InCommon Federation Discussions About Online Student Services

[Dean Woodbeck <>]

InC-Student: Notes from 10/30/2009

-------------------
Attending

Andrea Beesing, Cornell University
Brendan Bellina, University of Southern California
Keith Hazelton, University of Wisconsin-Madison
Louis Hunt, North Carolina State University
Nancy Krogh, University of Idaho
Mark McConahay, Indiana University
RL “Bob” Morgan, University of Washington
Rodney Peterson, EDUCAUSE
Mark Scheible, North Carolina State University
Ken Servis, University of Southern California
Renee Shuey, Penn State University
Ann West, Internet2/EDUCAUSE
Dean Woodbeck, Internet2 (scribe)

-------------------
PESC

Bob and Brendan reported on the creation of a task force by PESC to 
develop a service (called EdUnify) that will allow vendors and various 
service providers to electronically publish, in some way, the nature of 
the services and capabilities that they offer (the ability to consume 
transcripts, for example). This is in the early stages and the format is 
not determined. One intention is to involve InCommon in some way and use 
SAML. Brendan also reported that there was a great deal of enthusiasm 
about InCommon at the meeting.

Bob also mentioned a meeting of about 25 federations from around the 
world. He heard a presentation on the RS3-G (Rome Student System 
Standards Group) activity. It is called the Bologna process and is a 
European move to promote student mobility. It sounds similar to the 
proposed PESC service.

-------------------
AACRAO Webinar Follow-up

Mark McConahay reviewed the feedback from the webinar that was done for 
AACRAO and need to develop some practical, prescriptive advice for 
registrars and IT staff. What can we tell people they should do that is 
compliant with federal regulations and certain levels of assurance? What 
is involved with provisioning and what will things cost?

The second idea is exploring the possibility for a remote proofing 
service that would make use of InCommon members. For example, a 
university may direct a remote student to visit the nearest InCommon 
member for identity proofing.

Mark M. introduced a chart, developed at Penn State, that provides a 
visual representation of what levels of assurance at Penn State might 
consist of and how they might be differentiated. This is not an 
inclusive list of all data elements collected or vetted. He suggested 
that this serve as a starting point for this group; perhaps adding some 
additional rows or columns and tying the level of assurance information 
to InCommon Bronze and Silver.

This would be one way to begin looking at a prescriptive document. 
Potential starting points include:

1) start from Silver and Bronze, condensing those and tying them to the 
student life cycle.
2) start with FERPA and how it interacts at points in the student life 
cycle.
3) start with levels of assurance and tie those to the student life cycle.

A grid based on the Penn State model might include, for example, a 
column indicating whether or not a proofing scheme is FERPA-compliant. 
Perhaps then LeRoy Rooker or one of the attorneys could provide a 
review. The group agreed that this would be a very valuable endeavor.

There was substantial discussion about the types of columns and rows 
that might be added to the Penn State model. Additional column headings 
might include an individual’s place in the student life cycle, 
information about how a credential is issued, compliance with federal 
regulations like FERPA, and the corresponding InCommon assurance profile.

Rows might be added – and an LoA might be on more than one row. For 
example, there may be differing ways in which credentials are issued 
that correlate to LoA 1.

There was discussion that this chart, like the assurance profile 
documents, will not cover all of the specific examples on each 
individual campus. There will be gray areas that fit between levels of 
assurance, for example. The goal is to continue to work toward 
compliance and not let the exceptions become barriers to progress. It 
will be up to the community to adjudicate the exceptions.

It might be valuable to identify some scenarios that might be 
commonplace and might fall between LoA 1 and LoA 2, or where there might 
be a perceived difference between InCommon Silver and LoA 2 – similar to 
the apparent perception of some Meteor board members. Bob mentioned that 
it appears the Meteor people were looking only at NIST 800-63, when that 
is only one factor in determining levels of assurance. Other 
documentation came from the federal government’s eGov initiative. He 
believes that progress is being made in this area.

There was also a discussion about the case in which a student obtains a 
PIN from the federal government, as part of the process of filling out a 
FAFSA, and universities allow that as an acceptable form of identity 
proofing. It would be interesting to know how this maps to the InCommon 
assurance profile system.

---------------
Next Steps

Mark M will develop an expanded grid, based on the Penn State model. Ann 
has placed a practice matrix on the wiki for use by the collaboration group:
https://spaces.internet2.edu/display/InCCollaborate/Practice+Matrix

The group will discuss this on the next call in two weeks

---------------
AACRAO

There is a half-day workshop scheduled for the AACRAO meeting to be held 
in late April, 2010, in New Orleans, concerning what registrars need to 
know about identity management. It will be a basic terminology and 
concept workshop for entry-level folks. Nancy has not had any luck in 
recruiting presenters. Mark M and Nancy will discuss this at the 
EDUCAUSE meeting next week. Mark M and Keith both said they may be 
interested in helping with this, should travel budgets allow.

---------------
Next Call – Friday, November 13, 2009 – 4 p.m. EST / 3 p.m. CST / 1 p.m. PST