| Note |
|---|
WORK IN-PROGRESS |
| Table of Contents | ||||
|---|---|---|---|---|
|
...
| Panel | ||
|---|---|---|
| ||
This document was updated in June 2023. The previous version has been archived. |
On This Page
| Table of Contents | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
OpenCCC & The CCCID
OpenCCC is the federated identity initiative and systemwide student account system for the California Community Colleges system. Developed by the CCC Technology Center in 2011, the OpenCCC system has generated over 25 million unique student accounts (as of June 2023) supporting single sign-on access to many systemwide online technology applications.
...
What is the CCCID?
When a new OpenCCC student account is created
...
the system generates a unique student identifier for the user called the CCCID (California Community Colleges ID) and stores the user's validated credentials and minimum personal identifiable information
...
in a secure identity management system
...
enabling single sign-on access to admissions applications and other systemwide web-based services.
CCCID &
...
Authentication
The CCCID is the master link between the identity management system, community colleges, and all systemwide technology services. When a user is authenticated to use an application or service such as CCCApply, Canvas or MyPath, the CCCID is passed to that service to identify the unique individual. In this way, services and applications can maintain personal accounts for the user anonymously, thus ensuring the privacy and security of the user’s data.
...
Key Functionality:
...
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
See: What information do students need to create their OpenCCC account? |
CCCID Facts
The CCCID is unique to each individual student
The CCCID is generated when a unique individual the student/user creates an OpenCCC account.
The CCCID is used to identify the student during sign-on by systemwide technology applications
The CCCID is securely stored in a secure systemwide identity management system and passed delivered to the college via SuperGlue for Apply or via Data Warehouse Direct Connect service.
The CCCID can be used for student identification and deduplication by the college.
The CCCID is used to identify the student during sign on by systemwide technology applications.the mandated student identifier for every California Community College student
How do
...
students get
...
a CCCID?
The majority of students get their CCCIDs when they first Every student is assigned a unique CCCID during the OpenCCC account creation process which is required in order to apply to a California Community College using the CCCApply admission application. Since 2012, when the CCC Technology Center first released the new CCCApply application in conjunction with the new OpenCCC Account system, colleges have downloaded new student/applicants through their CCCApply download client process. The OpenCCC Account data fields, which are created as part of the initial CCCApply application, are passed to the college with the CCCApply application data in their automated download file. Below is a diagram that illlustrates the process that colleges are using now to download the OpenCCC data - including the student's system-generaged CCCID - along with the student's application dataor use any systemwide web application or service. Thus most students create their OpenCCC account when they apply for admission via the CCCApply online application or as part of the MyPath onboarding process. In some cases existing students who do not yet have a CCCID will encounter the OpenCCC Sign In page the first time they attempt to access a systemwide application, such as Canvas. Either way, every student will begin the account creation process from the Sign In page by clicking the Create an Account link.
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
For more information, see How To Create A New OpenCCC Account. |
How long does it take for a student to create an OpenCCC account?
Creating an OpenCCC account is simple, secure and user-friendly using a desktop computer or a mobile device. With access to their personal email account handy, students on average are able to setup and validate their account in under 7 minutes, including creating a secure password and completing the short account profile section.
What information do students need to create their OpenCCC account?
To create an account students need a unique email address or mobile phone number, whichever they prefer, to receive a time-sensitive verification security code in order to validate their identity. Once validated, only a few other details are required to complete the student account creation process, including:
Name & Address
Birthdate
Secure password
These are the only data required to create a new OpenCCC account. Additional information may be needed to submit an application for admission or a financial aid application.
Where do users go to create their account?
Students must have an OpenCCC account before they can apply to a California Community College using CCCApply, therefore most students create their account the first time they apply for admission. All current and prospective students, including high school and lower grade students exploring careers with Career Coach, or submitting a financial aid application, will encounter the Create an Account link on the OpenCCC Sign In page as they begin their CCCApply application for college.
How long does it take to create an account?
The simple, mobile-friendly account creation process redesign focuses on the student experience first. Using a clean interface style and clear instructions, users can create & validate a new account, and complete their Profile, in under 7 minutes.
| Info |
|---|
The new account creation process has been greatly streamlined; nevertheless, time-to-creation will vary depending on the user. |
How long does it take to get through the OpenCCC Account creation process and what is required?
The full OpenCCC Account is a very quick and easy process to complete. There are three pages total and typically takes less than 5 minutes to complete. Below are the required questions and data fields collected in the OpenCCC Account:
Legal Name (Last, First, Middle)
Birthdate
Email
Permanent Address
Main Phone Number
Username
Password
PIN Number
Security Question Responses 1-3
What is the full set of data fields passed to the college via the CCCApply download process?
...
What is the set of data that is used to uniquely identify a student in the process?
There are several combinations of data fields that are used to match a duplicate OpenCCC Account, including:
Email Address
Birthdate
SSN/TIN
Legal First & Last Names
Main Phone Number
What is the Account Matching process in OpenCCC?
The Account Matching function does not have a user interface. It is called by other functions to compare user data with existing accounts. It will accept whatever set of user data the calling function provides, and will attempt to identify a unique account based on that data. (For example, Account Recovery might provide only the required fields, Legal Name and Date of Birth.)
Once the Accounts database has been searched for matches, Account Matching will:
identify a single matching account to the calling function, provide flags to indicate match type (such as whether the match is definitive or not) as appropriate; or
tell the calling function that there was no matching account; or
tell the calling function that there were two or more matching accounts.
It is not the job of Account Matching to determine that a unique account found by Account Matching is a true match—in other words, that it does indeed belong to a particular online user. That task is performed by Account Verification, which will employ security questions to verify that the online user is the actual owner of the account. (Account Verification will never ensure a true match with absolute certainty, but a verified match must provide sufficient assurance to meet current and evolving security standards.)
How does Account Verification process work?
It is the job of Account Verification to verify with an acceptable level of certainty that a unique existing account identified during Account Recovery or Account Creation does indeed belong to the online user. It does this by randomly selecting two of the account’s three Security Questions, and requiring the user to answer those questions.
If the user answers the Security Questions correctly, Account Verification will display the account’s Username and provide fields for resetting the account’s Password.
Once the password has been reset, the user will be admitted to the account, just as if he had logged on. (For example, if Account Recovery or Account Creation has been entered as part of the flow from a college website to the OpenCCCApply online application, the user will be taken from the password reset screen to the Introduction page of the college’s online application.)
...
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
For step by step instructions, see How to Create A New OpenCCC Account. |
How do colleges get the CCCID?
Most students create their OpenCCC Account - which generates their unique CCCID - during the application for admission process to their selected California Community College, either via CCCApply or the CVC/OEI program. The CCCID is passed to the college with the student’s account data when the application is submitted. Application and account data is delivered to the college via SuperGlue for Apply; however there are alternative ways to get a student’s CCCID:
SuperGlue for Apply: Student account data (which includes their CCCID) is delivered with every CCCApply submitted application via SuperGlue for Apply and the College Adaptor.
Data Warehouse Report Server: Colleges can also retrieve account data from submitted and in-progress applications via the CCC Data Warehouse Report Server.
CCCApply Report Center: Real-time submitted application data (including student account data) can also be accessed in the CCCApply Report Center.
SSO Proxy: For continuing students who don’t have an OpenCCC account and therefore cannot sign-in to systemwide technology services, the SSO Proxy will prompt account creation.
For accounts created via the SSO Proxy, how do colleges get the data into their systems?
For continuing students who do not yet have an OpenCCC account and therefore no CCCID, will be prompted to create an account by the SSO Proxy service the very first time they attempt to access a systemwide technology application - such as Canvas. Once the account is created, the college can retrieve the student’s account information and CCCID through the CCC Data Warehouse Report Server.
What is included in the full account data set delivered to the college?
All account data fields are delivered to the college with the student’s submitted CCCApply application for admission or CC Promise Grant application. Alternately, colleges can access student account data via the CCCApply Report Center or the CCC Data Warehouse Report Server. For a complete list of self-reported and system-generated account fields, see the latest CCCApply Standard & Noncredit Application Data Dictionary, or any of the other CCCApply application data dictionaries.
Is there a significant number of duplicate CCCID records found across the system?
No. The number of duplicates CCCID account across the entire CCC system is approximately .2% and decreasing. Though some colleges have raised concerns about the potential for duplicates, at this time we are finding that very few duplicates are being reported (less than 100 duplicates at most colleges, and in even more cases - less than that). The CCC Technology Center recommends that colleges use
| Note |
|---|
If a duplicate account is found, the CCCTC recommends using the account that aligns |
...
with the most recently submitted CCCApply application when associating |
...
it to a student account at your college |
...
. |
...
For the OpenCCC Accounts that are created via the SSO Proxy, how do the colleges get these accounts back into their systems?
The CCC Technology Center is currently developing a mechanism to return the OpenCCC accounts (CCCIDs) created for students who did not previously have a CCCID at the time they first encounter the SSO Proxy via the CCC Report Center.
...
The Significance of the CCCID for Single Sign-On (SSO)
The CCCID is used for multiple purposes across the California Community Colleges system. The CCC Chancellor's Office and other systemwide organizations rely on the CCCID to track a student’s progress and the educational choices made by student across throughout the course of their academic journey. Students that attend multiple colleges across the system are tracked in one central location (OpenCCC Student Account System) and their CCCID will can be used for research (locally and systemwide) to better align support and services across the system, and to prevent fraud.
In order to track students through their CCCID, the The objective of the CCC SSO Proxy is to provide back-up to the OpenCCC system and ensure that every CCC student has a CCCID. Therefore, as part of the SSO Proxy integration, it is strongly recommended that colleges store the CCCID student CCCIDs in their Active Directory or LDAP directory in order to pass this attribute with the EPPN with when the student user session when authenticating signs in (authenticates) to a CCC web application, such as CCCAssessCCCApply, Canvas and MyPath, MyPath, and more.
| Panel | ||||||
|---|---|---|---|---|---|---|
| ||||||
For more information, see the CCC SSO Federation Resource Guide. |
What is the EPPN?
The EduPersonPrincipalName (EPPN) is the unique identifier for a user (applicant, student, faculty, staff) across all college IdPs.For the the Student population, a Central OpenCCC Id (CCCID) is a unique correlation ID for a single student across the entire CCC system and is a key SAML attribute requirement across all service providers. Many colleges will be able to lookup the CCCID from their directory servers, but for the colleges that dont store CCCID, the central IdP proxy will be used to lookup the CCCID for a given EPPN and included it in the list of SAML attributes sent to the final Service Provider.
The EPPN has the syntax of an email address, but it should be considered a "globally unique federated identifier" rather than an email address. It is generally the most important attribute to be shared with federated services. Note that the value of EPPN does not have to match what the user fills in enters as their username when they login, and the user does not need to know what their EPPN is, as it is shared between the IdP and the service. It should be unique, rarely change, and not be reassigned to another user.
...
The significance of the EPPN to the CCC SSO Federation
...
For the the Student population, an OpenCCC Account Id a California Community College ID (CCCID) is a unique correlation ID for ID for a single student across then the entire CCC system and is a key SAML attribute requirement across all service providers. Many colleges will be able to lookup the CCCID from their directory servers, but for the colleges that dont don't store CCCID, the SSO Proxy central IdP proxy will be used to lookup the CCCID for a given EPPN and included it in the list of SAML attributes sent to the final Service Provider.