Penn State and AES/PHEAA: e-Authentication Melissa Kunes Penn State Office of Student Aid May 4, 2005

What is a Federated Application? One central sign on point (user login with id and password) Able to access multiple data bases among all members of the federation Gesture of “trust”

Project Goal Penn State students are “authenticated” on “eLion” “Passed” to the AES/PHEAA portal using the same “trusted” authentication Eliminate student confusion by eliminating second sign on prompt AES/PHEAA has multiple student applications Springboard to set up a network federation for AES/PHEAA

Ideal Penn State Federated Application Penn State students are “authenticated” on “eLion” “Passed” to the AES/PHEAA portal using the same “trusted” authentication Federal Department of Education “trusts” AES/PHEAA and Penn State Students can access NSLDS, other Department of Education data bases

Background Penn State “Access Account” “Trusted” User ID and Password authentication process Letter of “Safe Harbor” from the U.S. Department of Education as method of authenticating student to allow e-signature of Federal Perkins Loan Master Promissory Note This declaration of trust prompted AES/PHEAA to engage in this federated application with Penn State

Why does the Department of Education trust Penn State?

Student ID Card Process Freshmen (All New Student) Testing: Students directed to Student ID Office Must bring photo ID (Driver’s License, Passport) Students asked for proof of social security number Photo is taken for the Student ID Image is stored on database Student issued photo ID with student’s name on front of card Magnetic stripe on back of card has Penn State Student Number

Computer “Access Account” Process Student is directed to computer “Access Account” signature station Student swipes Student ID and is prompted to enter date of birth If date of birth matches our database the student is prompted to sign an agreement accepting electronic services and agreeing to computer usage and security policies Not to share their password Notify officials if password is compromised Consequences if policy is violated The agreement and signature is electronically imaged The student is issued a User ID and Password

What is Penn State’s Primary Need for this Federated Application?

Federal Stafford Loan Master Promissory Note e-signature process Simplify the Federal Stafford Loan Master Promissory Note e-signature process for Penn State students on the AES/PHEAA website

Current Process to e-sign Federal Stafford Loan Master Promissory Note Student accesses Office of Student Aid public website Click “links” through general Federal Stafford Loan Master Promissory Note information Click “links” to AES/PHEAA web site Directed to sign on at AES/PHEAA website Student e-signs Federal Stafford Loan Master Promissory Note using PIN

Federated Application Process Student logs into “eLion” using Penn State User ID and Password Accesses “e-sign Federal Stafford Loan Master Promissory Note” application Student is transported to AES/PHEAA website (no additional sign in needed) Student e-signs Federal Stafford Loan Master Promissory Note using PIN where application and e-signature is stored

Project Team Member Offices Office of Student Aid Administrative and Internal Programming Staff AES/PHEAA Programming Staff Center for Academic Computing Legal staff

Project Issues Decision to use Shibboleth (version 1.2) Purchase/install hardware and software Origin server, target software Security Concerns Dedicated, secure FTP (SFTP) Stored elements Liability responsibilities Signing contracts/letters of “trust” Determining key attributes to send across SFTP Name, SSN(!), Date of Birth Naming conventions/Industry standards Trading/exchanging “public” keys Programming needs/ Testing resources Small Talk Mainframe (Natural/AIDAbase)

Project Issues (con’t…) Prioritize project/alignment of priorities Penn State underwent SSN to PSU ID conversion Accessing SSN critical process Napster Project Working with non-financial aid staff to understand process Getting all players on the same page at the same time…

Accomplishments Decision to use Shibboleth version 1.2 AES/PHEAA has installed origin server/target software Access to SSN has been granted Programming resources have been allocated SFTP in place Attributes have been determined and tagged Legal/liabilities have been agreed upon Testing of the communication flow will commence in the next week

Current Status Project has been in development since January 2003 Keep touching base with the players Appreciate the baby steps Don’t get frustrated A fine wine takes time….

Director, Federal and State Aid Programs Contact Information Melissa Kunes Director, Federal and State Aid Programs Office of Student Aid mjk5@psu.edu (814) 863-2869