2018-33: Enhance the SSO Proxy Sign-In Page with a Template with College Co-Branding

Butte College and others have been whitelisted from the proxy for any session that sends over any EduPersonAffiliation attribute that is not strictly "student" (i.e., that includes - faculty, staff or member or any other value that is not ONLY student).

Butte College and others have been whitelisted from triggering the proxy for faculty, staff, member.

8/2 Note: Butte College will do another round of tests - to ensure the whitelisting is in place as expected. 

Currently, the following logic is in place:

• Only students should ever see the proxy for the purpose of ensuring their CCCID is passed (seamlessly) to the endpoint/application
• If a faculty/staff/member at a college is also a student - they are currently being filtered from the proxy BUT this is a temporary change until this process is finalized/approved and all colleges are informed.

DONE

COMPLETE

Zendesk #12988

In July, Canvas was whitelisted (does not redirect) for any EduPrimary Affiliation that was not strictly (only) STUDENT. 

Improve the language/messaging on the proxy Sign-In page that affirms that the OpenCCC and CCC ID mechanisms are legitimate. 

• Revise/improve the message/ language on the proxy sign-in page for clarity and to legitimize the proxy re-direct
• Add "OpenCCC" to Username & Password
• Add language to clarify "why student is being redirected"
• Add short video/screencast
• Update language on the Sign-In page (i.e. "We know you might not be expecting this, but...", etc.). This can easily be accomplished by embedding a short (20-30 second) screencast video."

Proposed Solution:

Enhancements to the proxy sign-in page have been approved:

• Update the language on the Sign-in page with new, dynamic text that displays the name of the destination application. Tim approved the following change:
  
  You're on your way to << CANVAS >> from <college>...
  
  To continue, please sign-in or create an account with OpenCCC, the California Community Colleges systemwide student account.
  
  
  

Solution Issues:

The Proxy can't differentiate between individual colleges (origin) if they're from a multi-college

Tim added to this design - "You're on your way to CANVAS from <<college>>"

• Replace old "OpenCCC" logo with new "CO Brand" version and color
• Update the font type and replace with new colors
• Add "OpenCCC" to the Username & Password labels
• Change the colors
• Increase the font size on "Create a new account"

Change to:  

A Service Of The
California Community Colleges Chancellor's Office

• In the new font (per new 2018 CO Brand Guide) and ensure all words in CCCCO are on one line.  
• The font size can be adjusted based on the fit of this requirement. 
• All words in the text-based logo should each be capitalized. 

Improve the proxy workflow with better branding

• Add college-branding 
• Enhance/improve CO and CCCTC branding
• Legitimize the endpoint application - add application branding
• Use college sub-domain & URL mapper to legitimize the re-direct

Note: 

When a user goes to access an App like Canvas - then hit the Proxy - Proxy LOGIN - (CCCCO logo has little value to students)  - the page presented needs to confirm and legitimize the re-direct.

“You’re here because….”

Drop icons onto the OpenCCC Login page - (some kind of branding)

Make the following changes to the proxy workflow:

• Using college MIS code, display proxy Sign-In page on a college-branded web page, similar to the college-branded CCCApply pages. Use all existing college-branded banners;

Solution Issues:

The Proxy can't differentiate between individual colleges (origin) if they're from a multi-college

Hotfix 1.9.1 - Rolled to Pilot 

Hotfix 1.9.2 - Pilot release 8.16.18 / Production 8.23.18 5pm TBD

Fix and deploy EPPN > CCCID API and other processes of getting colleges the CCCIDs created during proxy re-redirect

Implement a better way to implement the PROXY

PROXY improvement discussion with Josh on 6/21/18

• Develop a service/process to get the CCCIDs into their system first
• We need to come up with Something we can do to help the colleges get this data
• Use the Download client to help store the CCCID into their Active Directory for new students

EPPN issues
6.2.0 fixes the CCCID duplication issue in Report Center
Bug ticket is open for this:  Also couldn’t filter by MIS code

• EPPN Look-up (API) service is fixed now (check with Charles H.) note: This is in the Central Services (with Messages services, rules engine? Services that can be used by multiple projects)
  Increased the Dynamo DB parameter settings - in place
  and a software fix was made by Charles H. (if Dynamo gets overrun, will try again) - this one is not live yet.

Only tells us about mappings that already exist (pulls a list of CCCID to EPPNs)

A temp work-around fix was put into place by Infiniti so that State Center can pull down their mappings

EPPN/CCCID API 

problem with capacity (we weren't able to accommodate the counts (too many downloading)

EPPN Download Service

1. Proxy account creation or recoveries from redirect to proxy - folks that have hit the the proxy and have to create or recovery. We grab their new account/CCCID and add to Dynamo table. - 
2. Proxy pass throughsSome colleges are passing along and we catch it when they pass.  These are all stuck into the Dynamo DB table. 

(prod-eppn-map) - 

Suggestions from Matt in proxy meeting 8.02.18

Run something at the college (NOT the download process for applications) Franz to apply confluence page 

(short term work-around, Jay Owen, increased Dyamo db params to allow State Center to download EPPNs - with approval from Lou.  

Charles H. fix was more permanent - IF multiple colleges wanted to download EPPN mapping at the same time, even with the increased params there's a chance it could flood the Dynamo again. Increased error handling in the download service code. 

Replace the OpenCCC.net domain with .edu or .org (for legitimacy: .com and .net are all easy to obtain and commonly used in spoofing efforts

• Change "Openccc.net" to ".edu"
• Use college-specific sub-domains to legitimize the re-direct (Consideration of custom subdomains per CCC point of origination in conjunction with (or w/o) #1 above (i.e. "butte.openccc.edu/idp/profile/SAML2/Redirect/SSO?execution=e4s1")

Patty discussed obtaining a .edu domain with Tim on 8/1.  This is not possible; only accredited institutions can obtain a .edu.  Any non-accredited institution that has one now was grandfathered in by EduCause.

Sub-domains using the URL-redirect can be implemented if needed

DECLINED

DECLINED .edu can't be obtained

PENDING sub-domain use

Gather data on Proxy usage

• How many students have to create an account in the Proxy
• How many students have to recover their account in the proxy
• Log data needed - We need data
• How many students just went through without being redirected - 

I have filed ZD-2850 to request that Infiniti make the Prod Proxy logs available in a S3 bucket so that I can download them and parse for this type of information.

I have also asked Infiniti for a dump of the prod eppn_mappings table to see if there is any useful info in there to help answer these questions (IADO-842).

Create and publish Proxy FAQs

Butte would link to this page for students

FAQs and Direct Account Link to create CCCIDs
Email campaign 

We need a marketing campaign on the Proxy - video tutorials, workflow diagrams, 

Matt - calls with the college before they go live with Canvas - go over all implementation details carefully, workflow requirements for students (provide link to the Direct Account Creation) - another message (why your student would see it)

Video should demonstrate quickly and clearly:

If the OpenCCC proxy is triggered when you attempt to access a systemwide application, here's what happens and why.

Three options:

Changes needed to the Sign-In UI

To change the Proxy UI - both the Proxy team and the Apply team need to do work, but OpenApply team would need to do the deployment

The proxy needs to send a parameter to OpenCCC to tell the page what to display.
The Apply needs to do the UI changes and deploy.  Deployment could happen with a rolling restart.(Old code won't be able to handle the new code, (Signature will be invalid.

Requirements:

Apply Jira ticket for the work
Zendesk ticket for the deployment 

Deployment:

Getting into Pilot would be a problem - so we'd have to go right to Prod if we make changes outside of the 6.2.0 release

Can't do RF test - they don't do branching/versioning of old code (due to complexity of our code since last prod/pilot releases)

Test in TEST environment (Vicky roll back to 6.1.0 branch maybe)

Problems with the Current Proxy - Design & Workflow

The Proxy can't differentiate between individual colleges (origin) if they're from a multi-college

Tim added to this design - "You're on your way to CANVAS from <<college>>"