In addition to the web-based certification system, there are a number of business systems such as cartoons, OA office systems, teaching systems, personnel systems, and unified identity identification platforms."Uniform account number, one authentication, multisystem availability"The technical means of landing this matter.
Target audience: One cartoon, OA, teaching system, unified identification platform
A cartoon system is the most typical of campus network certification interfaces. A cartoon carries a student’s school identity (school number, name, faculty, card status, etc.), and a campus network certification system allows students to authenticate their access to a campus card (or calibration number) and a calibration system calls a cartoon system to verify cards and identities and achieve uniform identification; while a cartoon system also provides for a campus network fee (a student who has a loop memory or mobile phone end-up to a campus network account number) that will allow a uniform charge to be made. The OA office system and personnel systems are common interfaces for the certification of teaching staff. The educational staff accounts are maintained in the OA or personnel system, while the certification system is connected to the Internet with an OA account or domain account number, which is automatically synchronized by adding or deleting the account number. The teaching and learning workers system is the authoritative source of student accounts. The UID is a central system that many universities have built and is responsible for the uniform identity of their own systems. According to the product information of NatShell V7, the system supports interface with any third-party data sources (a cartoon, OA, a database of third-party arbitrary), LDAP authentication (in conjunction with Windows domain certification) and various authentication methods such as account passwords, micromails, APPs, etc., which provide the technical basis for campus network integration with third-party systems.
Reconciliation: interface docking, LDAP docking, data synchronization and uniform authentication
The interface between the campus network certification system and third-party systems is mainly several ways. Interfaces are most flexible. API interfaces (usually HTTP or database interfaces) are open to a cartoon, OA, etc., and authentication systems call for interface identification when users authenticate them or for data interaction (e.g. fees, opening accounts, cancellations) when operations are performed. For example, when a cartoon docking is carried out, students enter card numbers, the authentication system calls a cartoon system interface to validate card numbers, release and record after validation. LDAP docking applies to interfaces with Windows or the Unified Identification Platform. The LDAP is a standard directory access protocol, and the UID platform or AD domain usually supports LDAP, which transmits authentication requests to the LDAP server for account identification codes, and then issues network privileges based on properties returned by LDAP (user group, department, etc.). The advantage of LDAP docking is that it is standard, common, fast-track, and the disadvantage is that field mapping requires mutual recognition (e.g. username format, group structure in the AD domain). Data synchronization is a tool to synchronize third-party system user data (accounts, names, departments, status) into the user base of the authentication system through time missions or messages. For example, daily synchronization of student data from the teaching system, automatic opening of accounts for new students and automatic sales for graduating students. The advantage of data synchronization is that it is simple and non-dependent on real-time interfaces, with limited synchronization time (usually T+1 or hour level) and data conflicts need to be addressed (e.g. whichever of the two account numbers is inconsistent). The UIF serves as a campus-wide certification hub, with systems (including the campus network accreditation system) integrated and students can access multiple systems once they log in. In this model, the UCN certification system transmits authentication requests to the unified platform, returns the user identity to the platform after validation, and certifies that the system issues network privileges. In actual projects, these are often combined: one card of universal interfaces for real-time authentication, teaching systems for the synchronization of data for account life cycle management and unified identity platforms for LDAP or OAuth interface certification.
Boundary conditions of the interface: interface open, field mapping, alignment conditions and deployment boundaries
The same identity interface sounds good, but there are a number of border conditions to be confirmed when you land."V7 has relevant capabilities, but availability depends on the interface being open, field mapping, configuration conditions and deployment boundaries". Specifically, several questions are identified. First, whether the interface is open: whether an interlinker provides interface documents, whether OA allows external access to the system and whether the database of the teaching system is accessible (many schools do not have direct access to the database for security reasons). If the interface is not open, the docking scheme will need to be adjusted——For example, to export imports using data or to abandon a real-time docking. Second, whether the field can map: a cartoon card number format, OA ' s manual code, and the coding of teaching systems, is consistent with or capable of mapping the system ' s account numbers. Where the field map does not match, conversion rules (e.g., school add-on zero, card prefix) need to be validated in the interfaces. Third, the authentication process connection: details such as tips, log lock logic, password strategy (school uniform cryptographic policy or individual systems) need to be clear after the docking. Fourth, the interface and scheduling: cross-system interfaces require a combination of technical teams from both sides. Interfacing requires time for interface debugs, problem check-ups, regression tests. Schools should reserve the config window when planning projects. Fifth, data security and rights: authentication systems access data from a cartoon, pedagogic, etc., and need to clarify the scope of data (reading or writing alone, visible fields), whether data transmission is encrypted, sensitive data (identity number, mobile phone number) are dissensitive. These border conditions need to be clearly identified with the business systems manufacturers before the project starts, otherwise the design programme may be rendered unattractive by reliance on an unconnected system.
Proceeds from a single identity docking and common problems
For users, the integration of a campus network certification system with a third-party system is evident. For users, students and teaching staff need not repeat authentication information in multiple systems, access to all authorized web resources and services is possible through one certification, which not only simplifys the authentication process, improves user experience, but also contributes to the central management and efficient use of campus network resources. For operators, when a uniform number is managed, opening accounts, paying for payments, password replacements etc. can be automated, so that the carrier no longer needs to maintain multiple sets of account codes. However, there are common pits for a single identity docking. First, the post-record authentication relies on third party systems: if a cartoon system or a unified identification platform fails, campus network certification may be affected and therefore a demotion option is usually considered when designing——Whether the third-party system allows local accounts to continue authentication when they are not available. Second, timeliness of account synchronization: synchronizing student data from the teaching system; if it is not synchronized in time, there may be cases where access cannot be certified on the day of the start of the new school year and a steady synchronous link should be ensured before the beginning of the school season. Third, accuracy of the post-graduation saleser: if the student ' s account is not sold in time, there are both systemic resources and security concerns that require identification of the trigger mechanism for the seller (automated or manual processing). The fourth is coordination of multiple password strategies: campus network accounts, a cartoon, OA accounts need to be clear if the passwords are not consistent, and users need to have their systems coded or synchronized to other systems. The fifth is data consistency: where two account numbers do not match (e.g. when a school number has been changed in the teaching system but the authentication system is old or old), there is a need to identify which system should be used as an authoritative source and to establish a data reconciliation mechanism. These issues should be considered at the project planning stage so that they do not go back online again.
Options for the solution
Options for a uniform identity interface of the campus network certification system could be based on an inventory of the current situation in schools.——What is an existing cartoon, OA, teaching, unified identity platform and how its respective manufacturers and interfaces are open; and what needs are identified——The purpose of the docking is to harmonize certification (student exemption, one certification) or management (account life cycle automation) or charging (school network contribution combined with a cartoon); then to select the docking mode——Real-time authentication needs are docked with interfaces, account management requirements are synchronized with data and the access to a single identity platform is uniform for all schools; final confirmation of boundary conditions——Interfaces are open, field mapping, interface windows, data security, and the feasibility of docking each dependent system is clearly identified before a solution is determined. If a system cannot be connected (the interface is not open and fields cannot be mapped), an assessment is made of alternatives: alternative authentication (e.g. text message authentication for one cartoon authentication), account number conversion for real-time docking or adjustment of demand (e.g. no uniform fee is required for the time being, first uniform certification). Based on the product information of NATSHEL_BRAND V7, the system supports a cartoon, OA, any third-party database interface, LDAP docking and certifications such as micro-mail, APP, which provides multiple options for campus network uniform identity docking, but which path is dependent on the opening of interfaces and connectivity conditions across business systems.
The campus network is connected to a single identity system for third parties such as a cartoon, OA, pedagogic system and the Unified Identification Platform."One account went all over the school."The interfaces cover systems such as a cartoon (uniform identity plus uniform fees), OA/personnel (teacher account), teaching/studyer (student account life cycle), and the Unified Identity Platform (uni-school-wide certification); they are connected by interface, LDAP docking, data synchronization and unified authentication, which is used in physical project combinations. The site-to-place matching programmes need to confirm border conditions such as open interfaces, field mapping, bonding conditions and deployment boundaries, taking into account common problems such as downgrading schemes, synchronization of accounts, accuracy of graduating vendors in case of third party system failure."Any system can go straight and forth."。