Which is the easiest method to replicate student identity data?

[Yacapaca]

Until now, we have left it up to individual teachers to load just the students they want onto Yacapaca. Now we are getting requests for whole-school working. Teachers want student IDs and class affiliations to just automagically appear for them. That's fair enough, but we want to make the process as pain-free and secure as possible for the person who is going to transfer the data out of the MIS.

 

Which routes would you like to see us follow?

• we have ruled out LDAP and Shibboleth
  
• SIF and IMS Enterprise are high-end candidates
  
• simple CSV files are the most straightforward
  
• what have we missed?
  

[FN-GM]

Why have you ruled out LDAP? That would be the best way for us. Makes it easer as students dont have another password to remember.

[penfold_99]

What is your classification of high end? Expensive?

 

SIF can be a low cost option, happy to have a conversation about it if it would help?

[Yacapaca]

FN-GM We are wary of LDAP because our experience from other projects is that LDAP integration with external websites often fails. If you have examples of integrations with externally-hosted sites that are stable and successful, I would really like to investigate them.

[FN-GM]

FN-GM We are wary of LDAP because our experience from other projects is that LDAP integration with external websites often fails. If you have examples of integrations with externally-hosted sites that are stable and successful, I would really like to investigate them.

@Yacapaca Microsoft Office 365 and Google Apps. Perfect examples

[Yacapaca]

Thanks FN-GM. I will go back to my team and see if I can change their minds.

[FN-GM]

Just because the "team" doesn't like to use LDAP doesn't mean it shouldn't happen. You need to keep us happy, without us you wouldn't be here

[nickbro]

You have a few ways of doing federated authentication (that's what MS call external AD authentication).

 

1. Is writing something that can use the AD Federated Services stuff MS have made, this basically a HTTP/HTTPS POST to a school server that is available externally, this intern authenticates the user and posts the user back to your site with the auth token.

2. Is writing something that uses Shibboleth, this is like ADFS but doesn't natively use MS tech

3. Is to make a program that sits on the school site and establishes a http/https keep alive connection, when a user attempts to log into yacapaca, if the school is known, it will sent a request down the pipe to the school asking if this user is ok (obviously encrypt the username & password in the pipeline), the school then returns a simple yes or no, or you could go further and get back the first name, last name, upn, etc. If the user exists in your own database it will use that and just update the details if they have changed (no password stored), or it will create the user. This is basically how 1 and 2 work but you are making the interface between your external website and the school's AD infrastructure.

 

Hope that helps.

[Yacapaca]

@FN-GM (or anyone!) what do Microsoft Office 365 and Google Apps do when the student wants access outside of school? AIFAIK, most LDAP servers are accessible only from within the school network. This is what tripped us up last time.

[nickbro]

That's what ADFS is for. It'll redirect the user to one of your servers over https to authenticate and then send them back, your server will send a token saying, yes or no

[Yacapaca]

That's what ADFS is for... this basically a HTTP/HTTPS POST to a school server that is available externally,

 

Nick, thanks for this. To me it confirms the problem though. It fails very inelegantly if/when the school server is not available externally.

 

What happens with Microsoft Office 365 and Google Apps in this situation? Do they simply fall over, or do they have a fallback of some kind? Excuse my nervousness, but this sounds to me like a recipe for a thousand support calls, all blaming us for problems on services we don't control.

Edited February 7, 2013 by Yacapaca

[FN-GM]

if/when the school server is not available externally.

 

Well surely thats a risk the school should decide on...

[FN-GM]

@Yacapaca it will make you stand out from the rest if you go for this! Will give you the edge. Our school uses lots of online services. Many have different logins, its a real pain to manage.

[GrumbleDook]

I would be another advocate for SIF and Shibboleth ... the more that make use of them the better the options for them being ubiquitous.