Identity and Access Management Discussion Group

Participate in this Group

Search This Group

March 13, 2013 | Dean Woodbeck

Today's IAM Online will feature three campus case studies of Grouper, the community-developed access management software. Presenters include the University of Wisconsin-Madison, the University of Montreal, and Carnegie Mellon University.

3 pm ET today. For details: www.incommon.org/iamonline

-----

Dean Woodbeck

Program Manager, InCommon

Internet2

woodbeck@internet2.edu

734-352-7007

www.incommon.org

1 Comment

Educause attribute configuration and Federation

March 12, 2013 | CJ Mizner

Hello,

Does anybody have any successful documentation on configuring ADFS 2.0 for Federated login with Educase? We have imported the Relying Party Trusts from InCommon (and configured federation), and I found the reference below to the attributes but I have yet to find any documentation for those of us just starting out.

https://www.educause.edu/idp_setup/info

Thank you for any additional information you can provide.

CJ Mizner

Information Management & Technology

University of Northern Colorado

Campus Box 19

Snyder Hall, Rm 092

Greeley, CO 80639...

0 Comments

CAS and OpenSSO/Openam

March 11, 2013 | Bryan Wooten

I will throw in my 2 cents. My first foray into CAS was integrating it with OpenAM (or whatever SUN called it back then). I modified CAS to accept OpenAM tokens (used the x509 handler as a template). We also had applications that accepted PeopleSoft tokens and CAS tokens. I hated it from an application developer perspective. I believe it is wrong headed to have applications serve 2 masters. Single logout is difficult enough, this makes it impossible. We now have have our SSO all tied to CAS authentication. PeopleSoft uses CAS, custom in-house WEB applications use CAS, 3rd party apps use CAS, our Shibboleth IDP defers authentication to CAS. My belief and recollection is that OpenAM can be configured to use CAS for authentication. -Bryan On 3/11/13 4:17 PM, "William G. Thompson, Jr." wrote: >

0 Comments

PSP for Banner BEIS

March 11, 2013 | David A. Bantz

UA is implementing Banner Enterprise Identity Services (BEIS), one feature of which is support for real-time provisioning via the BEIS "Identity Proxy" and SPML LDAP Adaptor, or via a separate PSP. This note solicits the experience of other institutions who have deployed BEIS and use the real-time provisioning capability to provision identities in AD or a generic LDAP directory. • Do you use the SPML LDAP Adaptor, or a separate PSP to provision identities into your directory or directories? • If you evaluated alternative PSPs, what were the deciding factors for you? • What has your experience been in deploying and operating the provisioning service? • Do you have any other advice or recommendations for our deployment? David Bantz U Alaska IAM

4 Comments

RFB/P for One-Time-Passwords

March 11, 2013 | Listserv Anonymous User

Message from stefan.wahe@doit.wisc.edu

This effort is specific to a distributed environment across the UW-System for about 3,000 users for our business/financial applications. We are still making them available for digital signing and encryption. We also may still use them for research efforts local to UW-Madison. The reasons for the change for these application/populations include:

(1) The need for an agnostic solution that is not driver dependent on OS, browser or device type.

(2) Ability to provide contingency access for staff who have lost or malfunctioning hardware token.

(3) Steps to authentication (this is because of the federated environment we are authenticating between).

I do know that many campuses have successfully deployed a x509 solution for authentication.

Thanks - Stefan

...

0 Comments

Password notifications

March 11, 2013 | Mark B. Jones

· Yes, a confirmation is immediately sent to a user’s official e-mail address when their password is changed. The mail states when it was changed and who changed it (which could have been someone from the helpdesk).

· No, we don’t send mail about failed changes, only the feedback on the password change form.

· We begin notifying users that their password will expire about a month before. The notifications start weekly and increase to daily the week before the password expires.

· I’m not sure what you mean by role based notifications. Only the user is notified.

...

1 Comment

Non-Disclosure Agreements

March 11, 2013 | Mark Clements

I'm wondering if anyone would be willing to share their non-disclosure agreements.

I will be working with my security group to author one soon, and am looking for useful things to include, and if you ran into any 'gotchas' from legal.

Also, anything you wish you had included, but didn't?

Thanks in advance!

-- MC
-------------
Mark Clements
Director of Administrative Computing and Networking
University of Wisconsin Oshkosh

0 Comments

March 13 IAM Online: Three Campus Case Studies of Managing Access with Grouper

March 7, 2013 | Valerie M. Vogel

IAM Online - Wednesday, March 13, 2013 3 pm ET / 2 pm CT / 1 pm MT / Noon PT www.incommon.org/iamonline Three Campus Case Studies of Managing Access with Grouper Is your campus looking for more efficient ways to manage access to course materials, administrative data, and even HR data? Wondering how to set up roles and permissions for administrators, staff and students allowing them to access the resources they need? Tune into the March 13 IAM Online to hear case studies from three campuses highlighting how Grouper, the open source access management software from Internet2, is being used to address group and access management challenges. Host and Moderator: Tom Barton, University of Chicago Speakers: Paul Donahue, University of Wisconsin-Madison Sebastien Gagne, University of Montreal Rahul Doshi and Michael Gettes, Carnegie Mellon University ************** Connecting We use Adobe...

0 Comments

Pre-provisioning user access

March 6, 2013 | Listserv Anonymous User

Message from mike_shore@bcit.ca

Hi all,

Our account and email provisioning processes are based on an employee’s start date. However, once in a while we get a request from HR to create a mailbox for a “higher up” (manager or VP) who is starting at some point in the near future. The reasons given include wanting to set up their calendar schedule, start communicating the new the hire, and get them up to speed so they hit the ground running on their first official day of work.

I understand this desire, but from a security and liability standpoint we’re not comfortable with creating an “unused” account and mailbox. Even if it is a VP, he is not an employee until date X, so why should he have access to our resources before date X?

Do you have policies or procedures in place to provision employees before their actual start date? Technically,...

27 Comments

Brute force attacks

March 6, 2013 | Paul Hodgdon

I was wondering if anyone is using any software/appliance to mitigate or detect brute force attacks. Do you do anything with blocking an IP on N number of failed attempts within a timeframe or anything similar? Is there anything specific to something like OpenLDAP or AD?

-Paul

5 Comments

Connecting to the Incommon metadata xml with ADFS 2.0

March 4, 2013 | Listserv Anonymous User

Message from leifj@sunet.se

On 03/05/2013 01:32 AM, Cantor, Scott wrote:

4 Comments

Password reset token

February 25, 2013 | Paul Hodgdon

Are any schools doing one-time password reset tokens to an alternate e-mail on file? If so how is it working, any challenges or issues with security? Do you do it for all users or just a subset? Any schools that advise against this and why? Thanks for the input. Paul Hodgdon Sent from my iPhone

7 Comments

TWO WEEKS! Send your proposals for 2013 Apereo Conference (Jasig and Sakai) by March 4

February 23, 2013 | Thomas J. Barton

Dear Colleagues, Below is a reminder to submit your proposals for the first ever Apereo Conference. There will never be another quite like it! Thanks, Tom -- Tom Barton Senior Director for Architecture, Integration, and Security Chief Information Security Officer Information Technology Services University of Chicago +1 773 834 1700 (office) TWO WEEKS LEFT! Time is running out to submit your proposal by March 4 https://www.concentra-cms.com/cfp/p/apereo13 The deadline for this year's 2013 Apereo conference is two weeks away. Please submit your proposal so we can learn from you in San Diego, CA, June 2-7, 2013. The conference is an exciting opportunity to collaborate with your peers in higher education. What makes the conference so compelling is YOU – your success stories and your amazing work. You may submit a presentation session, birds of a feather...

0 Comments

Fwd: agenda, social identity conference call, 2/25/2013, noon EST

February 22, 2013 | Steven T. Carmody

This social identity working group recently spoke during an IAM Online webinar which described the functionality available with the pilot social-to-SAML gateway, and the steps a Service Provider would take to use the gateway. Next monday's working group conference call will set aside some time for people who attended the webinar to ask questions about the gateway, its status, and how to use it. I'm sending this to the IDM list because IAM Online does not collect email addresses of attendees, and I suspect some of the attendees heard the webinar announcement here. In the future, I will not be sending agendas to this list. thanks. ---

0 Comments

Use of GUID in IdM

February 21, 2013 | Paul Hodgdon

I was wondering if anyone had a good example of how they are using GUID’s. We had on our technical requirements for implementing OIM that we needed to generate a GUID. Does your IdM system do this now and do you store it in your data sources?

-Paul

IT Accounts & ITSM Applications Manager

University of New Hampshire

Client Services

Primary: (603) 862-2377

Alternate: (603) 862-4242

Paul.Hodgdon@unh.edu

http://accounts.unh.edu

25 Comments

Confirmation of the EDUCAUSE Security Breach

February 19, 2013 | Dan Malone

I have confirmed this email was also sent to our members using federated authentication via InCommon. Do these users really need to reset their password? Since some users will not understand the difference and will follow the EDUCAUSE password reset procedure, what will happen to these member accounts? Will they still be linked to the InCommon login process? Thanks, Dan (2/19/2013 11:49 AM) Matthew Milliron said the following: > The information about an EDUCAUSE server breach is accurate. > > We have just notified all members and the community via e-mail and social media outlets. > > The e-mail notification was sent through our e-mail marketing product (Informz). Links within the e-mail are redirected through our marketing product. > > Please note that the password reset page is responding slowly due to increased traffic. Old password have already been deactivated; therefore, you do not need to change your password immediately. We expect traffic to the page to...

2 Comments

IAM Online Webinar: Accepting Social Identities -- Today, Wed., Feb. 13 (3 pm ET)

February 13, 2013 | Valerie M. Vogel

IAM Online – Wednesday, February 13, 2013

3 pm ET / 2 pm CT / 1 pm MT / Noon PT

www.incommon.org/iamonline’

Accepting Social Identities: Integration with SAML and Deployment Strategies

Things are moving fast and furious to develop ways to integrate social identities with existing federated SAML-based identity management. The February IAM Online will talk about specific next steps, review the steps in configuring an SP to use the pilot gateway, answer questions about deployment, and discuss a central Social-to-SAML gateway. Dedra Chamberlin will share another potential Social2SAML gateway model for feedback.

**************

Host and Moderator: Renee Shuey, Penn State

Speakers:

Steve Carmody, Brown University...

0 Comments

Google Apps Directory Sync (GADS) operations inquiry

February 11, 2013 | Michael R. Gettes

Fellow IDM travelers, I am using GADS for managing our forth-coming Google Apps domain for CMU. I am interested in the experience of others regarding the operations aspect of this tool. It wants to send email. Running with WARN doesn't seem to be very useful. I am interested if anyone has come up with what they believe is the right combination of things or a wrapper script for GADS which looks for problems so I you don't get email for every run of the tool - cuz I don't wanna ignore the emails - i just wanna see the problems. You can reply to the list or directly to me. If directly to me, I will summarize experience to the list. Many thanks! /mrg

1 Comment

Banner to OIM Real-time provisioning

February 6, 2013 | Corey Scholefield

Great topic. We've also got a home-grown Banner view that we used to integrate with Sun IDM. Your question makes me wonder just how much uptake there has been with BEIS out in the field....?

Corey S.

On 02/06/2013 06:23 AM, Nicholas Pluta wrote:

We are a Banner institution with OIM. Our implementation was based on an Oracle database view that OIM looked for its data. This was done around 2009 before BEIS was an option. Last year we were looking at replacing the view with BEIS, but Ellucian was not interested in offering professional services to help set that up. They instead wanted to sell up a different...

1 Comment

Allowing social accounts to access campus services

February 5, 2013 | Steven T. Carmody

Last December IAM Online hosted a webinar where several people talked about a pilot service that allowed people to authenticate at social identity providers (google, yahoo, etc) and then access services and applications protected by Shibboleth (SAML). Several applications were mentioned, including use by Continuing Education courses, parent access to services, and access by partners not associated with an InCommon member campus. The webinar drew a large and enthused audience; the poll taken at the end of the webinar had a large percentage of attendees indicating a strong interest in working with and experimenting with this service. This followup note is to invite people interested in working with the gateway to attend the next Social Identity Working Group conference call, scheduled for Monday Feb 11th at noon EST. (Bridge information included at the bottom of this note.) That call will review cookbooks describing the implementation steps for using the S2S gateway...

2 Comments

Department of Education to Rollout Two-Factor Authentication

November 30, 2011 | Rodney Petersen

(Please excuse the cross-posts.)

The U.S. Department of Education Federal Student Aid technology office announced this week at the 2011 Federal Student Aid Conference its plans to issue 90,000 tokens to privileged users who have access to Personally Identifiable Information on FSA systems. The privileged users will include financial aid staff at your institutions. More information is available at http://net.educause.edu/ir/library/pdf/CSD6059.pdf

We will also feature the Department’s plans next week as part of IAM Online (www.incommon.org/iamonline) scheduled for Tuesday, December 6^th, at 3 p.m. ET / 2 p.m. CT / Noon PT....

10 Comments

Office 365 Provisioning and Federation Options

July 25, 2012 | Jeremiah Adams

Hello IdM Community,

We are facing a couple of challenges here at the University of Colorado Denver | Anschutz Medical Campus that I anticipate some of you have worked to conclusion, and therefore would like to ask for your insights.

A bit of our environmental background is that we are an Oracle Identity Management (OIM) shop, focusing our energies on making that suite (OIM, OVD, OID, OIF, OAM) of products as productive as possible for us. We also rely heavily on Microsoft for messaging services, having a large majority of our constituency supported by Live@edu, and moving in the near future to Office 365, while also maintaining on premises exchange services for some portions of our constituency.

Now for the questions:

1) ...

9 Comments

Use of VDS for IAM

April 24, 2012 | Listserv Anonymous User

Message from corey.pedersen@utah.edu

Our IAM program has promoted the use of a Virtual Directory Server (VDS) as a focal point for our Identity Services. This would be utilized to virtualize data from our enterprise systems and aggregate access to our other directories and AD.

I was hoping that some of you could comment on your successes or failures utilizing a VDS in this manor. What kind of performance have you encountered? Ease(or otherwise) of use, etc.

If you wish to comment on particular vendors and do not feel comfortable doing so in this open forum, please send me your comments directly, with which I will be sensitive with their access.

Thanks in advance for your help,

...

9 Comments

On IMS Learner Information Services v.2: Roles and role definitions

December 5, 2011 | Keith D. Hazelton

See agenda item 2 on today's MACE-Dir call ___________________ 2. Expanded IMS roles vocabulary and eduCourse revisions - For revised role vocabulary, see Appendix B of http://www.imsglobal.org/lis/lisv2p0pd/MMSinfoModelv2p0pd.html - See also the full document set drafts of version 2.0 of Learning Information Services: http://www.imsglobal.org/lis/index.html The set of role types that a Person can have for their Memberships. The core vocabulary is: · Learner · Instructor · ContentDeveloper · Member · Manager · Mentor · Administrator · TeachingAssistant · Officer Rule B.1-01: Learner – the role of someone...

9 Comments

Photo Directory

July 26, 2012 | Listserv Anonymous User

Message from alacer.cogitatus@gmail.com

Good Evening List, I was wondering how many Higher Ed Schools have a photo directory (students and faculty and staff) and how you implemented it. There is some debate at my institution over querying a MSSQL Database to pull the image, or using powershell to populate Active Directory and doing the lookup that way. I wanted to get input and see what others are doing. Thanks! K

8 Comments

Mapping Banner to AD

May 29, 2012 | Listserv Anonymous User

Message from mike_shore@bcit.ca

Hi everyone,

We use ~~SungardHE~~ Ellucian Banner as our ERP, and AD as our authentication directory. We are moving towards a Microsoft-centric environment, with Exchange, Sharepoint and eventually Lync. We have hit a problem whereby some staff have multiple jobs (ie. part time instructor, as well as full time Payroll clerk). In these cases, Banner is able to track multiple jobs for a single person. However, AD only supports single values for attributes like Department, Job Title and Supervisor.

I realize there is no simple way to map multiple values in Banner down to a single value in AD. We have tried to determine what the person’s “primary” job is, based on hours committed to each job and other criteria. We have also considered using custom AD attributes to store additional information about an employee, but that info might not be...

8 Comments

Internal Password Dictionary Check Guidelines

February 20, 2012 | Todd Dergenski

Hello All:

We are currently updating our password policies to be more ISO complaint and I seem to be hitting a snag. There seems to be little to no guidance on what “not vulnerable to dictionary attacks” really means. From what I can gather, there seem to be 3 different styles of dictionary checkers out there. The lowest style seems to check if the password contains whole words: $password. Kind of a medium style strips all special/numeric characters and checks the remainder against the dictionary: pa$ss$wo$rd. The strongest seems to do a reverse l33t on the password to see if it was dictionary based: p@$$w0rd. All of these are technically dictionary checkers and have obvious security vs. user supportability problems, but out of everyone out there, which style have you implemented? Did you implement it across your entire organization or selected...

8 Comments

Password reset token

February 25, 2013 | Paul Hodgdon

7 Comments

IAM Online, Jan 16 - Scalable Privacy: An NSTIC Grant for the Identity Ecosystem

January 7, 2013 | Valerie M. Vogel

**************

IAM Online – Wednesday, January 16, 2012

1 pm ET | Noon CT | 11 am MT | 10 am PT

www.incommon.org/iamonline

**************

Scalable Privacy: An NSTIC Grant for the Identity Ecosystem

Are you interested in providing users more control over privacy, including consenting to release of attributes and actively managing their identity in cyberspace? Would you like to hear about a national effort to build a consistent and robust privacy infrastructure? Join us for this IAM Online, where Ken Klingenstein of Internet2 will discuss how this federal pilot program will help develop tools and technologies to achieve these goals.

Under the grant, provided by NIST through the National Strategy for Trusted Identities in Cyberspace, Internet2 and partner campuses will build this...

7 Comments

LDAP Log Analysis (389, SunOne, etc)

March 2, 2012 | Michael R. Gettes

Kind beings, I am seeking any software people have to recommend for LDAP Log Analysis against 389/Fedora/Redhat/SunOne/iPlanet/Netscape directory server. I know years ago Brendan wrote something but it doesn't appear to be available any longer. I am wanting to know who are the top users of the directory, the operations they are performing, attributes requested and any other useful data. For monitoring, we are going with CN=Monitor - nice little web tool but getting top-talkers and the like doesn't seem to be readily available. Of course, my google foo ain't so good. Many thanks in advance! /mrg

7 Comments

Shibolethe and InCommon

December 13, 2011 | Ramanarao Chamarty

I am looking for resources which can guide us in setting up Shiboleth and InCommon for federation – start to finish - at Temple University. Thank you in advance.

Ramana Chamarty

Director, Temple University

r.c@temple.edu

7 Comments

LDAP - SSL certificate expiration

April 26, 2013 | Gary Chapman

Our SSL certificate (located on an F5 load balancer) used when accessing our LDAP

directories is about to expire. The directory is Oracle (ne Sun) and the certificate

is Verisign 1024 bits. The F5 does SSL termination. There are several hundred

hosts that bind to the directory on a given day, many representing major systems.

While arranging for testing, we are also trying to gauge the client system (wide variety)

impact of updating to

(a) a Verisign 2048 bit cert

(b) an InCommon 2048 bit cert

While InCommon would our preference, our highest priority is to minimize the number of

client systems/applications that need manual certificate updates.

Anyone have recent experience (or sage advice) with such a maneuver?

Thanks - Gary...

5 Comments

Brute force attacks

March 6, 2013 | Paul Hodgdon

-Paul

5 Comments

Home Grown ID Match Fuzzy Match?

November 15, 2012 | Listserv Anonymous User

Message from benjamin.oshrin@the.oshrinium.net

For those of you with home grown ID match systems (perl scripts, etc), what, if any fuzzy matching do you do and how do you do it? I'm specifically looking for details like "We have a lookup table of firstnames, so if we get a first name of Bill we'll also check the database for Will and William" or "We pull any records with the same SSN and the same (or transposed) DOB, and then use the perl module Text::LevenshteinXS to compare the candidate names." Thanks, -Benn-

5 Comments

IAM Online Virtual Working Group Meetings: May 20-21, 2013

May 1, 2013 | Valerie M. Vogel

The IAM Online webinar series has scheduled a special series of virtual working group meetings to showcase key identity and access management tools and services. Working groups will provide project overviews, discuss current work, and entertain questions. These will be interactive sessions, using Adobe Connect for slide-sharing and chat discussions, and a phone bridge for participating and posting questions. Join us to: * hear an overview of each project * find out about the current work * learn how your campus can benefit Sessions on Monday, May 20, include (all times Eastern) Noon - 1:15 pm - Grouper 1:30 - 2:45 pm - Shibboleth 3:00 - 4:15 pm - Interfederation and CIFER (two separate topics) Sessions on Tuesday, May 21, include (all times Eastern) Noon - 1:15 pm - Social Identity 1:30 - 2:45 pm - CoCoA (collaboration platform) 3:00 - 4:15 pm - MACE-DIR A wiki page includes background information on each of these working groups, agendas, and dial-in/Adobe Connect information:...

4 Comments

LDAP product suggestions

March 19, 2013 | David Langenberg

Hi All, The University of Chicago is undertaking a project to replace our present LDAP infrastructure (Oracle Directory Server Enterprise Edition v 11) with something not Oracle. The three leading candidates we have selected are: OpenDJ by ForgeRock OpenLDAP Port 389 / RedHat DS Would anybody who happens to already be running one of the above systems mind chiming in about their experiences (good and bad)? Also, if you would please let me know if you could go back in time, would you select the product you're presently running? Thanks Dave -- David Langenberg Identity & Access Management The University of Chicago

4 Comments

PSP for Banner BEIS

March 11, 2013 | David A. Bantz

4 Comments

Connecting to the Incommon metadata xml with ADFS 2.0

March 4, 2013 | Listserv Anonymous User

Message from leifj@sunet.se

On 03/05/2013 01:32 AM, Cantor, Scott wrote:

4 Comments

Workday and PeopleSoft integration

February 8, 2012 | Peter Bosanko

Currently, we populate Active Directory and our enterprise directory with nightly feeds from PeopleSoft, where for the most part, PeopleSoft is the data of record. We are about to introduce Workday into the mix, and I expect other cloud products aren't far behind. As such, I'm compelled to reconsider how we organize identities. One challenge for us is to decide where the data of record is for personal information: Workday, PeopleSoft, both, or a dedicated identity management system. I'm wondering what other schools are doing on this front. Have any of you implemented/deployed identity management systems that act as the data of record for person records, instead of being fed by, for instance, PeopleSoft? I'm trying to get the sense of what if any pitfalls there are to this strategy. Thanks for your help. - Pete Pete Bosanko Manager - Identity Management 736 Rhodes Hall Cornell University Ithaca, NY 607-254-8683

4 Comments

SAML or CAS on Windows or Linux

January 13, 2012 | Listserv Anonymous User

Message from pmorley@mcdaniel.edu

Good Morning,

We are looking for a solution for Single Sign-On that can be implemented fairly quickly that supports either CAS or SAML.

We have an outside vendor who is trying to integrate with us.

Has anyone worked with SSO Easy, a 3rd party company that provides a Windows based SSO provider, but is specific to the integration from the perspective of licensing.

Thanks.

Phillip Morley
Jr. Systems Administrator | Information Technology
McDaniel College
2 College Hill
Westminster, MD 21157
( Office: (410) 857-2540
y E-mail: pmorley@mcdaniel.edu

4 Comments

Jump to a Month

See Entire Archive

Group Leaders

Rodney Petersen

EDUCAUSE

Christopher Duffy

Peirce College

Main Nav

Publications

Research

Major Conferences

Online Events

Special Topic Events

Events for all Levels and Interests

Career Center

Leadership and Management Programs

Fellowships and Awards

Getting Involved

Jump Start Your Career Growth

Latest Topics

EDUCAUSE organizes its efforts around three IT Focus Areas

Join These Programs If Your Focus Is

From the Blogs

Find Others

Share Ideas

Get on the Higher Ed IT Map

2013 Strategic Priorities

Membership

Who We Are

Stay Informed

Uncommon Thinking for the Common Good™

Identity and Access Management Discussion Group

Guidelines and Contact

Participate in this Group

Search This Group

Jump to a Month

Group Leaders

Related to this Group...

Research and Publications

Conferences and Events

Career Development

Focus Areas and Initiatives

Connect and Contribute

About EDUCAUSE

Publications

Research

Major Conferences

Online Events

Special Topic Events

Events for all Levels and Interests

Career Center

Leadership and Management Programs

Fellowships and Awards

Getting Involved

Jump Start Your Career Growth

Latest Topics

EDUCAUSE organizes its efforts around three IT Focus Areas

Join These Programs If Your Focus Is

From the Blogs

Find Others

Share Ideas

Get on the Higher Ed IT Map

2013 Strategic Priorities

Membership

Who We Are

Stay Informed

Uncommon Thinking for the Common Good™