1. Joint Information Systems Committee 01/04/2014 | slide 1 Access Management and e-Portfolios What are we trying to protect??? Joint Information Systems CommitteeSupporting education and research

2. Joint Information Systems Committee 01/04/2014 | | Slide 2 Access Management and e-Portfolios What are we trying to protect?? Nicole Harris Programme Manager

3. Joint Information Systems Committee 01/04/2014 | slide 3 An apology An Apology

4. Joint Information Systems Committee 01/04/2014 | slide 4 Overview Introductions and why interested Short (probably very ill-informed) presentation from Nicole Open discussion Aim: action points for projects and JISC.

5. Joint Information Systems Committee 01/04/2014 | slide 5 JISC Background MLEs for lifelong learning raised the question of access management for learner records, particularly in lifelong learning scenarios. –Commissioned a report of current access management systems: none met the specific requirements of the scenarios in question. JISC regional pilot call invited participants to include a shibboleth element within the proposal. Initially this was envisaged to develop access to resources across institutions (i.e. institutions acting as service providers to other institutions). Many took this as an opportunity to look at access control within e-Portfolios. This sounds like an excellent idea, but… What role does Shibboleth have for e-Portfolios??

6. Joint Information Systems Committee 01/04/2014 | slide 6 Problems What do we mean by an e-Portfolio?? What do we mean by a Personal Development Plan? Do we have a shared understanding of e-Portfolios across regional pilots? Are we interested in supporting e-Portfolios in a single institutional context? What mechanisms are we using to share learner records across institutions? –Information remains at each institution and is called by services. –Information is rolled-up and passed on to each institution. –Central repository (national?). –User owns data. Single institution, small regional sharing or nationally available in a lifelong learning context? Until we understand what scenario we are operating in, we cant understand what access management requirements we have. I.E. We need to know what the question is before we try and answer it!!

7. Joint Information Systems Committee 01/04/2014 | slide 7 Personal Access I want to access my e-portfolio at my current institution. I am only interested in the current picture, and not in information from other institutions that I may have attended. –Shibboleth access to e-Portfolio software may answer this (no different from shibboleth access to VLEs for example). I want to use the software at my current institution to access my e-Portfolio from this institution and others. I know that my old institutions have given this information to my current institution. –Issue relates to how that information has been securely passed across to the current institution, and who has the authority to guarantee the information. –Securing UK LIP? I want to somehow access my e-portfolio information from all my institutions. The information is still held at the individual institutions. –Role of the multi-WAYF?? –Central repository (shibboleth log-in) then n-tier calls to other services (problem being investigated)?? –Other solutions??

8. Joint Information Systems Committee 01/04/2014 | slide 8 Authority Access I am an administrator within the English department and I have been tasked with updating the records of all the students based on grades received this summer. –Use of detailed attributes within access management system. This institution wants to make student grades and qualifications generally available. We want to allow people who have permission to access the records access, but nobody should be allowed to change the information. We want the data to be authoritative without candidates, other institutions, or perspective employers needing to contact us to be assured. –How make this available? –Where are the requests coming from? –Who gives permission?

9. Joint Information Systems Committee 01/04/2014 | slide 9 External Access I am a prospective employer. I wish to access a candidates e-Portfolio and be assured that what I am seeing is authoritative data. –How do we provide this access?? Shibboleth Virtual Home for Identities?? –Who gives permission to access?? The student?? How managed?? –Can anyone access my e-Portfolio data at any time?? –How is this data brought together from across all institutions?? –Role for digital signatures?