CCITP February 5, 2015

Attendees: Ron Ried, Brent Phillips, Meredith Eliot, Emilia Noullet, Ari Harrison, Justin Suzuki, Steven Hart, Scott Griffith, Jason Armbruster, Milap Sharma, Debra Weiss, Patrice Thoresen, Jon Giltner, Laura Snyder, Larry Levine, Eric Galyon, Kerry Havens, Pregash Devasagayam, Grant Matheny, Jeff Hoskin, Nate Campbell, Justin Suzuki, Kim Elzinga, Aaron Mansfield, Jeff Grothe, Ilene Mesnard, Erik Hedl, Eric Heltne Introductions/Agenda Review (Brent Phillips, Ron Ried) 2015 CIO CCITP Kickoff (Larry Levine) – presentation appended

• Chancellor-level strategic intents: o Student success (retention) o Reputation o Revenue

• OIT’s major strategic intents: o Employee empowerment o Client satisfaction with services and resources o Client satisfaction with transactional support o Weighted average cost per service unit in lowest quartile among peers

• Projects: o ICT accessibility

New site up: http://www.colorado.edu/accessibility/ o Teaching Excellence

Be Boulder Anywhere (BBA) Desire2Learn (D2L)

o Constituency Relations CRM COE

o “The Paperless Campus” o Network

Wireless VPN

o Research Computing Data centers clusters, supercomputer, storage, data management, RC

networking, RMACC, RMCMOA • Daily Work

o Continuous Improvement o “Satisfied” or “Very Satisfied” response to reactive survey over 90% since May

2013 o Not just numbers

• Questions? o How do departments make sure that they’re making their digital signs accessible?

Contact Julian Kinsman (kinsman@colorado.edu)

Upgrade on HCM/Fin Upgrade (Milap Sharma, Jason Armbruster, Laura Snyder) – – presentation appended

• What is Elevate?

o Collaboration between CU System Administration and the campuses to enhance how the university does business

• Program status—all areas looking good (details available at http://www.cu.edu/elevate-cu-hcmfin-upgrade-project):

o Employee Services o Finance o UIS o Communications

• Data access has several components: o Data governance o Platforms (PS Lite, Microsoft Access, ODBC) o Timing o Reporting o Interface o Integrations

• Main contact for Elevate: Laura Snyder (laura.snyder@colorado.edu) Account Ownership for Secondary Accounts and Distribution Lists (Kerry Havens, Eric Galyon, Pregash Devasagayam) – presentation appended

• Group management: o Stops ad-hoc group management in Active Directory or derived from data feeds;

need for enterprise group management o Why now? Office 365 is the main driver

• Registry groups: o Sets of accounts that are grouped together based on common attributes o These groups can be used as “composite” groups for resource owners to make

authorization and access decisions. • Group ownership vs. management

o Ownership: a single person who is responsible for the group o Management: a person or group of people that can make changes to the

membership of the group o Identity management system will be the authoritative source of group ownership

information. Grouper will be source when Office365 migration is completed. • What does the team need from ITPs?

o They need to find the owners and managers of all secondary accounts in CUIdM o Jamey Chapin from OIT Communication will send a message with a link to a list of

accounts that need someone to claim ownership o If departments need migration help, contact Pregash Devasagayam

(Pregash.Devasagayam@colorado.edu). • IAM team will survey group owners to verify that it is still needed and the assigned

resources are still validated • Factionless accounts will be disabled and deleted after a period of time. Before that

happens, the team will make many attempts to identify to avoid getting rid of business critical accounts.

Update on Eduroam and Docusign (Ari Harrison) – presentation appended

• What is Eduroam? An international secure federated access service that allows members of participating institutions to access a secure wireless network.

o Went live at CU-Boulder on January 7th o Eduroam is available to all CU-Boulder faculty, staff, and students. Information on

how to connect: http://www.colorado.edu/oit/services/network-internet-services/eduroam

o Supported: Windows, Macs, Linux, Apple iOS, Android

o Secure W2 is our vendor; automated process for getting through the onboarding steps

o Responses to questions: Does not replace UCB Wireless

• Eduroam is more secure than UCB Wireless (which is not secure) • Docusign

o “Paperless” strategy designed to streamline paperwork across campus. o Developing as a service that will be supported by OIT to help departments improve

their paper and email-based workflows and conversion to using digital signature sand electronic workflows

o To access API for Docusign: connect with Mark Diekhoff (Mark.Diekhoff@Colorado.EDU)

Software Site Licenses (Justin Suzuki) – presentation appended

• Office 365 is available, with email migration coming soon o Students, staff, and faculty will have access to Office Pro Plus

While they’ll have it while they are here as students, they will no longer have access after their student status ends.

• Matlab now has a site license that allows students to install on personal computers • Adobe CS6 volume licensing ends at the end of February. Existing CS6 licenses will not

expire. o Acrobat Pro will continue to be available at the CLP rates ($68.64) o CS6 will be replaced by Creative Cloud

Decision & Action Item Review (Meredith Eliot)

• Brent will forward Greg Hoppes’ question about what data layouts will be used for payroll in the new system to Milap Sharma for follow-up

• ITPs: go through the google spreadsheet of group accounts after the communication link is sent out

• Justin will follow up re. Patrice’s question about activating multiple accounts of Office

CCITP 5 February 2015

Larry Levine

MAP OF IT CONSUMED BY CU-BOULDER

The IT services consumed by CU Boulder are performed largely, but not entirely, at CU Boulder

1

2

The IT services provided at CU Boulder are provided by OIT and other campus IT professionals, along a Continuum of IT Services. (http://www.colorado.edu/avcit/sites/default/files/attached-files/continuum.pdf)

MAP OF IT PERFOMED AT CU-BOULDER

3

4

Chancellor’s three major strategic intents:

1. Student Success (Retention) 2. Reputation 3. Revenue

Strategic Intents – SPE and the OPI

OIT’s four major strategic intents: 1. Employee Empowerment 2. Client satisfaction with services and

resources 3. Client satisfaction with

transactional support 4. Weighted average cost per service

unit lowest quartile among peers

5

Projects: ICT Accessibility Teaching Excellence

BBA D2L

Constituency Relations – the CRM COE “The Paperless Campus” Network (wireless, VPN Research Computing

Data centers, clusters, supercomputer, storage, data management, RC networking, RMACC, training (RMCMOA)

Strategic Intents (satisfying clients) Projects and Daily Work

Daily Work: Continuous Improvement “Satisfied” or “Very Satisfied” > 90% since May 2013 Not just numbers

THANK YOU

• DISCUSSION/QUESTIONS?

6

Program

CCITP

Feb 5, 2015

1

Agenda

2

Agenda Item

Topic 1 – Program Status

Topic 2 – Milestones / Major Activities

Topic 3 – Data Access

Topic 4 - Questions

University of Colorado Program Status

3

Summary Program

Status Schedule

Start Schedule

End Scope Resources Work

Product Comments

Employee Services Feb-14 Nov-15 G G G Finance May-14 Nov -15 G G G UIS Apr-14 Nov-15 G G G

Communications Feb-14 Nov-15 G G G

Program branding continues. Websites are “live”. http://www.cu.edu/elevate

University of Colorado Update - Integrated Program Plan

4

Year 2013 - 2014 2015 2016 Month Aug - Mar Apr May June July Aug Sept Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sept Oct Nov Dec Jan

Governance Tasks

ES / Finance Upgrade Project Initiation

Oracle Assessment Steering Committee / Leadership Team / Program Management

Program Approach

ES / Finance Requirement Definition / Fit Gap Design Design / Build Overlap Build Test Deploy

ES Upgrade Fit Gap and Conceptual / Functional Design Test Move /

Configuration / Test Script Creation

Unit / Regression Testing Systems Integration Test

(SIT 1 / SIT 2) Parallel Payroll Testing

UAT / Performance C

utov

er

Go-Live HCM/FIN Support

Taleo Software Selection / Contract Negotiations Requirements / Configuration Build / Test UAT Systems Integration Test (SIT 1 / SIT 2) Performance

Cut

over

Go-Live HCM/FIN Support

Finance Upgrade Fit Gap and Conceptual / Functional Design

Test Move / Configuration / Test

Script Creation Unit / Regression Testing Systems Integration Test

(SIT 1 / SIT 2) UAT /

Performance Cut

over

Go-Live HCM/FIN Support

UIS Design / Implement Environment Strategy / Technical Analysis of Existing Customizations Technical Design / Build Systems Integration Test

(SIT 1 / SIT 2) UAT /

Performance Cut

over

Go-Live HCM/FIN Support

UIS Interfaces / Report / Portal Analysis Interface / Report / Portal Retrofit

Update CIW / Portal

Test CIW / Portal

Config / Test Connectivity (Test Move 3) C

utov

er

Go-Live HCM/FIN Support

Major Milestones

Func

D

esig

n Sp

ec

Pr

og.

Bas

elin

e

Tech

D

esig

n Sp

ec

Initi

al

Bui

ld

Com

pl.

SIT

Com

pl.

TRN

C

ompl

.

Cut

over

Go-Live HCM/FIN Support

CU / Oracle Test

Moves Test

Move 1 Test Move 2

Test Move

3

Technical Upgrade Oracle Solution Center HCM/ Finance

Comm / Outreach / Training

Campus Advisory Boards / Campus Meetings Campus Training (Delivery)

HCM Finance Data Consumers

• The upgrade includes changes to the underlying table structure of Finance and HCM systems.

• This means that the data prior to the upgrade will differ from the current format (the upgrade completes early November, 2015).

• You must make the appropriate changes to your data integrations during the upgrade to minimize interruption to your data extractions.

5

6

Data Access

Data Access

• Data Governance • What does this mean?

– Be sure to poll your users/departments to find out what they may doing that uses PeopleSoft data in other ways (data mining, analysis, entry creation, etc.)

• Includes: – PS Lite – Microsoft Access – ODBC

• Not related to the project; timing is the same though!

Data Access

• Reporting – PSQUERY – COGNOS

• MFIN • Query Studio

– Delivered Peoplesoft

• Integrations – Data Governance Document – Data Management Group – Approval/Access

Data Access Decision Tree

? 10

Group Management CCITP - February 2015 Kerry Havens, Pregash Devasagayam, & Eric Galyon

Why?

● Why group management? o Ad-hoc group management in the Active Directory

or group management derived from data feeds has grown into a need for enterprise group management

● Why now? o The main driver is the migration of distribution lists

and mail-enabled security groups to Office365

What are “Registry” groups?

Sets of accounts that are logically grouped together based on common attributes from source systems. For example, groups based on job code, department, or course enrollment. These groups can be used as “composite” groups for resource owners to make authorization and/or access decisions. The interface for managing these groups is called “Grouper”.

High Level Grouper Conceptual Model

Group Ownership vs. Management

Ownership: a single person that is responsible for the group (establishing a purpose for the group, a contact if there are questions or problems regarding the group, etc.) Management: a person or group of people that can make changes to the membership of the group

Group Ownership

The Identity Management System (CUIdM today, OIM tomorrow-ish) will be the authoritative source of group ownership information. This also ensures there are no name conflicts with other mail-enabled objects.

Group Management

Grouper will be the authoritative source for group management. Because Office365 is “read-only”, distribution list management has to be managed by tools that connect to the “on-prem” Active Directory. These tools consist of ADUC (rhymes with yuck) or Grouper.

What’s this got to do with me?

We need you! As part of the OIM and Office365 projects, we are actively trying to identify the owners (and managers) of all secondary accounts in CUIdM… which includes distribution lists and mail-enabled security groups in Active Directory. Yay!

What’s this got to do with me?

Especially for our ITP friends, next week, Jamey Chapin will be sending out communication regarding which accounts (including DLs and SGs AND resource accounts) that need to “claim ownership”. The email will include a link to a Google spreadsheet with every secondary and group account and its owner (known or assumed).

What’s this got to do with me?

Your mission, if you choose to accept it, is to go into that Google spreadsheet, search for your identikey or a secondary account that you should own and make a comment on that row to “own” it. This the poorest of the poor man’s IdM. :)

The next steps

After February 20th, I will close the access to the spreadsheet and start sending out surveys to the “assumed” owners for those accounts that were not marked as owned by you. You may receive several survey invites depending on how many accounts you are associated with.

The next steps

After that survey closes, we will be sending out another survey to all that have “claimed ownership” of their accounts, asking them to verify that it is still needed and the resources assigned to it are still valid.

The next steps

For the factionless accounts, they will be disabled and then deleted after a period of time. Throughout this entire process, we will be sending as many targeted and broad emails as necessary to ensure we do not delete business critical accounts.

Questions/Comments

Kerry Havens kerry.havens@colorado.edu Pregash Devasagayam pregash.devasagayam@colorado.edu Eric Galyon eric.galyon@colorado.edu

Eduroam-Secure Wireless

What is Eduroam?

The Eduroam service is an international secure federated access service, allowing for members of participating institutions to access a secure wireless network when on the CU-Boulder campus or one of the hundreds of other institutions in both the United States and world-wide.

Where is Eduroam available?

In addition to the University of Colorado-Boulder campus, Eduroam is available to all our faculty, staff, students and other existing Eduroam customers across hundreds of educational and research organizations world wide and is now available in over 70 countries and still growing.

Eduroam Connectivity

CU Boulder faculty, staff, and students need to install software from the following website link: http://www.colorado.edu/oit/services/network-internet-services/eduroam

Due to the diversity of devices and operating systems that exist on campus, such as CU owned laptops, desktops, as well as personal devices, such as cell phones, tablets, etc. the decision was made by the project team that the following operating systems would be supported: Windows Macs

Linux Apple iOS Android

Eduroam Features

Secure, encrypted wireless connection

Available, regionally, nationally and globally across hundreds of institutions, and can be accessed via hundreds of Wi-Fi hotspots that are growing rapidly across the world

Compatibility across multiple operating systems and devices

Access to campus resources

Who can get Eduroam?

It is available to all faculty, staff, students and other affiliates of the CU Boulder campus who maintain an identikey as well as visiting faculty, staff and students from other participating institutions.

When did it go live?

Eduroam was soft launched on January 7th 2015 across 99% of all access points located on both main and east campus.

Post Go live Update Adoption Rate According to the latest data provided by Tyler Schoenke in Security

Personal devices such as smartphones, and tablets: 56 Windows or OSX devices such as laptops and desktops: 61

It is obvious that this adoption rate is rather low, but that is due to the soft launch nature of the rollout, so that the team would have ample time to work out the bugs of the system in its initial rollout.

The Communications/Marketing team composed of Jamey Chapin, and Greg Stauffer have already done a great job of communicating to the public about the official rollout. They are currently in the process of implementing their more aggressive phase of outreach that will hopefully increase the adoption rate substantially over the next few months.

Post Go Live Update Issue Resolution Trouble Ticket update:

As of 2/2/2015 the amount of trouble tickets that have been issued that have dealt with some form of troubleshooting for Eduroam has been consistent with expectations. Based on data provided by Danny Cantu/Lecarla Gilmere of the ITSC, they have received 30 incidents, since launch, with 24 having been resolved, or closed, and 6 still currently in progress. The issues have been as diverse as user experience with the installation process, to possible weak ssid signal, NAC registration or VPN connection from outside of the country. Led by Lecarla Gilmere, and Jason Henley, their GDS and DDS staff have done a

great job of troubleshooting issues that have been raised by customers, and providing quick and effective resolution for most of them.

Credit Sole credit for the success of the Eduroam project go to my fellow team

members identified below, as well as the patient assistance provided by both Secure W2 and Impulse Point staff throughout the life of the project. Without their considerable effort, expertise, extraordinary patience and creative troubleshooting, the success of this project and the Go Live experience would not have been possible. Thank you to the following people for their enthusiasm and ingenuity and for contributing to the creation of this presentation:

Security Networking (NEO)

ITSC Communications

Tyler Schoenke Max Lopez Lecarla Gilmere Jamey Chapin John Scudder Robert Roybal Jason Henley Bob Schwander Dan Jones Majid Abdullah Danny Cantu Rochelle Scott

Ray Baum Jeeg Salbian Greg Stauffer David Wood ITSC DDS/GDS

Staff-Testing

Boulder Campus Digital Signatures and Workflow DOCUSIGN

Project Overview

In a dual effort to limit environmental impacts, and minimize costs and time, CU-Boulder has chosen to execute a “paperless” strategy. It has stated its goals to expand the uses of electronic methods for official university business transactions.

This project will create an OIT service to support departments in the analysis of existing paper and email based workflows and the subsequent conversion of those processes using supported digital signature and electronic workflow solutions.

Scope

Business Analysis Workflow creation:

CU-Boulder OIT staff will perform business analyses of existing workflows and workflow needs within campus departments, and designing and implementing efficient electronic processes which satisfy those needs.

Consolidate Processes: The focus of the analyses will be to identify common or similar needs which

represent opportunities to consolidate processes and create single solutions which serve broad needs, and to maximize use of existing, established systems.

Transfer and storage: Transfer and storage of signed documents to established ERP systems such as

PeopleSoft Finance, PeopleSoft HR, Singularity Document Management currently utilized for Boulder campus processes or campus maintained systems where utilizing ERP systems is not appropriate.

Project Approach/Status Update # Steps 1 Review lessons learned and guidance from HR pilot 2 Identify business requirements, accountability and

responsibilities for Docusign service and create work breakdown structure

3 Develop required service elements including service policies, support processes, and communications plan

4 Adjust Docusign service configuration based on lessons learned from pilot and as needed to support other service elements

5 Create Docusign Singularity interface 6 Finalize initial departmental administrators 7 Create transition guide 8 Implement communications plan 9 Train initial departmental administrators 10 Update Service Catalog

How does it work? Send The whole process of sending documents in Docusign can be boiled down

into three simple steps:

1) Upload your documents Docusign is compatible with Microsoft Word, PDF and other common document formats

It can be used on your own computer, or on cloud sharing sites such as OneDrive, Google Drive, Box, and Dropbox or other sites that are used by faculty and staff on campus.

2) Add who needs to sign The user just needs to add names and email addresses of their signatories and other

recipients. The application even provides the functionality to define the workflow order of signing as well

3) Place tags and send

How does it work? Sign The whole process of Signing in Docusign can be boiled down into three

simple steps:

1) Click link in email

2) Follow Docusign tabs

3) Finish

How does it work? Manage The whole process of Document management can be boiled down into

three simple steps:

1) Real Time Status

2) Save functionality is automatic and secure

3) Ease of use to administer

Credit/Update

At this time, the team is leveraging the considerable work that Mike Murray has done on behalf of Human Resources. He is providing his in-depth knowledge of Docusign and the lessons learned from his experience of rolling it out to Human Resources to our project and had provided valuable guidance.

The Business analysis effort is currently being capably executed in tandem with Kevin Notheis leading those efforts and helping transition those responsibilities off to OIT’s new Sr. Business Analyst, Mark Diekhoff.

The Business requirements documentation is being finalized by both of them at this time. Once it is reviewed, and approved by relevant stakeholders, the documentation will serve the basis for the work breakdown structure and project scheduling and execution efforts that will be undertaken by me.

Office 365

• Exchange Migration is being tested and applied to OIT

• Provisioning of licenses is underway • Students, Staff, and Faculty will have

access to Office Pro Plus

Matlab

• CU Boulder now has a site license that allows Matlab to be installed on student

personal computers

Adobe CS6

• Volume Licensing of CS6 is going away at the end of February • Existing CS6 licenses are permanent and will not expire

• Acrobat Pro will continue to be available at the CLP rates ($68.64) • CS6 is being replaced by the Creative Cloud

• For more information go to: http://www.colorado.edu/oit/creative-cloud-faq