Implementing the ebXML Standards in Postsecondary Education Jim Farmer and Justin Tilton instructional media + magic, inc. As prepared for (but not delivered at) the XML Forum of the Postsecondary Electronics Standards Council Monday · February 25, 2002 · Miami, Florida i n s t r u c t i o n a l m e d i a + m a g i c, i n c.

instructional media + magic Publisher’s Note The Architectural Committee focused on the ebXML specifications. The Committee recommended and the Forum adopted the ebXML Business Messaging.

instructional media + magic Federal mandates Immigration and Naturalization Service SEVIS Student and Exchange Visitor Information System, on or after January 1, 2003 Department of Education COD Common Origination and Disbursements February 2003 (pilot begins March 7, 2002) Department of Veterans Affairs VACert Certificates of attendance sometime 2003

instructional media + magic Federal data exchanges Business Message Message Format Data Transport Education COD XMLProprietaryProprietary Encrypted FTP INS SEVISXMLProprietaryProprietary Encrypted Veterans Affairs VACert (planned) XML?? ebXMLXMLApplication dependent standard SOAP

instructional media + magic Federal e-Authentication John Sindelar, “Achieving the Vision of E- Government,” Nov 27, 2001

instructional media + magic JA-SIG Web Services model HTTPS SOAP Business Message HTTPS SOAP Business Message University Agency Scenario User: Student, staff, or faculty Access Provider: University Portal Data Provider: Agency Web Server SIS Portal Web Server User App Server

Information Technology Standards

instructional media + magic ebXML Technical Standards Collaboration-Protocol Profile and Agreement - WSDL extended Messaging Services – SOAP extended Reliable messaging Message Status Service Message Order Multi-hop Registry – UDDI extended Implementation, Interoperability and Conformance

instructional media + magic ebXML CPPA Collaboration-Protocol Profile and Agreement The Message-exchange capabilities of a Party MAY be described by a Collaboration- Protocol Profile (CPP). The Message- exchange agreement between two Parties MAY be described by a Collaboration- Protocol Agreement (CPA).

Data Representations

instructional media + magic ebXML naming conventions Element names use Upper Camel Case (UCC) convention Attributes use Lower Camel Case (LCC) Class, Interface names use Upper Camel Case ClassificationNote, Versionable Method names use Lower Camel Case getName(), setName() “OASIS/ebXML Registry Information Model v2.0,” Organization for the Advancement of Structured Information Standards, Dec 18, 2001, p. 8

instructional media + magic Person ebXMLIFXINS SEVIS ED COD Title8 First Name Middle Name6440 repeating 251 Last Name6440 repeating 4035 Suffix40

instructional media + magic Address ebXMLIFXINS SEVISED COD Address lines of 642 of 603 of 40 City County19 State or Province Postal code Country64323

instructional media + magic Other addresses ebXMLIFXINS SEVISED COD Telephone (32) 1+31 (32) (US only) (US only) URL

instructional media + magic Person identifiers U.S. Department of Education COD Social Security Number + Date of Birth + Last Name U.S. Immigration and Naturalization Service SEVIS First Name + Middle Initial + Last Name + Date of Birth (MMDDYYYY) U.S. Department of Veteran Affairs [Documentation not published] ebXML Universal Unique Identifier (UUID) 64 characters “DCE 128 bit universally unique ids used for referencing another object.” IFX UUID - 32 characters with four dashes

instructional media + magic Date formats W3C YYYY-MM-DD (dashes included) ISO 8601:2000 Extended FormatYYYY-MM-DD Basic FormatYYYYMMDD U.S. NIST FIPS 4-2 References ANSI X YYYY-MM-DD Note: INS SEVIS uses MMDDYYYY

Security Authentication and Authorization

instructional media + magic ebXML security Persistent digital signatureW3C XMLDSIG Persistent signed receiptW3C XMLDSIG Non-persistent IETF TSL or IPSEC [one direction or bi-directional] Persistent confidentialityW3C/IETFC XML Encryption Non-persistent confidentialityIETF TLS or IPSEC Persistent authorizationOASIS SAML Non-persistent authorizationIETF TLS or IPSEC Trusted Timestampnot yet standardized [ebXML] “Message Service Specification,” version 2.0, OASIS, Jan 11, 2002

instructional media + magic Security for Federal Data Exchanges EncryptionInstitutionPerson EducationNetscape SSL Logon/ Password Logon/ Password INSNetscape SSL Digital certificate Logon/ Password or Digital Certificate? Veterans Affairs ?Logon/ Password Logon/ Password ebXMLIETF TLSDigital certificate Personal Digital Certificate

instructional media + magic Can a college be trusted? The federal government can “trust” a college or university because: The college is already regulated by federal law and regulations, and precedent. By analogy to current paper processes—a long history of “trust.”

instructional media + magic SAML authentication assertions AnonymousRole, organizational affiliation Student identifiedRole, organizational affiliation, name, identification number (SSN), date or birth Student identifiedAccount number + pin. [IFX application level]Card content OR Personal digital certificate Staff identifiedRole, name, local identifier and identifier type, organization and optional sub-organizations

instructional media + magic References “OASIS/ebXML Registry Information Model v2.0,” Organization for the Advancement of Structured Information Systems (OASIS), Dec 18, 2001 “OASIS/ebXML Registry Servics Specification v2.0,” OASIS, Dec 6, “Message Service Specification Version 2.0,” OASIS, Jan 11, “Business Message Specification V1.2.0a, Interactive Financial Exchange, Dec. 31, “Data elements and interchange formats -- Information interchange -- Representation of dates and times,” ISO 8601:2000, ed. 2, International Organization for Standardization, Dec. 21, 2000.

instructional media + magic References “Interface Control Document for the Student and Exchange Visitor Information System,” Immigration and Naturalization Service, Nov. 21, “Technical Reference for Common Record Transmitters to Common Origination and Disbursement ,” Version 3.1, U.S. Department of Education, Nov “Common Record XML Schema Definition File,”for the Common Record], Version 1.0, U.S. Department of Education, Aug. 20, 2001, file named CommonRecord1pt0.xsd.

The end

instructional media + magic Web self-service Web self-service$.06 $6.00 Telephone call$12.00 Forrester Research as quoted by Bonnie Azar Power in “Taking self-service out of the dark into Broad Daylight,” Red Herring, No. 110, Feb 2001, pp