Version 3 of Shibboleth Identity Provider (IdP) software was released earlier this year, replacing the popular 2.X V2 version which completed its an end-of-life process on July 31, 2016. No further security updates or bug-fixes will be provided for version Shibboleth Version 2.X.
The CCC Technology Center (CCCTC) will upgrade is upgrading the OpenCCC student gateway IdP , (Shibboleth v.2.4.1, to version 3.X 1) on September 29, 2016 30 as part of a planned mid-year release .The CCCApply college staff IdP, providing (5.5). The CCCApply staff IdP - which provides staff single sign-on (SSO) capability to the CCCApply Administrator and CCC Report Center, will - is also be being upgraded to the latest version 3.1.
There is no action required by colleges at this time; however, a campaign is underway, including a $5K mini-grant program to help offset the costs of implementation and support, for colleges that are ready to upgrade to version 3, as part of the CCC SSO Federation of secure, web applications being developed by the Education Planning Initiative (EPI), Common Assessment (CCCAssess), and the Online Education Initiative (OEI)
Recommendation
Although the new version 3.X is backwards compatible with previous versions, the CCCTC advises colleges to plan and begin their IdP upgrade at this time. To get started, please read this document first!
The CCCID & Statewide Technology Initiatives
The cornerstone of the statewide technology initiatives underway at the CCC Tech Center Tech Center portfolio of web applications is security, privacy and easeIn order to participate in the Failure to upgrade to Shibboleth V.3 could result in losing eligibility to participate in opportunities to participate in secure
of Upgrading to
| Note |
|---|
CCCTC Recommends Upgrade to Shibboleth V3Colleges using Shibboleth will need to verify which version they are using and if using version 2.X, should consider upgrading to the latest version. Shibboleth V2 will become an unsupported version, and whileupgrading to V3 is not required, it is strongly recommended. See below for more information on the benefits and requirements of upgrading the Shibboleth version 3 today! Assistance is available for colleges that need help upgrading to V3. For more information, please contact Patricia Donohue, Product Manager, pdonohue@ccctechcenter.org. |
Upgrade to Shibboleth Version 3 Today!
Colleges participating in one or more of the statewide technology initiatives will need to go through a readiness process to ensure that their campus system is compatible with the statewide IdP. This includes aligning the IdP and associated applications to support integration with statewide authentication services (SSO) for students and staff.
Colleges that have only one IdP configured for staff (i.e. Shibboleth 2.X for the CCCApply Administrator & Report Center) will be required to upgrade to Shibboleth version 3 in order to facilitate authentication capability for students, as well as admins and staff .
Failure to upgrade to the latest version 3.X of the Shibboleth Identity Provider ( IdP ) software is strongly advised at this time. Failure to upgrade could result in colleges acould result in users and IT staff losing access to online federated apps and learning resources following the End-of-Life date. 9STAR team advises all organizations that are currently using the Shibboleth Identity Provider software, that they upgrade to the latest Shibboleth Identity Provider software version 3.X. The new Shibboleth IdP version 3.X includes many features and enhancements that provide:
- Improved security.
- Ease of management and configuration.
- Greater inter-operability with apps.
The CCCID will be necessary for accessing Canvas through a student services portal being developed by the CCC Education Planning Initiative. The portal, when fully developed, will be the entry point to systemwide services including the OEI Course Exchange, the common assessment system known as CCCAssess, and others.
Colleges using Canvas should already be storing the CCCID in their student information systems, and should immediately begin transferring that data into Canvas via CSV upload. This will be required for additional integration and participation in future OEI activities and other statewide technology initiatives, according to John Sills, OEI Program Manager.
Support for Colleges IT Staff
The CCCAssess team realizes the challenge of adding yet another project to the IT team’s full plate, and is working to make the conversion as smooth as possible, said John Hadad, Product Manager for the California Community Colleges (CCC) Common Assessment Initiative (CAI).
“IT teams are already running at full speed,” Hadad said. “Each college has local IT projects to implement and upgrades to their systems. Plus, the IT staff provides ongoing support of the network. CCCAssess does mean extra work but we are doing everything we can to reduce the pressure and provide support.”
What if we use Shibboleth?
Colleges using Shibboleth will need to verify which version they are using. They should give consideration to upgrading to the latest version of Shibboleth, if that hasn’t been completed. Shibboleth v2.X will become an unsupported version, and while upgrading to v3.1 is not required, it is strongly encouraged.
What if we use other Identity Providers?
If a college does not use Shibboleth as its IdP, there are other steps that you may need to take. Colleges using PortalGuard, Ellucian students losing access to secure CCC web applications within the CCC SSO Initiative, including the new student services portal, MyPath; the common assessment system, CCCAssess; the Hobson's suite of Ed Planning tools; and Canvas, the statewide course management system (CMS).
Benefits of Upgrading
The CCCTC recommends that all colleges using Shibboleth Identity Provider software upgrade to the latest version 3.X in order to take advantage of the many benefits and enhancements it provides:
- Improved security
- Ease of use and configuration
- Decrease in Help Desk calls - fewer passwords to remember
- Increased student productivity
- Inter-operability and integration with CCC applications
Get Started on Shibboleth Upgrade
Colleges can choose to upgrade Shibboleth on their own (DIY), or work with an approved vendor on this implementation.
NOTE: Working with an approved vendor may affect your project timeline. Vendors are working with colleges on a first-come, first-serve basis; however project pilot colleges may be prioritized depending on the project timeline. Find out more about working with an approved vendor to facilitate your Shibboleth Upgrade. Contact Patricia Donohue, Product Manager, pdonohue@ccctechcenter.org.
| Info |
|---|
| Using A Different Identity Provider Software? If your college is not using Shibboleth Identity Provider software, there are other steps you may need to take to ensure your system is compatible with the statewide IdP. Colleges using PortalGuard and other IdP solutions will need to go through a readiness checklist process to ensure |
| they meet the requirements for student authentication per the CCC SSO Initiative. To understand the readiiness requirements for your IdP, please contact Matt Schroeder, System Engineer, mschroeder@ccctechcenter.org. |
Do you have more questions?
Additional information is available at the CCCAssess website at CCCAssess.orgfor the Shibboleth V3 upgrade and the CCC SSO Initiative. If you are a pilot college for a CCC technology initiative, please contact your Project Manager. You can also contact John Hadad directly at jhadad@ccctechcenter.org or 530-413-8583, and Monica Zalaket at mzalaket@ccctechcenter.org or 530-213-3677Patricia Donohue, pdonohue@ccctechcenter.org, for assistance, or post a comment or question on CCCTechnology.info.