Joint Information Systems Committee 04/10/23 | slide 1

Access Management and e-PortfoliosWhat are we trying to protect???

Joint Information Systems Committee Supporting education and research

Joint Information Systems Committee 04/10/23 | | Slide 2

Access Management and e-Portfolios

What are we trying to protect??Nicole HarrisProgramme Manager

Joint Information Systems Committee 04/10/23 | slide 3

An apology

An Apology

Joint Information Systems Committee 04/10/23 | slide 4

Overview

Introductions and why interested

Short (probably very ill-informed) presentation from Nicole

Open discussion

Aim: action points for projects and JISC.

Joint Information Systems Committee 04/10/23 | slide 5

JISC Background

MLEs for lifelong learning raised the question of access management for learner records, particularly in lifelong learning scenarios.

– Commissioned a report of current access management systems: none met the specific requirements of the scenarios in question.

JISC regional pilot call invited participants to include a ‘shibboleth’ element within the proposal. Initially this was envisaged to develop access to resources across institutions (i.e. institutions acting as service providers to other institutions).

Many took this as an opportunity to look at access control within e-Portfolios. This sounds like an excellent idea, but…

What role does Shibboleth have for e-Portfolios??

Joint Information Systems Committee 04/10/23 | slide 6

Problems

What do we mean by an e-Portfolio??

What do we mean by a Personal Development Plan?

Do we have a shared understanding of e-Portfolios across regional pilots?

Are we interested in supporting e-Portfolios in a single institutional context?

What mechanisms are we using to ‘share’ learner records across institutions?

– Information remains at each institution and is ‘called’ by services.

– Information is ‘rolled-up’ and passed on to each institution.

– Central repository (national?).

– User owns data.

Single institution, small regional sharing or nationally available in a lifelong learning context?

Until we understand what scenario we are operating in, we can’t understand what access management requirements we have.

I.E. We need to know what the question is before we try and answer it!!

Joint Information Systems Committee 04/10/23 | slide 7

Personal Access

I want to access my ‘e-portfolio’ at my current institution. I am only interested in the current picture, and not in information from other institutions that I may have attended.

– Shibboleth access to e-Portfolio software may answer this (no different from shibboleth access to VLEs for example).

I want to use the software at my current institution to access my ‘e-Portfolio’ from this institution and others. I know that my old institutions have given this information to my current institution.

– Issue relates to how that information has been securely passed across to the current institution, and who has the ‘authority’ to guarantee the information.

– Securing UK LIP?

I want to somehow access my e-portfolio information from all my institutions. The information is still held at the individual institutions.

– Role of the multi-WAYF??

– Central repository (shibboleth log-in) then n-tier calls to other services (problem being investigated)??

– Other solutions??

Joint Information Systems Committee 04/10/23 | slide 8

Authority Access

I am an administrator within the English department and I have been tasked with updating the records of all the students based on grades received this summer.

– Use of detailed attributes within access management system.

This institution wants to make student grades and qualifications generally available. We want to allow people who have permission to access the records access, but nobody should be allowed to change the information. We want the data to be ‘authoritative’ without candidates, other institutions, or perspective employers needing to contact us to be assured.

– How make this available?

– Where are the requests coming from?

– Who gives ‘permission’?

Joint Information Systems Committee 04/10/23 | slide 9

External Access

I am a prospective employer. I wish to access a candidates e-Portfolio and be assured that what I am seeing is authoritative data.

– How do we provide this access?? Shibboleth Virtual Home for Identities??

– Who gives permission to access?? The student?? How managed??

– Can anyone access my e-Portfolio data at any time??

– How is this data brought together from across all institutions??

– Role for digital signatures?