Proxy Issues & Proposed Solutions

Several colleges who have implemented Canvas have raised concerns about the requirement to implement the proxy workflow and haven't chosen not to do so to avoid the challenges and frustration to their students, faculty, staff and IT.

To support the colleges that are not ready for Fall 2018: 

• Consider removing the requirement for Fall 2018 and allow the Tech Center and Enabling Services to
  1) develop & complete implementation with the colleges,
  2) improve the Proxy sign-in UI and workflow, and
  3) develop a "short-form" Account creation process for existing students.
  
  

Colleges need more information and options from the Tech Center on how to implement the proxy for Canvas. 

See below for:

• implementation plan suggestions
• Communication plan suggestions
• UI UX suggestions
• Project plan suggestions
• Deployment issues

Faculty and staff have complained that they are getting redirected to the proxy as well as students and it's catching them off guard. The college had not informed/trained staff and faculty, or the information wasn't understood by the college during IT integration.

Some colleges don't want to implement the proxy workflow this fall until better implementation support and training is provided by the Tech Center.

These are the colleges that we heard from:

• Antelope Valley College (Rick
• Butte College (Dave Stephens, Matt)
• Santa Rosa (Mitch Leahy, Don Webb)
• ES team working on full spreadsheet of all the colleges names

Overall, colleges do not understand the purpose of the SSO proxy: how it works, why it's important, and how it is related to OpenCCC (or CCCApply or the CCCID). 

Admissions & Records and IT seem to have an understanding of the systemwide CCCID, but in general, college faculty, staff, counselors, and even college/district leadership hasn't been exposed to the significance of the CCCID and how it's used to track student records across the CCC system over the lifetime of the student's educational journey. 

The Tech Center needs to develop a clear, consistent message about the significance of OpenCCC, the CCCID for all students, and the SSO Proxy --- providing information on the purpose, the requirements, the long-term goals and objectives of the systemwide ID for all students - AND outline the implementation options and plan for communication to students and staff.

Colleges that adopted OpenCCCApply years ago never stored the CCCID in their SIS, thus the processes are not in place to implement the full workflow process 

Outline process for communication to students about the OpenCCC Account and CCCID

How it's different from their college student ID and used for systemwide single sign-on and tracking across colleges and applications

Based on feedback from colleges, students perceive the proxy to be illegitimate ("Is this for real?"). It appears to be a phishing attempt or scam, and doesn't feel congruent to their expectation that they were on their way to Canvas from their college portal..

Implement short-term improvements to the Proxy Sign-In page with better messaging, college branding, application branding, support for students with a video tutorial and a link to support.

Colleges perceive the proxy as a barrier for their students

Provide colleges with information on importance of the CCCID and the SSO proxy;

Provide colleges with information and options to prevent the proxy from re-directing students, including ensuring IdP and common directory is passing the information required by the proxy

Faculty and staff perceive the proxy as a barrier for them - they are frustrated 

Provide the colleges with information on the importance of passing the correct attributes in metadata

Whitelist (temporarily) Canvas, Starfish, Other vendor applications, and CAP to prevent faculty, staff from being re-directed to the proxy.

Colleges need better training and support on the proxy web service and overall workflow. 

There is a comprehensive IT proxy integration process and most of the colleges have completed that work; however there has not been a clearly prescribed implementation plan or support materials developed to help colleges educate administrators and staff, nor materials for students (clear instructions, help). 

Plan #1 - Update existing IT integration plan to include business operations students, faculty and staff ensuring that all CCC colleges (faculty, staff, Administrators, and students) understand the technical and operational implementation requirements;

Work with colleges to ensure IdP is passing 

1. Tech Center needs to develop and document step-by-step implementation processes for colleges 
2. Develop workflow diagrams to help colleges visualize how the flow of data works between the OpenCCC Account system at time of application, how they get the Proxy CCCIDs back to their systems

Colleges that have integrated the proxy but aren't passing the CCCID because they haven't been storing the CCCID for their students since they implemented OpenCCCApply. 

These colleges need to:

Communicate process and train faculty, staff, admin about the CCCID and the redirect workflow

IT needs to start downloading the CCCID, storing in their SIS, importing to Active Directory

Start passing the CCCID attribute in IdP metadata

Colleges can run a report in the Report Center collecting student information, CCCID and try to match up with college IDs;

Or colleges can prepare students for the proxy re-direct by communicating the process - legitimize the OpenCCC Account system and ensure they know it's legitimate;

Students that have created an OpenCCC account with CCCApply, can "recover" their account and enter in OpenCCC credentials on Proxy sign-in page. They only 

• Send email communication to all colleges with implementation suggestions for several different scenarios:
  • Implementation process for colleges that haven't been storing the CCCID for students (in other words, the college is not sending over the CCCID for any students, even if the student has an OpenCCC account);
    
    
  • Implementation process for colleges that haven't informed staff, faculty or students on the purpose of the proxy, what students need to do, etc.  
    
    
  • Implementation process for colleges that have a large number of non-credit or special populations that don't have CCCIDs

Descriptions of the OpenCCC Account, the CCCID, and the Proxy

Provide breakdown of implementation options and link to detailed checklist on Public Documentation/Implementation site

Emphasize / outline the proxy re-direct process - students have three options: 

When they get re-directed to the proxy sign-in page, they can:

1. Sign-in with their "OpenCCC" username and password credentials
2. Recover their account credentials by clicking "Forgot Username" or "Forgot Password" - then sign-in once the credentials are recovered
3. Create an account (emphasize this should only be done if they've never created an OpenCCC account before.
4. They only have to do this once - the proxy will store / remember their CCCID  
5. Colleges can obtain the CCCIDs created through the Proxy

• The CCCID is now an MIS reporting requirement starting summer 2018
  
  
• All students must have a CCCID and the colleges need to store this data field in their SIS and common student directory so it can be passed in the college/district IdP for consumption by all systemwide applications and services;
  
  
• The CCCID facilitates single sign-on for students across CCC systemwide apps and services, but does not ensure SSO between CCC apps and college apps*

UI Issues

The proxy sign-in page needs a better design to legitimize the service for students and colleges.

The sign-in page lacks legitimate, recognizable branding to the user so they feel comfortable that the re-direct is official and approved by the college, the CCCCO, and the application they are trying to access. 

The sign-in page messaging is confusing for the user; it's not clear what login credentials we are asking for. The student has just signed in to their college IdP and then immediately we are redirecting them to a second, different sign in page. The messaging lacks enough information to explain why the student is seeing the proxy sign-in page.

The sign-in page needs a Help link or better, an embedded video tutorial that can guide the student through the process (either sign-in with OpenCCC credentials, or recover account credentials and sign-in, or create an account if you don't have one.

UX Workflow Issues:

To streamline the proxy workflow, colleges want a "short-form" OpenCCC Account creation process for the students who are already students at a college.   

Colleges are frustrated that students are re-directed to the proxy while they to complete assignments for a course or program. Colleges want an optional workflow process that doesn't interrupt their students on their way to an important are trying to access a systemwide application 

Colleges are frustrated that we don't offer an easy way for bulk assignment of CCCID numbers to non-credit or special needs students (Adult Ed, Inmates, special K12 programs, and non-credit students). 

Colleges want to provide the Tech Center with a spreadsheet of account data and get back bulk-assigned CCCID assignment process

Many colleges don't know how to get the CCCIDs created during proxy re-direct back into their SIS or common directory systems.  Better, comprehensive Information needs to be provided to colleges about the EPPN>CCCID API process. 

OpenCCC Account Issues: 

Overall, the OpenCCC Account Creation process, especially when asked during proxy re-direct, is perceived as redundant, unnecessary, long and intrusive; especially when the user has already provided most of the information to the college already when they applied, enrolled, registered, etc.

Students are put off by the questions, especially SSN, Birthdate, address, phone, email, etc.

It is very unclear whether the SSO proxy is a product or a required technology component or simply a system technical requirement - both internally and externally from the field. 

Currently the SSO proxy does not have a project charter, project plan, business requirements, or roadmap; thus making it extremely difficult for continuous improvement and supporting our colleges.

The SSO Proxy also lacks a clear development team and