pages

Org Chart

Secure

Instant

Messenger

GroupWise 6.5

Remedy

Help Desk

iFolder

Nsure Audit

PBCAUTHXML

Nsure Audit

PBCIV-AUDIT

Nsure Audit

PBCXML

Remedy

Remedy Cares

Primary Active Directory

PBCFL.US

LDAP Service

Consumers

PBC GroupWise System

PBC_GW

Identity Vault

Synchronizes Identity Data for

7000-8000 Users

Identity Vault

PBCIV

eDirectory 8.7.3

PBCAUTH

eDirectory 8.7.3

LDAP Services

PBC Meta-directory Services Diagram

Scope of PBC SIM Solution Phase I

Connects and synchs identity data between

Enterprise eDirectory™ Tree – PBC_NDS

Enterprise GroupWise® System

Enterprise Active Directory – PBCFL.US

Remedy Help Desk solution in NOC always stays current

Begins automation of identity management processes

Adds monitoring, alerting and audit reporting

Adds LDAP service tree and LDAP consuming services

Adds Comprehensive password management solution

Simple Sign-On – Phase I

Synchronized passwords and LDAP provide Simple Sign-On to:

Enterprise eDirectory PBC_NDS

Enterprise GroupWise System

Enterprise Active Directory PBCFL.US

Remedy Help Desk Solution

eGuide White Pages

Instant Messenger

Novell iFolder®

PZ&B Zoning Kiosk

Soon to add Crystal Enterprise

Mimesweeper uses LDAP for eMail address lookup

Key SIM Components and Services

Solution’s Capabilities for PBC

Simple (reduced) sign-on

Password management

Data entry streamlining (process improvement)

Role-based access for policy/security compliance

Productivity improvements

Data and application sharing

Secure private/public access capability

Remote access (for mobile workers/emergencies)

Create a trusted, enterprise-wide identity infrastructure that improves security and access to resources and reduces maintenance & administration burden across PBC

A Secure Identity Management Architecture will allow Palm Beach County to:

Secure Identity Management Architecture Value Creation

Reduce Complexity

Leverage Common Capabilities

Enable Rapid Delivery of Functionality

Avoid Unnecessary Costs

Raise the Customer Service Bar

Open Up Information Silos

Net Enable the Organization

Automated Dynamic Distribution Lists

Dynamic Distribution Lists for each agency (38) self maintained as users are added, moved or deleted from IV. Can be added to support divisions.

All-County-Admininstration

All-Public-Affairs

All-Tax-Collector

Groups in eDirectory or Active Directory can generate and maintain a GW Distribution List.

eGuide supports a Mail this team! Link for sending mail to an entire org-chart team.

Using iManager during create users are quickly and easily granted access to the following resources.

PBC_NDS

PBCFL.US

GroupWise system with assigned email address and Distribution Lists

Memberships via templates, OU permissions, or specific group assignments grant access to departmental

Applications via ZENworks® or GPO

Printers,

Shared Directories

Notifications are sent to system administrators expedite application access for Crystal Enterprise, Remedy, IM, and Fax

Provisioning Phase I

Customized web user administration tool that addresses identified issues.

Key Solution Components iManager Portal

iManager…

Provides a single point of administration for identity data

Provides for personalized and delegated administration using Role Based Services (RBS) model.

Streamlines provisioning and de-provisioning of services and resources

Generates unique CN and Password on account creation.

Enforces minimum required data set and accurate user information

Notifies stakeholders of identity based events

Provides one stop shop for user based password management for all connected systems

Improves security by enabling stronger password policy for all connected systems

Enables password policy enforcement even when connected applications or directories cannot

Allows for user self service password reset using comprehensive challenge/response

Likely to require disabling of password reset from connected systems and applications

Key Solution Components Universal Password

Significantly reduces setup time for application implementation.

Dedicated LDAP service tree provides highly scalable, highly available LDAP access for authentication and authorization.

Uses industry standard LDAP v3 access protocol.

Supports LDAP(s) for secure LDAP communication.

Key Solution Components The Power of LDAP

Supports monitoring, alerting, logging and reporting of DS events

Platform agents collect, sign and send events to logging server.

Secure Logging Server (SLS) receives events, logs them to a database (Oracle or MySQL), and sends alerts as defined.

Provides Crystal Reports interface for reporting logged events.

Key Solution Components Nsure® Audit

Provides detailed org chart information and allows users to walk the org chart.

Provides white pages search capabilities of all identities in the meta-directory. Displays key employee information.

Provides employee self service of some attributes such as phone numbers, web links.

Can be modified/enhanced to include services search.

Key Solution Components eGuide

Provides secure IM communication internal to PBC WAN

Uses LDAP for authentication with same id/password

User CN is call sign, LDAP Searches via, first, last, dept

Can limit access by container or user

Can set to offline

Usable by any department CountyWide

Key Solution Components Instant Messenger

Targeted for mobile users that require offline access to files yet need them backed up to a file server

Also great for users or applications that require data local to PC

Provides synchronized file store between desktop, laptop and server

Provides automated synchronization

Provide file conflict resolution logs

Hosted by PBCAUTH Tree so agency can use it

Key Solution Components Novell iFolder®

Departmental Admin Impact & Deployment Plan

Data cleansing required from everyone is the most immediate need. We will help and automate

Reduced use of GWMAINT processes

Removal of GroupWise snap-ins from ConsoleOne®

Use of centralized iManager tool for all account management tasks

Containerization issues, may require reorganization

Introduction of contextless login to help OU reorg and benefit end-users who move around the County

eGuide requires org-chart management

SIM Project Impact on Departmental Administrators

Workshop

Design

Development/

Deployment

Populate and synch User Accounts across systems

Migrate system from QA to PROD

Setup of Security Principles

Admin Groups, Roles, Tasks, Templates, Groups and Dist. Lists

Startup UPS implementation

Migrate passwords from PBC_NDS

Seed passwords for non-PBC_NDS users

Migrate LDAP services to use PBCAUTH

Remedy, GroupWise 24 PO's, IM, Novell iFolder

Systems Architecture Setup

Service Placement, Fault Tolerance, Load Balance, Certificates

Maintenance/

Support

Requirements

Assessment

SIM Deployment, Phase I

Agency Preparation Requirements
Pre-Deployment Tasks

Create USER container in each geographic agency OU

Redefine / create templates to meet SIM requirements

Must be named using standards

Must include approved department attribute

Must be created and maintained in PBC_NDS

Attend SIM training.

Announce to user population SIM is being deployed and includes new password management processes

Disable password reset capabilities in from the client desktop using either ZENworks or GPO

Remove old and unmanaged ConsoleOne packages and Push the C1X client to all administrators

Assist by testing iManager interface, reporting any issues to SIM Team

Assist by helping users through new password management process, reporting any issue to SIM Team

Agency Preparation Requirements
Deployment Cutover Tasks

Agency Required Actions with Agency Driven Schedule

Review and optionally redefine group objects so they synchronize to PBCIV and GroupWise as DLs

Sweep desktops per CSA published spreadsheet to enable contextless login, NDPS® / iPrint, IM etc

Reorganize OU structure to leverage automated account startup

Schedule and announce LDAP authentication for GroupWise for Simple and Single-Sign-On

Begin Now - Complete after Deployment

Remainder of PBC Solution Lifecycle
Assumes Fri 3/4 – Tue 3/8 “Go Live” Window

GroupWise

End User
Training

<1 week

“Final Fixes” utilize up to 120 hours from Change Order #2 for new problems identified with previously signed-off UAT test conditions (including hours associated with situations where Novell works on a ‘bug’ and confirms that there is no defect)

An additional change order will be required to:

Fix confirmed problems that are not tied to UAT test conditions

2. Fix confirmed problems tied to UAT test conditions beyond the 120 hours

PBC will make best efforts to determine if problem is

“Severity 1” (can’t go to production until fixed),

“Severity 2” (go to production with manual fixes) or

“Severity 3” (low priority, Customer submits enhancement request to Novell under change order)

Dev/

Unit Test

Production Implementation Ended;

Novell depart End of Day 2/8

(except for Knowledge Transfer

Resource who Executes 32 hours)

Production

Migration

Starts

Re-Run UAT

Portions in

Production

Support

in

Production

Novell team on-site with PBC team

executing the Migration Plan

Friday 3/4

Saturday 3/5-

Sunday 3/6

Monday 3/7-

Tuesday 3/8

Warranty work processes

outlined in this document

for those test conditions

previously confirmed in UAT.

An additional change order

Required to fix confirmed

Problems not tied to UAT

testing (after using the 120

hours from CO#2)

30 day

Acceptance

Period Starts

Knowledge

Transfer

(32 hours)

Wed 3/9-

Thursday 4/7

Go/No-Go

Decision for

Production

Friday 2/25

PBC Admin

Training

1/31 thru 2/18

User

Acceptance

Test

Ending no later

than Fri 1/28

“Final Fixes”

from

Training

Week of 2/21

Novell team arrive

Thursday night 3/3

•••

Outline of “Go Live Weekend”
Assumes Fri 3/4 – Tue 3/8 “Go Live” Window

GroupWise

End User
Training

<1 week

Production

Migration

Starts

Re-Run UAT

Portions in

Production

Support

in

Production

Friday 3/4

Saturday 3/5-

Sunday 3/6

Monday 3/7-

Tuesday 3/8

Knowledge

Transfer

(32 hours)

Wed3/9-Fri3/4

PBC performs backup (tape and LDIF) of PBCNDS, GroupWise, IDV, AUTH, AD, Remedy production as a backout mechanism

PBC identifies Administrative Accounts for driver exclusion in AD, IDV, AUTH, NDS, GW, Remedy. Ensure that they are excluded.

Novell export drivers from QA and import to PROD. Novell promotes all other code to PROD.

Initiate driver from IV to PBCNDS; verify successful operation.

Initiate iManager migration (if not already done beforehand); verify successful migration.

Initiate driver from IV to AUTH (if not already done beforehand); verify successful operation.

Initiate PBCNDS to GW driver; verify successful operation.

Initiate IV to AD driver; verify successful operation.

Initiate IV to Remedy driver; verify successful operation.

PBC applies Universal Password password policy for those users who are migrating first (e.g. ISS).

PBC re-executes selected UAT conditions in PROD according to established process.

Novell supports Customer through prioritized queue of identified issues.

Knowledge transfer sessions (up to 32 hours total).

FRI

SAT

SUN

M-T

W-F

Challenges, Lessons Learned and Future Plans

Executive Sponsor and IS Management buy-in (ROI)

Data cleansing requirements and process

Project management issues – Managing conflicting objectives

Governance policies, security compliance and enforcement

Resistance from agencies not aligned with central IT

Existence of multiple directory services and HR systems

SIM Implementation Challenges

Product:

NetWare® / eDirectory

BorderManager®

GroupWise (Full Client)

GroupWise (Web Access Client)

ZENworks Server/Desktop Bundle

Extend Director Standard Edition

iChain®

ROI Leveraging Infrastructure Investment

License Count

4285

900

5207

500

4285

2 CPU

1000

Total Value = $1,197,572

What PBC owns today...

Product Quantity

DirXML® Engine	4285

DirXML eDirectory to eDirectory Connector	4285

DirXML eDirectory to AD Connector	4285

DirXML Password Sync for Windows	4285

DirXML eDirectory to MS Domain Connector	4285

Novell eDirectory 8.7	4285

NMAS Enterprise Edition	1000

Novell iFolder 2.1	4285

Novell Cluster Services™ 1.6 unlimited 2 node

Premium Support P-3000ASE 1 / 50 incidents

Total Value = $475,000

SIM project software entitlements... licensed via already owned software

Palm Beach County Return On Investment

ROI According to Giga Document by Jonathan Penn

Provisioning for PBC employees

Accurate Central White Pages

Web Single / Simple Sign On

“Justifying the 2003 IT Budget: Identity Management Brings Quantifiable ROI to Security”

$3,560,000

$10,002,200

$2,700,000

Total ROI=$16,262,200

Data Cleansing Process

Export and merge data from eDirectory, GroupWise, and HRIS

Take best and logical data from each source

Separate and send to agencies in spreadsheet

Scrub results and import back to access for analysis

Insert default attributes for missing data

Import to identity vault and display using eGuide

Maintain via delegated admin and self-service

Data Cleansing Process

DataFields—Results of Data Cleansing Process

Nulls

Nulls

Telephone Number

Cell Mobile Number

Fax Number

Pager Number

Public Facing Phone

Company

Department

Division

Full Name

Given Name

Initial

Preferred Name

eMail Address

IS Manager

Manager

Title

Working Title

Location

Street Address

City

State

Surname

Zip Code

922

6998

2280

7180

7200

0

6363

0

6699

0

7200

464

7200

0

0

0

3789

720

6566

7160

959

0

0

2283

0

354

7021

6850

1041

7022

0

62

48

48

1915

041

042

043

25

5077

133

0

0

0

Managing Conflicting Objectives

Streamlined and automated administration vs. Keep the solution simple and supportable

Enforcing new policies vs. Managing Change

Future Phases

HRIS Integration

AD + Exchange integration for specific Agencies

Oracle Internet Directory OID Integration

B2E Portal Implementation

Secure Remote Access with iChain.

Provisioning of access badges for employees.

PBX, FTP,RADIUS,VPN

Modular Access Systems

PBCFL.US

Messaging Server

OID

Oracle Internet

Directory OID

Clerk of Courts

SCT Banner

Oracle 8.1.7

Property App

SCT Banner

Oracle 8.1.7

PBC BCC

E.1.S HR App

Oracle 8.1.7

PBC_NDS

Production Tree

PD_15

NDS 6.09

ENG

eDirectory 8.5x

LDAP Server

Identity Vault

eDirectory 8.7.3

Remedy

xxx

Oracle 8.1.7

GroupWise

Other AD Forests

Tax Collector

SCT Banner

Oracle 8.1.7

DirXML

Potential Future State Meta-Directory

PBC DirXML MetaDirectory Services Diagram

Novell NDS Trees

Managed by Agency Admins

Active Directory Forests and ExChange Systems

Managed by

Agency Admins

Custom Web and

Client Server Applications

LDAP Service Consumers

B2E Portal eGuide

BCC Custom HR App

Agency SCT Banner HR Apps

Adds HRIS

Adds departmental AD's

Adds more LDAP consumers

eGuide adds services search

Supports automated batch connections

LDAP

LDAP

X

X

Here’s what workshop participants asked for. This is a list of the key finding’s from the workshop engagement as identified by PBC agencies.

In a nutshell this diagram quickly illustrates our current heterogeneous environment. It is with this scenario we can easily understand how difficult and time consuming it is to keep the identity data for each of these systems up to date.

In many cases it’s not being done at all which creates security exposures.

This is a diagram of what our solution looks like after Phase I of our meta-directory is completed. It includes synchronization of employee data between the Identity Vault, or enterprise eDirectory (PBC_NDS) and Active Directory (PBCFL.US) services, our GroupWise system and Remedy.

It also adds an LDAP service tree to support authentication and authorization of LDAP enabled applications. Phase I LDAP consumers include Remedy, GroupWise, GroupWise Messenger, iFolder, and eGuide services. Phase I includes a simple sign-on experience for up to 7 applications for those that take advantage of them. Other future adapters of LDAP include Crystal Reports and eventually a portal implementation.

Which ultimately led to this list of capabilities. This is a list of solution components that drive our solution proposals.

Definition and purpose of the iManager tool.

Another key component of the SIM solution is the Universal Password System this is an add-on to eDirectory that support significantly more complex passwords, giving very granular policy definition capability on passwords.

The system can be used to enforce password policy on applications that otherwise could not support it.

One of the most powerful solution components is the LDAP service tree. This includes dedicated LDAP servers that are both high scalable and redundant for load balancing and fail over. They support industry standard LDAP v3. and secure LDAP to keep all communication secure.

The key to your strategic planning going forward to make sure your applications going forward support LDAP. Whether you buy or build if your application supports LDAP the time to implement and manage user accounts is significantly reduced.

Talk about the IM pilot for the COC, Remedy or Portal pilot.

Key overview of the audit system.

Key highlights of eGuide.

Key highlights of eGuide.

Used for the mobile laptop community.

Here is a comprehensive list of perceived challenges PBC would encounter as we move to implement SIM in PBC. This list was created by workshop participants during a session at the workshop.

So the process included exporting data from various sources, taking the best data from each source and merging them together. We then sorted the data by agency and distributed the data to agencies in a spreadsheet. This process was per customer requests so they wouldn’t have to enter data 1 employee at a time. The spreadsheet saved time and provided much more consistant data, because users could cut and paste standard attributes and sort by sort to quickly identify non-standard entries.

Our team audited and made corrections to each spreadsheet before importing the data to our database. We looked for missing data, proper capitalization, common abbreviations of addresses and fixed them, always working with the agency contact.

In some cases where the department did not provide required data we defaulted the data to best known data. Examples include setting missing addresses to department headquarters, and setting manager fields to know department or division managers.

The results from this process has exceeded our expectations. Our earliest predications estimated that agencies such as WUD, Libraries, and PBIA would not provide the information. It turns out that we already have very good information from Libraries and WUD has committed to providing the date by January 10th. PBIA has also indicated they are likely to follow suit.

Because the process took 3-4 months there will be delta’s to need to updated, but we can clearly show that the end result is measurably better data than what we started with.

2003-12-08T12:43:39