Brought to you by InCommon in cooperation with Internet2 and the EDUCAUSE Identity and Access Management Working Group.

Transcription

1 IAM Online Brought to you by InCommon in cooperation with Internet2 and the EDUCAUSE Identity and Access Management Working Group. IAM Online is a new monthly series delivering interactive education on Identity and Access Management (IAM), including federated identity management essentials, advanced issues in IAM, and hot topics from the EDUCAUSE Identity and Access Management Working Group. Experts will provide overviews, answer questions and lead discussions. IAM Online includes three types of presentations/discussions: Federated Identity Management Essentials - Learn how you can leverage your existing identity management infrastructure to provide single sign-on access to resources both on- and off-campus. Advanced Issues in Identity Access and Management - Community developers and experts will provide information and lead discussions about emerging technical, architectural and other topics involved with the deployment of identity and access management. Hot Topics and Current Issues in Identity and Access Management - The leadership of the EDUCAUSE Identity and Access Management Working Group will probe hot topics and current issues gleaned from questions posed to the Identity Management Discussion Group, federal policy developments affecting identity and privacy, and other higher education and industry initiatives. Schedule [assembled from current and archived materials and presentation slides] (all starting times 1 p.m. EST / Noon CST / 11 a.m. MST / 10 a.m. PST) Thursday, May 13, Advanced Issues in Identity Access and Management - Toward Common Identity Services - Tom Barton, Host Thursday, April 8, Federated Identity Management Essentials - Making Federation Happen Thursday, March 11, Hot Topics and Current Issues in Identity and Access Management - Provisioning Remote Users Provisioning Remote Users and the Impact of the HEOA Legislation on Distance Education From 4 April 2010

2 Session overview: Mark Scheible and Lori McNabb explored the general challenges of provisioning remote users and the specific impact of HEOA regulatory requirements that ask accrediting organizations to evaluate college identity procedures for distance education students. Mark Scheible, Manager, Identity and Access Management, North Carolina State University Lori McNabb, Assistant Director, Student and Faculty Services, University of Texas System Friday, February 12, Federated Identity Management Essentials - Introduction to Federated Identity Management Session overview: John O Keefe discussed how Lafayette College leverages their existing identity management infrastructures to provide single sign-on access to resources both on- and off-campus. He outlined the value of InCommon Federation participation, including the security and privacy benefits, particularly in this era of outsourced services and resources. Introduction to Federated Identity Management John O Keefe, Lafayette College From 4 April 2010

3 IAM Online Thursday, March 11, 2010 Provisioning Remote Users and the Impact of the HEOA Legislation on Distance Education Mark Scheible, Manager, Identity and Access Management, North Carolina State University Lori McNabb, Assistant Director, Student and Faculty Services, University of Texas System Questions via Adobe Connect chat Audio via Adobe Connect preferred Conference phone bridge also available (listen-only) Dial-in numbers: Preferred (from any phone where long distance has no add'l cost) (US/Canada only if you pay for long distance) Access Code: # Brought to you by InCommon, in cooperation with Internet2 and the EDUCAUSE Identity and Access Management Working Group 1

4 IAM Online: Hot Topics and Current Issues in Identity and Access Management Provisioning Remote Users and the Impact of the HEOA Legislation on Distance Education Mark Scheible, Manager, Identity and Access Management, North Carolina State University Lori McNabb, Assistant Director, Student and Faculty Services, University of Texas System 2

5 Introduction What we re going to talk about 1. There are more Questions than Answers 2. Some Definitions 3. Provisioning of Remote Students 4. How Distance Education is impacted by HEOA 5. Technologies and Options 3

6 Definitions Authentication: The process of identifying an individual, usually based on a username and password or pass phrase. Authentication ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual. Credentialing: The process whereby users are given electronic credentials to ensure that they are coupled with the correct digital identity information. Digital Identity: The electronic representation of a human identity that is used in online interactions with other people or machines. The purpose of the digital identity is to establish the level of comfort and confidence in a digital environment that is associated with face to face human interactions. 4

7 Definitions Cont. Identity: A unique set of characteristics or attributes held by no other person or thing. Identity Proofing: The process by which an individual is tied to their electronic record by validating sufficient information to uniquely identify a person. In Person identity proofing usually requires the presentation of a government issued photo ID. Identifier: A user ID. This could be a number (SSN, EmployeeID, StudentID, etc.) or a username (NetID, generated combination of attributes) Provisioning: (1) The process of providing users with access to data and technology resources. (2) The process of providing [users] with accounts, the appropriate access to those accounts, all the rights associated with those accounts, and all of the resources necessary to manage the accounts. [webopedia.com] 5

8 Some Challenges How does credentialing take place for the remote student? What impact does FERPA have on the identityproofing process? What level of assurance does an institution need to have that the student is who they say they are? 6

9 The Proofing Process Using widely available information to authenticate is not reasonable (FERPA DoEd review of guidelines 12/2008) o Name, DOB, SSN, Student ID, Addresses Is help available from external sources? What other information is available for incoming students that could be used to validate their identity when issuing credentials? Should the admissions process specifically capture data that can be used in identity proofing? (and if so when in the process?) 7

10 Distance Ed vs. Traditional Similar processes exist during the admissions process for both traditional and DE students o Application process o Issuance of an initial credential (prior to any on campus visit) o Access to admissions related services (e.g. application, , financial aid) Differences begin to occur once the traditional student arrives on campus (e.g. photoid, in person instruction) DE students may never set foot on campus or have a face toface meeting with an instructor The HEOA legislation only applies to Distance Education 8

11 Questions? 9

12 Higher Education Opportunity Act processes in place through which the institution establishes that the student who registers in a course or program is the same student who participates in and completes the course or program and receives the academic credit. HEOA

13 Higher Education Reauthorization Act Accreditation requirement Online courses Correspondence courses Student privacy Notification of expense 11

14 Academic Dishonesty Plagiarism Fabrication Falsification Misrepresentation Misbehavior Gallant,

15 Higher Education Opportunity Act Secure logins and pass codes or Proctored testing or Authentication technologies 13

16 Secure Logins & Pass Codes Reframe security conversation Address distance education in security policies Student privacy 14

17 Proctoring Academic decision that must include faculty members Limited pedagogy Traditional proctoring vs. digital proctoring (new technologies) Student expense 15

18 Authentication Technologies use, at minimum, a secure login and pass code or proctored exam and, as they become available and widely accepted, new identification technologies and practices. Wheelan,

19 Authentication Technologies Biometrics (usually fingerprint scanners) Mouse/keyboard pattern matching Challenge questions Monitoring Combinations 17

20 DE Technology Implementation Authentication vs. Proctoring vs. Both First authentication Frequency of authentication Types of assessments Data management Implementation for just online 18

21 then Academic Integrity 19

22 Questions? 20

23 Summary and Options For Remote Provisioning of Credentials Perform a Risk Analysis of services provided Secure process for delivery of an initial credential Work with your auditor 21

24 Summary and Options For Distance Education Work with your accreditor to understand and meet their requirements Username/Password OR Proctored Assessments OR New Technologies Assess new technologies and plan well for their implementation Create a culture of integrity 22

25 Last Points Username/Password may be all that s required (for now), but evaluate your process for securely communicating this information and take advantage of new technologies as they become available or more affordable Possibility of changing the admissions process (form, information asked, etc.) so that you have data to pose random challenge response questions to authenticate the issuing of the initial credential(s) Possible use of vendor services (e.g. verification questions, notary) 23

26 Last Points Cont. Use of state systems (Universities, Community Colleges) for issuing credentials through member institutions Opportunity to use a Federal Government credential at some point to authenticate a remote user? (e.g. FAFSA authentication) Use of InCommon Federation as participation grows (a credentialing application for In Person ID Proofing?) 24

27 Questions? Lori McNabb, Assistant Director, Student and Faculty Services, University of Texas System Mark Scheible, Manager, Identity and Access Management, North Carolina State University

28 IAM Online Please take a few minutes and complete the survey about today s IAM Online: Upcoming IAM Online: April 8, 2010, 1 p.m. (EDT) Making Federation Happen, by Joel Cooper, Carleton College; and John O Keefe, Layfayette College May 13, 2010, 1 p.m. (EDT) Advanced Topics in Federated Identity Management Security Professionals Conference April 12-14, 2010 Post-conference seminar is Identity Management for Security Professionals: Leveraging Federations. Go to CAMP! June 21-23, 2010 InCommon CAMP Raleigh, North Carolina Exploring and Supporting Federated Access Brought to you by InCommon, in cooperation with Internet2 and the EDUCAUSE Identity and Access Management Working Group 26

29 IAM Online Friday, February 12, 2010 Introduction to Federated Identity Management John O Keefe, Lafayette College Questions either via Adobe Connect chat or the conference call. Dial-in numbers: Preferred (from any phone where long distance has no add'l cost) (US/Canada only and only if above number costs user more than 800/866 calls) Access Code: # Brought to you by InCommon, in cooperation with Internet2 and the EDUCAUSE Identity and Access Management Working Group

30 Introduction to Federated Identity Management John O Keefe Director, Academic Technology and Network Services Lafayette College 1

31 What is Federated Identity Management (FIdM) 2

32 The Questions How many off campus applications do you have (or are you planning to have)? How do these service providers verify the identity of your users? know who s eligible to receive these services? know the user is active and hasn t left the institution? How comfortable are you with the privacy and security of the identity data? 3

33 The Problems Access to outsourced services in a traditional way does not scale Authentication is managed by identity holder (user) on a case-by-case basis Authorization is managed by the Service Provider without institutional verification Security and privacy varies from service to service, user to user Accuracy and timeliness not managed by anyone In 2005, 11 different LC username/password combinations 4

34 Traditional Identity Management Research Projects Shared Courses Institution A Student Loan Service Physics Homework Service Institution B = Credentialing / Authentication Library Provider = Authorization = User Credential 5

35 Federated Identity Concept Federation Research Projects Shared Courses Institution A Student Loan Service Physics Homework Service Institution B = Credentialing / Authentication Library Provider = Authorization = User Credential 6

36 InCommon Federation US Research and Education Federation Over 200 participants representing over 4 million users and growing Sponsored partners include the National Science Foundation, the TeraGrid, the National Institutes for Health, EDUCAUSE, the National Student Clearinghouse, and companies offering library databases, human resource systems, and other important services Higher ed. participants include all types of colleges and universities from the liberal arts (like Lafayette) to large research institutions (like University of Florida) Members agree to common participation rules and basic practices that allows each to interoperate with the others 7

37 Use Lafayette College 8

38 The College 2,382 Students, 206 Faculty Small, residential, private liberal arts college Merged IT/Library organization with 29 IT staff Open-source centric Centralized IT 30% of 1 FTE dedicated to FIdM 9

39 What We Do With Federated Identity Library Applications (Jstor, RefWorks) Moodle Spaces (Lafayette s collaborative Moodle instance) University Tickets Online e2campus Google Apps (Not ) 10

40 What We Do With Federated Identity Spaces (I2 wiki) University of Washington Technology Wiki DreamSpark Internal network management apps 11

41 University Tickets Provides online ticket sales for campus events Student Life had previous arrangement with vendor Wanted to validate affiliation via LDAP import into THEIR system We pointed them to InCommon Now sending only basic attributes, no LDAP information 12

42 e2campus SMS-based emergency notification system Spam-like s sent to campus users requesting password changes prompted project Collaborated with Public Safety Went live in October 2009 Makes using service easier and more secure 13

43 Moodle Spaces Our first use of SP Alumni Ambassadors (213 users) Oomycete Undergrad Molecular Genetics Network Alumni Chapter Volunteers (26 users) Uses ProtectNetwork IDs - Solved credential issuance problem for lightly-affiliated users 14

44 What s Next for LC and FIdM: IdP Collaborations with other schools Financial Aid Applications itunesu NSF & Grant Application/Management 15

45 What s Next for LC and FIdM: SP WordpressMU Single Sign-On for web applications Banner Drupal Zimbra 16

46 Why Does This Matter? 17

47 Facilitates Collaboration Enables faculty, staff, and students both within and beyond your institution to use a common set of applications Enables faculty, staff, and students both within and beyond your institution to access, share, and manipulate a common set of data Enables faculty, staff, and students both within and beyond your institution to access research tools over the Internet and Internet2 18

48 Protects Collaboration Privacy - Sends the minimum amount of attributes Security - Keeps person attributes secured in your local identity vault and limits number of UserIDs and passwords Outsourcing - Enables integrated t institutional use of external applications Regulations - Access that must adhere to Federal regulations can easily be provisioned 19

49 Questions? John O Keefe okeefej@lafayette.edu web: twitter: okeefej_62 20

50 IAM Online Please take a few minutes and complete the survey about today s IAM Online: Upcoming IAM Online: March 11, 2010, 1 p.m. (EST) Provisioning of Remote Users, by Mark Scheible, North Carolina State University April 8, 2010, 1 p.m. (EDT) Making Federation Happen, by Joel Cooper, Carleton College Go to CAMP! June 21-23, 2010 InCommon CAMP Raleigh, North Carolina Exploring and Supporting Federated Access Details soon at Brought to you by InCommon, in cooperation with Internet2 and the EDUCAUSE Identity and Access Management Working Group