ForgeRock IAM Solutions

Why ForgeRock IAM is a perfect fit for the education vertical market?

ForgeRock’s IAM stack is an open source, adaptable, lightweight, scalable, quick to deploy and all this while providing the full identity management framework. All of these are important non-functional requirements in this space.

OpenIDM: Identity Management

We configure this product for standard identity management requirements and customize where needed to additional educational institution-specific needs such as:

• User self-service functions such as student registration,  password reset
• User provisioning based on roles and permissions and especially permission matrix driven provisioning and access to systems
• Development of scripted SQL connectors to aggregate data from varied systems of record such as AS400, Banner or other HR systems.
• Cloud connectors that sync data to and from Google, and Office 365
• Implement custom Activiti workflows to implement existing business processes not covered by in-house BPM systems
• Development of custom UI screens in open source HTML, CSS, JavaScript frameworks such as Angular JS or Bootstrap etc

For further information on OpenIDM visit https://www.forgerock.com/products/identity-management/

OpenAM : Access Management

Although CAS is sufficient for limited SSO use cases, we strongly recommend OpenAM to universities when possible. The reasons being the OpenAM :

• Authentication based on dynamic, context-based access that is responsive to user location, time zone, device, IP address, time of day, and more, providing endless personalization possibilities and mitigation of risk. This is especially pertinent in universities with campuses across the globe.
• Authorization that allows users to access applications and services based on permissions and policies defined by using our policy engine tools
• Federation and single sign-on with a single identity, allowing users to access services that span the cloud and mobile devices, on premises and off.  This solves any multilateral federation or InCommon integrations that an institution may have
• Adaptive risk that combines contextual information to evaluate the risk of users (especially students) attempting to access resources and, if they are deemed suspicious, require a higher level of authentication or identity-proofing

Further information on OpenAM is available at https://www.forgerock.com/products/access-management/

OpenDJ: Directory Service

Directories have long been data stores that have been authentication sources for portals and/or other applications at colleges and universities. OpenDJ brings this directory service to a new level in terms of being scalable, lightweight and adapted to the group based delegated administration requirements at these institutions. Additional responsibilities attached to this directory service are:

• Data replication to other directories
• Password policy and flexible schemas to accommodate custom attributes
• REST to LDAP integration which is especially useful in cases where adapters need to be developed to publish identity data from existing HR systems into a directory

Further information on OpenDJ is available at https://www.forgerock.com/products/directory-services/

How do we do this?

We believe that any IAM deployment at an educational institution involves phased implementation plan that addresses an institutions business priorities and solves specific business challenges as opposed to a big-bang approach. A phased approach also ensures the technical staff needed to support these technologies acquires experience managing the new system, and administrative staff can adapt to the new process or business flows that the new system will create.

Budget limitations at colleges and universities are more pronounced than in the corporate world and this usually means a rapid development and deployment needs. But before we do that we usually allocate mutually agreed-upon time to do a scope assessment, set business priorities and road map.