DAASI International provided us with very professional and competent support in our cooperation project with a joint Shibboleth IdP and IdP proxy. We are very happy with the straightforward collaboration.
We are very happy. With other service providers similar projects require more communication and legwork on our part for clarification. DAASI International is well versed in their area of expertise and acts professionally.
Thanks to the good collaboration with the employees of DAASI International, we could quickly get acquainted with the IdMS „midPoint“. This saved us a lot of time on trial and error, especially in regards to more complex tasks.
The recommendation to choose DAASI International for the implementation of Shibboleth and a two-factor solution (PrivacyIdea) has fully paid off for us, as the setup was accomplished quickly and well – and even below the projected budget. We are also very happy with the ongoing support.
With the professional help of DAASI International, especially of support representative Martin Haase, we were able to quickly and seemlessly implement the Shibboleth IdP with two-factor authentication as well as the incorporate several service providers, i.e. the DFN-AAI.
If we ever needed help or had questions (almost never), DAASI International was always happy to help and quick in their reactions.
In the context of a short-term ressource shortage we got quick, uncomplicated and very experienced help by DAASI International and could also count on DAASI International as reliable partner subsequently.
The identity management system of the Nikolauspflege had become outdated. Hence, they decided to replace the old system with a more modern standard solution. In addition to the outcome of a requirement analysis, it was their own first-hand experience with midPoint as well as the close relationship of DAASI International and the developer Evolveum, that made them opt for the open source product midPoint.
Responsibilities, such as group management, should be logically distributed. In order to ensure IT security, data privacy, as well as in adherence to the BSI (German Federal Office for Information Security) guidelines, the four-eyes-principle was implemented. The goals of the project included reducing the workload for administrators, speeding up processes by introducing direct user responsibility, as well as improving the user experience. Moreover, it was especially important to design a fully accessible user interface.
One of the biggest challenges in this project was to replace the individual programming, which had been worked on for years, and which lacked proper documentation, with off-the-shelf product, as well as to recondition inconsistent staff data.
With the help of DAASI International, or more precisely of Mr. Füller and Mr. Lukrafka, we were able to eventually overcome these challenges despite multiple obstacles.– Johannes Glenz, IT-System Administrator
The target systems were filled by two different staff management systems. Both were connected to a separate IdM system with which user data, and permissions were provisioned into separate Active Directory instances. In some cases, users could receive an account in both domains. For conclusive identification, it was crucial to be especially careful with data harmonisation, as well as the integration of Powershell scripts for provisioning. The temporary withdrawal of permissions – important for the realisation of the test modus – as well as the subsequent reassignment should happen automatised with the help of roles.
In order to follow specifications different administration permissions on different levels, as well as different key user roles were implemented. The four-eyes-principle was established via a workflow for permission requests. midPoint supports full accessibility by default. The few translations gaps that existed, were closed by DAASI International using specialised extensions. In order for this project to be successful it was crucial to test the provisioning processes with real data before switching the system into productive mode. The tests uncovered inconsistencies, which also led to an improvement of data quality in the staff systems. Finally, the databases could be merged into one IdM system, which allowed for automated cross-domain permissions, and overall made them simpler and transparent.
The commission was to to develop a web portal based solution for the registration and administration of client users, thus enabling them to centrally register for selected applications and to manage their own data.
The design of the portal called for an on-premise solution that would be DSGVO-compliant and provide typical self-service functions, i.e. such as account sign-up, password change and the possibility of applying for additional services. Additionally, it was requested to enable the interaction with the pre-existing LDAP server, which provides authorisation data for external users.
In a friendly and professional cooperation with the competent team of DAASI International, we ended up with a solution for a self-service portal which has been an enormous help due to its flexibility, far beyond its originally intended purpose in a small project.
– General Directorate, Staatsbibliothek zu Berlin
Projects as this are part of the basic service portfolio of DAASI International.
For a sustainable solution, the system was supposed to be set up in a way so that administrators can easily integrate further applications without having to consult with external service providers to adjust certain the configuration.
DAASI International set up the portal on the basis of LUI, a freely customisable module of the IAM framework didmos. It consists of two components: a self-service as well as an administration portal for the administration of external users. Here, didmos LUI serves as the intersection between web application and OpenLDAP server.
The main focus of the GESIS – Leibniz Institute for Social Sciences project was their connection to the DFN-AAI and the simultaneous establishment of their own authentication infrastructure. For this purpose, a Shibboleth Identity Provider was created which receives its data from an OpenLDAP-based directory service. Through the linkage to the Active Directory, an automatic filling of the user information into the directory service was achieved so that password changes of the users are now synchronised directly. This way, the GESIS employees are allowed a single sign-on for their applications. The connection to the DFN-AAI allows GESIS to provide its own services to the users of other organizations as well as to make the offers of the other members of the DFN-AAI available to their own users. Thanks to the great experience of DAASI International, the project was realised within a few weeks.
The establishment of an Active Directory (AD) for the Max Planck Institute for Solid State Research was carried out with the aim of continuing to use the existing OpenLDAP server as a primary system for users and group members. A Samba server configured as an NT4 domain controller has been connected to these so far, which should be replaced by an AD to be built during the project. In order to allow users to change their password for all applications and systems at the workstation, a synchronisation of the password from the AD into the OpenLDAP directory was established.
In addition to the didmos Pwd Synchroniser, the ETLflow didmos module, which is configured so that a complete synchronisation of the data can be carried out at any time, should the target data be incorrect. As a permanent solution, the didmos Provisioner ensures that users can quickly read and transfer attribute changes from the OpenLDAP server to the AD, which makes a permanent update possible.
The Max Planck Institute was interested in setting up the AD on its own using a concept developed by DAASI International. In addition to the commissioning of the concept, telephone support was provided during implementation. As a result, the Max Planck Institute is now in a position to independently manage the infrastructure being built. Thanks to the close cooperation and independent implementation during construction, the AD can always be adapted to new needs.
The Justus Liebig University Gießen commissioned DAASI International to optimise the connection of the JLU to the central placing procedure of the foundation for university admission. For this, a connector was developed that links the Justus Liebig University to the Dialog-oriented Service Procedure (DoSV) in order to transfer the applicant data from the central service center to the local system at the smallest possible time intervals. Thus, the status changes of the various applications are also available, always locally updated in the HIS software used. After two tests, in which both the course of the applications as well as the interplay with other universities were examined, the system could be productive with a degree program on June 1, 2015 and has been available since then for the application for a place to study.
European Space Agency (ESA)
The assignment was to provide an IDaaS (Identity as a Service) platform to offer account management as well as Single Sign-on (SSO) for commercial companies operating in ESA member states to access all Earth Observation Data and Applications with a single Identity.
Ruhr University Bochum (RUB)
The Ruhr-University-Bochum (RUB) needed a new IdM system as their self-developed solution had become outdated.
Challenge: Replacing a self-developed IdM system while maintaining the highly customized functionality.
Process: Setting up multiple instances of midPoint to first compliment the existing system, and slowly start the transitional period.
Outcome: The university now runs both, midPoint and their self-developed system. Ultimately, midPoint will fully replace the old system.
Let us know how we can assist you.
