Katarina Valalikova

Infrastructure Provisioningin the context of organization

k.valalikova@evolveum.com@KValalikova

Agenda

● Cloud, infrastructure, provisioning, OpenStack

● Identity management

● Infrastructure management

● Infrastructure and Identity Management

Clouds

Cloud

Hardware specialists

Operation team

Maintenance

Money

Datacenter

Robustness and scalability

● Virtual machines

● Bare metal

● Orchestration

● Containers

● ….

Heat

Neutron

NOVA

Magnum

Heat

Neutron

NOVA

Magnum

Users

???? ?

?

?

??

What about the users?

How to automate user provisioning?

● OpenStack Keystone

– Tenant/Project, User provisioning

– User tenant assignment

– Accesses for Virtual Machines

● Automation in the context of organization?

– Reusing of information

● Accesses and possibilities inside VirtualMachine

DB Application

DB

HR

IDM

LDAP

UNIX

Who am I? What do I do?

● Company Evolveum

● Java Developer & Identity Engineer

● IDM midPoint

– Provisioning

– Deprovisioning

– Identities

– Groups

– Projects

Who am I? What do I do?

● Company Evolveum

● Java Developer & Identity Engineer

● IDM midPoint

– Provisioning

– Deprovisioning

– Identities

– Groups

– Projects

DB Application

DB

HR

IDM

LDAP

UNIX

Education

Insurance

Technical

Experiences

● Different companies

● Different areas

● Different requirements

prc = new PropertyResolverConverter(Application.get().getConverterLocator(), Session.get().getLocale()); - if(object instanceof String){ + if (object instanceof String) { String label = (String) object; String key; - if (label == null || label.trim().equals("")){ + if (label == null || label.trim().equals("")) { PropertyResolver.setValue(expression, getInnermostModelOrObject(), null, prc); } else { + if (!isStrict) { // set default value from input and overwrite later if key is found + PropertyResolver.setValue(expression, getInnermostModelOrObject(), label, prc); + } for (LookupTableRowType row : lookupTable.getRow()) { if (label.equals(WebMiscUtil.getOrigStringFromPoly(row.getLabel()))) { key = row.getKey(); - PropertyResolver.setValue(expression, getInnermostModelOrObject(), key, prc); } } } - } else if (object == null){ - PropertyResolver.setValue(expression, getInnermostModelOrObject(), object, prc); + } else if (object == null) { + PropertyResolver.setValue(expression, getInnermostModelOrObject(), object, prc); } } @Override - public void detach() {} + public void detach() { + } }

Who and what?

● Technical view

prc = new PropertyResolverConverter(Application.get().getConverterLocator(), Session.get().getLocale()); - if(object instanceof String){ + if (object instanceof String) { String label = (String) object; String key; - if (label == null || label.trim().equals("")){ + if (label == null || label.trim().equals("")) { PropertyResolver.setValue(expression, getInnermostModelOrObject(), null, prc); } else { + if (!isStrict) { // set default value from input and overwrite later if key is found + PropertyResolver.setValue(expression, getInnermostModelOrObject(), label, prc); + } for (LookupTableRowType row : lookupTable.getRow()) { if (label.equals(WebMiscUtil.getOrigStringFromPoly(row.getLabel()))) { key = row.getKey(); - PropertyResolver.setValue(expression, getInnermostModelOrObject(), key, prc); } } } - } else if (object == null){ - PropertyResolver.setValue(expression, getInnermostModelOrObject(), object, prc); + } else if (object == null) { + PropertyResolver.setValue(expression, getInnermostModelOrObject(), object, prc); } } @Override - public void detach() {} + public void detach() { + } }

Who and what?

● Technical view

● Management view

prc = new PropertyResolverConverter(Application.get().getConverterLocator(), Session.get().getLocale()); - if(object instanceof String){ + if (object instanceof String) { String label = (String) object; String key; - if (label == null || label.trim().equals("")){ + if (label == null || label.trim().equals("")) { PropertyResolver.setValue(expression, getInnermostModelOrObject(), null, prc); } else { + if (!isStrict) { // set default value from input and overwrite later if key is found + PropertyResolver.setValue(expression, getInnermostModelOrObject(), label, prc); + } for (LookupTableRowType row : lookupTable.getRow()) { if (label.equals(WebMiscUtil.getOrigStringFromPoly(row.getLabel()))) { key = row.getKey(); - PropertyResolver.setValue(expression, getInnermostModelOrObject(), key, prc); } } } - } else if (object == null){ - PropertyResolver.setValue(expression, getInnermostModelOrObject(), object, prc); + } else if (object == null) { + PropertyResolver.setValue(expression, getInnermostModelOrObject(), object, prc); } } @Override - public void detach() {} + public void detach() { + } }

Who and what?

● Technical view

● Management view

● Business view

Group A

Group C Group B

Is IDM sufficient?

● Companies with big fluctuation

● Quickly growing companies

● Companies providing serviciesfor wider population

● Users, Account, Projects,

● Organization units, Services,Groups, Infrastructure,...

What is the hardest thing for me?

● Interacting with people

● Get agreement

● Get help (whithin a reasonable time)

● Effectivity

● Infrastructure settings

● Application installation

● Gain accesses and permissions

Is there a way how to solve it?

● midPoint and OpenStack together?

● Can it work somehow?

● Are there any advantages?

● Positive impacts?

Web Application

HR

IDM

LDAP

UNIX

Use case – New employee

Use case – New employee

HR

Use case – New employee

HR

IDM

Use case – New employee

DB Application

DB

HR

IDM

LDAP

UNIX

Use case – New project

DB Application

DB

HR

IDM

LDAP

UNIX

Project

Use case – New component

OpenStack

DB Application

DB

HR

IDM

LDAP

UNIX

Project

MidPoint and OpenStack together?

● Connector

● Run/Stop VM

● User management

● Tenant Management

● User (in Role) for Tenant

ConnectorDB

HR

IDM

LDAP

UNIX

Demo

● New Employee

● New Project

● midPoint – OpenStack integration

● Different views

Pre-configured demo resources

● OpenLDAP

– User management

– Group management – based on project

– Group membership management

● OpenStack

– User management

– Tenant management

– User to Tenant (in Role)

Demo Organizational Structure

● Project

– Create new tenant in OpenStack, run/stop virtualmachine

– Define project structure – LDAP groups

● Organization

– Different divisions of organization

● Cooperation

– Partners, Customers,...

Demo Roles

● LDAP Roles

– Create users

– Create groups

● OpenStack Roles

– Tenant

– Virtual Machine

Demo Resources for new VM

● LDAP – installed inside new VM

● Unix – users to the VM

What are the benefits?

● One tool

● All about organization under one roof

● Global view of organization

– Resource

– VMs

– Users

– Projects

– ...

One tool All information under one roof

Thank you for your attention

@KValalikovak.valalikova@evolveum.com

Summary

● MidPoint and OpenStack

● Reusing existing information

● Global view of organization

● Automation of some processes

● Security

● Flexibility

● Adaptability

● Reliability

Web Application

HR

IDM

LDAP

UNIX