The Meteor Project and Financial Aid Delivery Justin Tilton instructional media + magic, inc. Presented to: The National Association of Student Financial Aid Administrators October 11, 2001

The Meteor Project 2 Financial aid services In the past, regulations drove practices and determined services Now, information technology drives practices and has the potential to increase service ________________ Using information technology, the U.S. Department of Education is improving its services, and setting higher expectations. The challenge for schools and others in the Higher Education loan community is to meet the current expectations and collaborate on standards for the future.

The Meteor Project 3 Some key initiatives Student loan industry CommonLine Common Account Maintenance (CAM) The High Performance Channel (HPC) The Meteor Project ELMnet Department of Education OSFA Web enabled applications Common Origination and Disbursements College and university collaboratives JA-SIG (Java in Administration Special Interest Group) Internet 2 and Shibboleth MIT’s Open Knowledge Initiative Florida State University, University of Hawaii “30 minute application to funds”

The Meteor Project 4 SFA Web-enabled applications FAFSA on the web Schools portal release 2.0 with single sign-on Financial partners portals – FY 2002 Student on-line access to direct loan servicing API to SFA systems

The Meteor Project 5 Impact on colleges and universities Changes: From Batch to Real-time Transactions, From Proprietary File Transfers to Internet XML Messaging Standards From SFA-defined to Industry Standard Message Content An integrated Student Experience Use of SFA-provided Java (J2EE) shared-components

The Meteor Project 6 An initiative of the student loan industry Collaborative effort of 37 guaranty agencies, lenders, secondary markets, and servicers On-line, real-time information services Separate channels for students and financial aid professionals Aligned with industry, SFA standards ______________________ “Building the IT infrastructure for the next decade”

The Meteor Project 7 Students expectations shaped by... Their experience applying for federal financial aid Their use of financial services portals Their use of the Internet Their life in a “real-time, information rich” environment

The Meteor Project 8 Students now expect... Customer service 24 hours a day, 7 days a week Complete information from a single source Delivery by Web, , telephone, facsimile, and wireless devices response time of 15 seconds for telephone, 10 seconds for Web, and 2 hours for and facsimile access to a complete customer history

The Meteor Project 9 Is technology important? Technology choices determine the quality of electronic services offered to Web-savvy prospective students, current students, alumni, faculty, staff and the public. Technology choices will determine with whom you do e-business and how it is done.

The Meteor Project 10 SFA technology choices XML - B2B Standard Business Messages XML Schema (data validation) Java - Transportable Programs Shared Java Components Web Implementations – FAFSA UML - Unified Modeling Language

The Meteor Project 11 eBusiness Web services architecture XML “tagged” data content eXtensible Markup Language SOAP data transport Simple Object Access Protocol XSL transformations for presentation eXtensible stylesheet language XML Digital Signature for Server Authentication UDDI/WSDL directory services Universal Description, Discovery, and Integration,and Web Services Description Language

The Meteor Project 12 Technology standards M - from Meteor installation O - optional Industry OSFA Meteor JA-SIG uPortal IBM Web Services Microsoft.Net Sun One Java Programming Language XML Markup Language SOAP Data Transport M UDDI Directory M WSDL Service Description M

Where does The Meteor Project fit into all of this?

The Meteor Project 14 Relationship of Meteor and JA-SIG JA-SIG uPortal Meteor Channel The Meteor Project

The Meteor Project 15 The Meteor Project Meteor is the software and service to obtain a student’s own financial aid information from a number of different sources. The software can be installed on any Website--a school, lender, guaranty agency, secondary market, servicer, or collection agency. The software is Open Source--a “gift” from the Meteor sponsors to the financial aid community.

The Meteor Project 16 Data from multiple sources, locations The Pilot Implementation

The Meteor Project 17 Reference implementation The reference implementation includes: Authentication of the user A list of loans Details on any specific loan Error, warning, and information messages for the user

The Meteor Project 18 Meteor authentication

The Meteor Project 19 Meteor list of loans

The Meteor Project 20 Sample Meteor loan detail

The Meteor Project 21 User message, no Meteor service

The Meteor Project 22 User message, please call

How does Meteor work?

The Meteor Project 24 Meteor in a nutshell… Lender XML UDDI

The Meteor Project 25 The first step… The student chooses a portal to their Financial Aid information

The Meteor Project 26 Next, a secure connection

The Meteor Project 27 Requests sent... XML Guaranty Agencies NSC SFA

The Meteor Project 28 Responses returned XML SFA GA NSC OPEID Bank of Oklahoma OPEID University of Central Oklahoma OPEID Bank of Oklahoma XML

The Meteor Project 29 Aggregated data in portal

The Meteor Project 30 Student wants details

The Meteor Project 31 Request for detail sent to Lender Lender XML

The Meteor Project 32 Detail screen displayed Lender XML

The Meteor Project 33 Diagram of Meteor Concept Web Services HTML Meteor XML Student Access Provider Data Provider Student Access Provider Data Provider

The Meteor Project 34 As implemented... Web Services Secure HTML Meteor Secure XML Standard Browser Standard Browser uPortal Meteor SOAP Meteor SOAP Meteor SOAP Meteor SOAP Database

The Meteor Project 35 The development configuration uPortal Standard Browser Standard Browser uPortal Meteor SOAP JAVA Components Meteor SOAP JAVA Components Meteor SOAP JAVA Components Meteor SOAP JAVA Components Database JDBC Connection Database JDBC Connection Linux Apache Tomcat Linux Apache Tomcat

The Meteor Project 36 What we learned... The XML/SOAP business message turnaround is less than 1 second Because of the scope of authorization for access and different uses, Meteor needed two separate channels Student and parental access to the student’s information Financial aid professionals access to information about students

The Meteor Project 37 Professional - Authorization

The Meteor Project 38 Selection

The Meteor Project 39 Display

Why is Meteor important?

The Meteor Project 41 The Meteor software Provides an information service for students and alumni Provides an information resource for financial aid professionals Becomes a first step toward implementation of the Department of Education’s real-time “Common Origination and Disbursement” - due in 2003

The Meteor Project 42 Meteor software will be available as: A channel in JA-SIG’s uPortal 2.0 or later A Java servlet that can in incorporated into any Website that supports servlets Possibly a channel in Apache Foundation’s JetSpeed portal (also IBM’s general portal)

The school experience Authentication, a barrier to implementation

The Meteor Project 44 Some definitions Proxy (a) An entity authorized to act for another; (b) authority or power to act for another ; (c) a document giving such authority. OASIS Security Services TC Glossary, July 2001 Financial aggregation is the process of gathering content from multiple sources and consolidating that information at a single web location for review and, potentially, financial transactions by the customer. BITS Voluntary Guidelines for Aggregation Services, April 2001

The Meteor Project 45 Some definitions Credential - Data that is transferred to establish a claimed principal identity. Assertion - A piece of data, produced by a SAML authority, constituting a declaration of identity, or attribute information, or authorizations. Login, Logon, Signon - The process of presenting credentials to an authentication authority, establishing a simple session, and optionally establishing a rich session. OASIS Security Services TC Glossary, July 2001

The Meteor Project 46 IFX Business Message SOAP Header Routing information Business Message Security Password [Digital] Certificate Magnetic Stripe and PIN Request/Response of Secret Business services content

The Meteor Project 47 Authentication and authorization Defining “Level of identification” Incomplete standard protocols for authentication or authorization Web Single Signon Internet2/Shibboleth Originally Jan 2001 now Dec 2001 SAML Security Assertion Markup Language Indefinite Delay (from June 2001) likely 2002 Indeterminate policies and procedures Legal - new laws and lack of precedents Lack of e-business experience

The Meteor Project 48 e-Business users Hierarchy of trust Government Banks “Brand name” companies Pattern of e-Business Use (typically six to twelve months) Data only Small transactions - $10 to $25 Larger transactions

The Meteor Project 49 Boston College expectation Only ”regular” students and employees in the financial aid office will access Meteor through the College’s secure portal. The National Student Clearinghouse, and subsequently others, will “trust” the Boston College authentication.

The Meteor Project 50 The “trusted” college Secure College environment Secure Internet connection Employee uses school logon and password College sends institutional logon and password Loan list message Scenario User: Employee Access Provider: Boston College Data Provider: Clearinghouse

The Meteor Project 51 As a proxy service Secure College environment Secure Internet connection Student uses logon and password from Data Provider College forwards this logon and password Loan list message Scenario User: Student Access Provider: College or University Data Provider: Guarantee Agency

The Meteor Project 52 As a security aggregation service Student uses logon and password from Access Provider College forwards this logon and password Loan list message Scenario User: Student Access Provider: College or University Data Provider: Guarantee Agency CitiBank SallieMae Secure Internet connection 5

The Meteor Project 53 Third party authentication Student uses logon and password from third party College forwards the assertions Loan list message Scenario User: Student Access Provider: College or University Data Provider: Guarantee Agency SAML Request Assertions returned Secure College environment Secure Internet connection

The Meteor Project 54 Meteor sponsors American Education Services American Student Assistance Bank One College Foundation, Inc. [NC] The College Board/CollegeCredit Education Loan Program Connecticut Student Loan Foundation Education Assistance Corporation Education Funding Association Florida Department of Education, OSFA Georgia Higher Education Assistance Corporation Great Lakes Higher Education Guaranty Corporation GuaranTec, LLP Higher Education Student Assistance Authority Illinois Student Assistance Commission Iowa Student Loan Liquidity Corporation Kentucky Higher Education Assistance Authority Key Education Resources LoanStar Systems, Inc.

The Meteor Project 55 Meteor sponsors Michigan Higher Education Assistance Authority Montana Guaranteed Student Loan Program National Student Loan Program, Inc. New Hampshire Higher Education Assistance Foundation New York State Higher Education Services Corporation North Carolina State Education Assistance Authority Northwest Education Loan Association (NELA) Oklahoma Guaranteed Student Loan Program Oregon Student Assistance Commission Panhandle-Plains Student Loan Center Rhode Island Higher Education Assistance Authority Sallie Mae, Inc. Southwest Student Services Corporation Student Loan Finance Association Student Loan Guarantee Foundation of Arkansas Student Loans of North Dakota Texas Guaranteed Student Loan Corporation United Student Aid Funds Vermont Student Assistance Corporation

The Meteor Project 56 And we had help... The National Student Clearinghouse’s Roberta Hyland and Joy Wang provided data access and programming assistance to make their database available to Meteor users. Interactive Business Solutions Software Engineer (and Harvard University graduate student) Peter Karchenko joined the Meteor team working on the project. Priority Technologies, Inc. extended the Meteor software and contributed the UDDI/WDSL implementation. Credit Online’s Dennis Warnke and Glenn Leyba shared LoanML drafts and their experience implementing IFX SOAP messaging. Great Lakes’ Steve Marganeau provided CommonLine XML as it was being produced in December Sigma Systems Inc.’s Andy Sprague provided test data and design guidance and Randy Timmons gave Meteor briefings and demonstrations.

The end