* Searching for a provisioning/de-provisioning system for NASA
I spent a fascinating three days last week in Washington, D.C. where I was invited to be on an external review team for a large-scale identity management project at NASA.
The project involves rolling out an agency-wide, LDAP-based directory system along with specialized directories for sensitive (in the privacy sense, not the classified, security sense) data and a public-facing directory with a small subset of data to facilitate communication. Additionally, an account management system with provisioning and de-provisioning features is being introduced. It’s this latter project I want to talk about today.
In the private sector (i.e., corporate enterprises), deciding the kick-off point for a provisioning service is almost a no-brainer: you tie it to the human resources department or to the payroll system because these are the first areas of the organization to “touch” a new employee.
But NASA – like most federal organizations and lots of state, county and municipal organizations – has both employees (part of the civil service system) and contractors (personnel of an outside organization doing work for the agency). NASA also has a huge number of collaborators and, for want of a better word, “guests”: researchers from academia, R&D personnel from commercial enterprises, even entire elementary school science classes.
Each of these categories, as well as numerous others, enters the system through a myriad of entry points. The agency can’t tie to payroll, which is run through another agency, or human resources, which doesn’t track most of the people accessing NASA programs and services. There’s no single point at which all those desiring an account on the NASA network system have to pass through.
The closest thing to a universal entry point is the physical access badging system. Everyone who needs or wants to enter a NASA facility has to have a badge. Civil servants and most contractors have badges. But there’s a large minority of people who access NASA’s computer programs, data and systems who never physically enter a NASA facility. These “virtual visitors” range from school children enrolled in science courses thorough researchers in both commercial and educational organization up to representatives of other U.S. government agencies as well as representatives of foreign space programs.
NASA is still looking for a way to totally automate everyone’s entry into the system. It has been working on it for a couple of years and looks to be making progress but realistically may never be able to automate the entire process of enrollment for all those needing an account on the agency’s computer systems.
The lesson for the rest of you is that this isn’t holding the project back. Procedures are being put into place to handle those cases without an automated entry point with a manual system fully documented and structured to mimic the automated system so that – should automation become possible – the changeover can occur rapidly. If you have to wait until all the tees are crossed, you might never get within sight of the goal you’ve set.
While this doesn’t meet with the advice I usually give about rolling out a fairly simple, easy to implement application or service which touches and helps many people, the effect is the same – the users (and the bosses) see the result sooner rather than later. Hopefully they’re pleased with the result and fund the rest of the project or projects.
There was another fascinating aspect to the review I was doing, and I’ll get to that in the next issue.
