InCommon Federation Discussions About Online Student Services

["Ann West" <>]

All,

Below are the notes from the NSC planning call. Please respond with
updates as appropriate. 

FYI, the action items from the NSC meeting have already been sent to the
list. 

Thanks,
Ann

AACRAO/EDUCAUSE/Internet2 IdM Call: Notes from 3/16/2007
--------------------------------------------------------
Renee Frost, Internet2
Nancy Krogh, Idaho/AACRAO 
Todd Mildon, U Wash
David Yeh, Cornell
RL Bob Morgan, U Wash/Internet2
Renee Shuey, Penn State
Ann West, EDUCAUSE/Internet2
Andrea Beesing, Cornell

Action Items
-------------
- Todd will write up the CollegeNet/Application Services issue and
explain the problem space
- Robert to contact Jeff von Munkwitz-Smith about the AACRAO Technology
Conference
- David will send out statistics of NSC transactions.
  
Notes
------
- Our primary discussion topic centered on the meeting with the NSC at
the Internet2 Spring Member Meeting. David mentioned that the
Clearinghouse started out as a student loan clearinghouse to help
validate enrollment/eligibility. They currently maintain enrollment,
degree, transfers, graduation rates, part-time/full-time status, and
demographic data for 90%+ HE schools in the US. Over 3000 schools are
members (must be accredited to join).

Primary services enable students and others to verify enrollment; view
online degree verification; and order transcripts and help to deliver
them from school to requestor. NSC also verifies US students studying
abroad for enrollment and aid reconciliation.  For the Registrars
office, their services provide a reduction in workload; for the student
NSC reduces issues associated with loan default, among other things.
Individual schools, such as community colleges, can also track their
prior students across the HE space; the NSC associates (or joins) the
multiple institution data with the individual (based on SSN). 

- How many students use the services? [AI] David to send out transaction
and data holding statistics. Initial look at self-service usage revealed
282,000 transactions in 1/2006 alone.

- One of the primary security concerns is the sending of the
institutional data to NSC. 

-Does PESC have a role in this work with the NSC? The PESC-sponsored the
EA2 group is looking for a killer app to bring efforts together. Working
with the NSC to adopt federated identity would be a natural.

- Who has usernames and passwords? 20-30 people in the administration on
a given campus or more. Currently, to request access, one fills out a
paper form and faxes it to NSC. They've received complaints about the
security of this process so they are revisiting it. However, we're
concerned that they will implement something that's unsupportable by HE
and would rather offer them a standard approach to use instead.
Federated identity could be a win if they have a problem setting up the
accounts (and removing them), for instance. This might help change the
current model too where students authenticate using their SSN.  At the
meeting, we can discuss this and the various components that go into
ensuring trust. 

Benefit for NSC include:
        - Brand protection - having a data spill wouldn't be good
        - Increase efficiency on both sides for
provisioning/de-provisioning
        - Ensure the right person has access given the process
                - The current process is easily compromised.

- In general, we need a higher level of security, reduction in work
efforts, and business process to ensure integrity of our business.
Schools are all over the map w/r/t the security of their processes.
Having campuses see big drivers for federated identity like NSC and NSF
Fastlane (https://www.fastlane.nsf.gov/fastlane.jsp) can help encourage
better processes. This is a big value of the InCommon Federation too.
InCommon can be a gathering point for the community to decide what
practices should be promulgated. Currently, schools just have to publish
their practices to join the Federation. Having specific practices and
requirements for joining means that a school must standardize to
participate. But how can one be sure that they truly conform? Who audits
them? This is still being discussed.

- We then looped back to the specifics of the NSC meeting. The primary
goal is to initiate a collaborative project, have them join InCommon and
help bring more schools into the federation. 

AGENDA for the NSC Meeting
- Introductions -10
- Business Issues - 20 minutes - David
        Security
        Operational efficiencies
        (Todd/Nancy might contribute)
                - Todd writing up thoughts 
        Registrar and business side

- InCommon/Usher - unified activities 15-20 minutes 
        Bob/John Krienke

- Why is it important from the National Student Clearinghouse?
        David/Todd write-up 
        - collaborate across institution and vendors - cost
        - improve business process and services - time
        - reduce security exposure/risk

Next Call: TBD in May