Recommendations of the Attributes for Collaboration and Federation Working Group June 21, 2018 Repository ID: TI.101.1 DOI: 10.26869/TI.101.1 Persistent URL: http://doi.org/10.26869/TI.101.1 Authors: Brad Christ and members of the Attributes for Collaboration and Federation Working Group Publication Date: August 2018 Sponsors: InCommon’s Technical Advisory Committee, Community Trust and Assurance Board, and Steering Committee © 2018 Internet2 This work is licensed under a Creative Commons Attribution 4.0 International License. Table of Contents[a] 1 Executive Summary 3 2 Introduction 4 3 Working Group Process, Research and Analysis 5 3.1 InCommon Participants with Active Researchers 6 3.2 One on One Conversations 6 3.3 Survey 7 3.3.1 Consent 10 3.4 Conclusions 11 4 Recommendations 11 4.1 Make R&S support a requirement in Baseline Expectations 11 4.2 InCommon should build a bigger tent 12 4.3 Add more researchers to Internet2 and InCommon governance bodies 12 4.4 Engage grant funding agencies 12 4.5 Operate an InCommon IdP as a service 13 4.6 Improve support for Service Providers 13 4.7 Improve R&S documentation for IdPs and SPs 13 4.8 Rethink InCommon’s R&S outreach efforts 14 4.9 Remove the legacy “InCommon-only” R&S category 14 5 Appendices 14 5.1 Working Group Charter 14 5.2 One-on-One Interview Questions 15 5.3 NSF Campus Cyberinfrastructure (CC*) Program Criteria 15 5.4 R&S Adoption Rates Within InCommon 16 5.5 Survey Questions 17 5.6 Survey Results 24 ________________ 1 Executive Summary Adoption of the Research and Scholarship Entity Category (R&S) by InCommon participants has not met expectations, with even many research-oriented institutions failing to join. Adoption outside of that group is even lower. Through surveys and interviews, the Attributes for Collaboration and Federation Working Group reached over 130 organizations, examining participation and planned participation in R&S. Over a third of these organizations had no familiarity at all with R&S, encompassing members both large and small. Besides lack of awareness, the most common reasons for why an institution hasn’t joined the category include confusion about the purpose of R&S (e.g. “my institution does not perform research”), other priorities taking precedence, or lack of knowledge about technical requirements. Among organizations currently supporting R&S, there was disappointment expressed in the slow adoption of the Category by both identity providers and service providers. To increase the overall participation in the R&S Category and address the concerns raised by both current and prospective members, the Working Group has developed the following recommendations: * Make R&S attribute support a requirement in Baseline Expectations * InCommon should build a bigger tent * Add more researchers to Internet2 and InCommon governance bodies * Engage grant funding agencies * Operate an InCommon IdP as a service * Improve support for Service Providers * Improve R&S documentation for IdPs and SPs * Rethink InCommon’s R&S outreach efforts * Remove the legacy “InCommon-only” R&S Category These recommendations are listed in order of potential impact on R&S participation. However, each recommendation could be be executed independently and in any order, as there are no prerequisites. The Working Group, however, has concluded that a multifaceted approach is required, no single strategy is going to be sufficient to meet the goal of increased R&S participation. 2 Introduction The InCommon Federation was founded on a principle of privacy protection, based on local authentication and limited default attribute release to Service Providers (SP) with the expectation that campuses would actively manage their Identity Provider’s (IdP) Attribute Release Policies (ARP) and release attributes beyond the default in response to the needs of their various constituencies. However, conservative interpretation of privacy regulations such as FERPA and a common perception by central IT that the primary need for attribute release is determined by contracts for enterprise services has resulted in very restrictive ARPs becoming the norm, which is unsuited to supporting academic collaboration. InCommon created, and REFEDS subsequently globalized, the Research & Scholarship (R&S) Category as a scalable way for campus IdPs to implement an ARP providing a small set of standard user attributes - name, email, a persistent user identifier, and their campus affiliation - to SPs that have been validated as supporting the Research & Scholarship mission. The thought was that for people using R&S SPs, associating their name with their academic work is more important than remaining anonymous. As of this writing, 280 SPs around the world have received R&S validation, providing access to library resources (e.g., Hathi Trust), humanities and social science research, computing resources (e.g., XSEDE, European Grid Infrastructure, Open Science Grid), and data from organizations such as CERN and research projects such as LIGO. The National Science Foundation added their voice to those who actively support R&S by requiring all Campus Cyberinfrastructure proposals to include InCommon and R&S support status and, for those institutions not already supporting the category, their plans to do so (cf. “NSF CC* Program Criteria” section in the Appendices). The EU’s General Data Protection Regulation (GDPR) has understandably focused attention on privacy related practices. A thorough analysis of how attribute release under the R&S Category addresses GDPR requirements was conducted by REFEDS. The net conclusion is that R&S Category implementation contributes to GDPR compliance. While R&S is a great idea and makes federation “just work” for academic collaboration in a user privacy respecting manner, IdPs must opt-in to support it. But not enough have done so; their academic users cannot use federation to collaborate with their peers in research communities whose SPs have been vetted as meeting the R&S criteria. As shown by the “R&S Adoption Rates Within InCommon” graph located in the appendices of this report, only about 15% of InCommon IdPs have opted-in to the REFEDS R&S Category. Even when the legacy form of R&S is included, which is only usable within InCommon, the amount only goes up to 30% of IdPs. Yet almost all InCommon IdPs representing campuses have users who actually use research services. As described below in the section, “InCommon Participants with Active Researchers”, about 81% of InCommon campuses have people that use one of a limited sample of research services. A larger sample of services would, of course, raise that percentage even further. This means that most academic users currently in InCommon are being poorly served by federation. As Duncan Brown, PhD and professor of physics at Syracuse University, notes, “Reliable federation of identity significantly lowers the barriers for collaboration in teams both large and small.” The goal should be that all academic users are well served by federation. The sample above suggests that support of R&S by 85% of InCommon IdPs is what the federation should aim to achieve. InCommon Steering Committee, InCommon Technical Advisory Committee, and InCommon Community Trust and Assurance Board jointly sponsored the Attributes for Collaboration and Federation Working Group to obtain feedback from the community on why more campuses aren’t releasing the Research & Scholarship (R&S) attributes to R&S Service Providers (SPs). The key deliverable for the working group is to make recommendations to mitigate identified concerns or roadblocks and “flip the bit” on R&S implementation, making it an expectation and a requirement (cf. the Working Group Charter section in the Appendices). Otherwise, frustrated research communities may seek less secure and more privacy-invasive alternatives to federation as a means to support their members’ academic activities. Some evidence is already beginning to emerge that this is happening among service providers. Action is required before this becomes commonplace. 3 Working Group Process, Research and Analysis The Working Group gathered data on which to base its observations and conclusions in three ways, described in the following sections. The first provided a lower bound on the number of InCommon campuses that have active researchers. Such schools can remove a barrier their researchers experience by implementing the R&S Category ARP in their campus IdP. The second activity was to speak one on one for an hour with the CIO at each of a sample of InCommon Participants that did not, at that time, implement the R&S Category. These institutions were selected to represent the range of InCommon Participant Types (small, medium, and large campuses and research organizations) and were further constrained to those known to have active researchers. Finally, a survey was constructed and made widely available. In addition to gathering data, the Working Group also consulted analyses of privacy and consent mechanisms in connection with releasing R&S attributes. 3.1 InCommon Participants with Active Researchers The scope of InCommon usage is not always apparent from counts of participating higher education institutions, organizations, and service providers. During a 2017 Technology Exchange Advance CAMP session, an IdP operator explained their lack of interest in the R&S Category because they did not have any researchers at their campus. A member of one research community attending the session had a list of its users handy and checked how many came from that campus. There were 16, which was a complete surprise to the IdP operator. Motivated by this, the Working Group reached out to the Principal Investigators of a small set of research services to ask if they would consent to providing their user lists to determine how many of their users are at InCommon campuses. All consented, listed below. Project Discipline/Purpose Enabling CyberInfrastructure ATLAS-CMS high energy physics OSG CIPRES phylogenetics XSEDE Science Gateway I-TASSER protein structure and function prediction XSEDE Science Gateway Open Science Grid user portal direct OSG access OSG SeaGrid science & engineering applications XSEDE Science Gateway XSEDE user portal direct XSEDE access XSEDE The data provided was processed to normalize users’ organization names, then users from organizations that are InCommon Participants were selected. The result was that 403 of then-current 499 Higher Education Participants were home to 16,102 users of the above services. There are hundreds more such services running as XSEDE Science Gateways, and many more beyond that, spanning many academic disciplines. 3.2 One on One Conversations Working Group members arranged one on one calls with CIOs of seven InCommon Participants chosen among those that did not then implement R&S, that were known to have active researchers, and that represented a range of sizes and types. A set of questions was constructed with which to scaffold each conversation (cf. One on One Interview Questions in the Appendices below), and WG members made notes soon after each conversation. All but one of those contacted were unaware of the R&S Category, which was the biggest barrier to adoption observed by the Working Group. All but one indicated that they would implement R&S after learning about it, but three of those indicated it would be a low priority given other priorities. Two indicated that no faculty had asked central IT about it, contributing to a sense of low priority. In one case poor quality of R&S documentation was given as a reason for lack of adoption. A theme through several of the conversations was that central IT is not the right campus advocate for a program like R&S. They felt they needed to hear from their faculty, researchers, or perhaps librarians, and absent that input they had better things to do. This also explains some of the suggestions the Working Group heard about how to get the word out: to faculty, researchers, librarians via ACRL, and EDUCAUSE. One said don’t use CIOs, another said use CIOs and also message to IAM and Security people. Messaging should include practical examples tailored to audience, address “what’s in it for me?”, and perhaps list all or notable R&S SPs. Other notable statements: * Is federation valuable when ssh is the main use case? * Implementing R&S is what being a good member of InCommon is. * Bigger issue is getting academic healthcare orgs into InCommon. * Knowledge that peers we care about do R&S can be helpful. * Particularly for public universities, in-state peers There are two main takeaways. First is that a different approach is needed to make people aware of the R&S program, and more broadly, the value of federation to academic collaboration. Second is that central IT in some schools takes a proactive approach to enabling academic collaboration of their faculty and researchers, while others prefer to react to specific requests of their faculty and researchers. 3.3 Survey Starting In December 2017, the Working Group began surveying both InCommon and non-InCommon members regarding participation and planned participation in the Research and Scholarship Category. The principal method of outreach included emails sent to the InCommon participants list as well as emails to two Northwest regional collaborations, the NorthWest Academic Computing Consortium and the Orbis Cascade Alliance. Copies of the survey questions and the aggregated results are included in the appendices of this report. Just over 130 institutions and organizations have taken the survey, with 91% of them being InCommon members. A wide range of institutions and organizations responded, including large public research universities, small private institutions, service providers, and collaborative groups. The results of the survey indicate that awareness of the Research & Scholarship Category is high among active participants in InCommon, but low to almost non-existent for institutions that, while members, are not actively participating in the federation, Internet2, or other technically-focused higher education collaborations. Just about a third of respondents indicated no familiarity with the R&S Category. Among survey respondents, slightly over 40 percent already participate in the Research & Scholarship Category with just under 30 percent more of the respondents definitely or probably planning to join the Category. The remaining 30 percent of respondents, however, are either definitely not or probably not planning to join. ________________ Among institutions that are not planning to participate in the Research & Scholarship Category, the most commonly cited reason was lack of familiarity. Besides lack of awareness, the most other common reasons for why an institution hasn’t joined the Category include confusion about the purpose of the Category (i.e. “my institution does not perform research”), other priorities taking precedence, or lack of knowledge about technical requirements. ________________ Institutions not planning to join the Research and Scholarship Category were asked what would cause them to reconsider their decision. Most institutions would like to see additional information about the Category, such as a listing of the services available as part of the Category, a list of their peers currently participating, better technical documentation, and information about risk. 3.3.1 Consent The use of “consent” (presenting a form to a user with the “option” of providing their attributes to an SP - whether R&S or others), is often suggested as a way to mitigate data stakeholder concerns about implementing R&S. The working group, however, cannot make a firm recommendation either way on the use of a consent mechanism for the following reasons. Under the EU’s GDPR, consent is contra-indicated for R&S use cases. An academic using R&S resources in their work presumably needs them for their work, unlike the same person choosing to use a consumer cloud service like Facebook. If a user wants to access a resource pursuing the “legitimate interests” of the organization, ie, doing academic work, and that service reasonably requires certain attributes in order to deliver the service, the user may feel pressured to consent to their release, which contradicts the GDPR requirement that user consent can only apply when it can be freely given. In those cases, the recommendation under the GDPR is to provide notification instead. Moreover, the R&S Entity Category, without consent, positively contributes to user privacy under GDPR by identifying resources whose access falls under the legitimate interests justification under GDPR, and also implements the principle of data minimization by only releasing R&S attributes, all of which are reasonable for an R&S service. A well-engineered consent tool, such as the Consent-informed Attribute Release System, may be useful outside of the R&S Entity Category, if an institution, for example, decides on a default attribute release policy for ALL service providers. In that case, R&S attributes would be released automatically (no need for consent by individual users), but accessing non-R&S SPs would give the user a choice of which attributes, if any, to release. This puts the decision about which attributes to release, whenever possible or whenever required by regulation or policy, in the hands of the user. 3.4 Conclusions * The most common reason why a campus has not implemented support for R&S is lack of awareness. * Some campuses assign a low priority to implementing R&S until they receive a request from a member of their faculty or perhaps from the Library or Research Office. * The above two statements also apply to InCommon more broadly, i.e., they are not familiar with the value InCommon may represent to their campus and hence do not make it a priority. * Some campuses lose “institutional memory” of InCommon when key IT staff turnover. * InCommon’s messages often aren’t seen by the right people. 4 Recommendations 4.1 Make R&S support a requirement in Baseline Expectations InCommon strongly recommends R&S attribute release by its IdP Participants (cf. https://www.incommon.org/federation/attributes.html), although how broadly this is understood is not known. The WG recommends that a requirement to do so be added to a future version of the Baseline Expectations for Trust in Federation. Additionally, the TIER Shibboleth IdP distribution should have R&S Attribute Release Policy enabled by default. 4.2 InCommon should build a bigger tent The principal reason that most InCommon members have not joined the Research and Scholarship Category is simply awareness. There is no sufficiently effective means to communicate with IT leadership of current and especially potential InCommon members. InCommon’s messages are not reaching the right audiences, which includes CIOs, Registrars, Research Offices, and faculty researchers. InCommon needs to better market itself and the R&S Category, appealing to both the broader non-Internet2 affiliated InCommon membership along with prospective members. These outreach efforts should include working with other higher education focused conferences and organizations like EDUCAUSE, the Campus Research Computing Consortium (CaRC), Council on Library and Information Resources (CLIR), and the Research University CIO Conclave (RUCC). Other opportunities could include webinars, newsletters, and outreach at academic (non-IT) conferences. A final suggestion would be for InCommon to offer a new member orientation or member connect service, which would pair veteran members with new members or those that have experience staff and/or leadership turnover. 4.3 Add more researchers to Internet2 and InCommon governance bodies At many institutions, InCommon and the R&S Category are not given priority because CIOs and IT organizations do not focus on proactively enabling academic collaboration as a core part of their mission. They, instead, wait to hear from campus stakeholders like researchers, librarians, and research offices before acting. InCommon should not attempt to directly change that; however, Internet2 and InCommon rely mainly on CIO input to guide decision making and this may result in shifting InCommon’s (and Internet2’s) mission away from research and academic collaboration to some degree. Broader representation on Internet2 and InCommon’s governance bodies from researchers and other important stakeholders may help produce balance guidance as well as drive members to more rapidly adopt initiatives like R&S. 4.4 Engage grant funding agencies A recent example of the impact of engagement with funding agencies is the new requirement by the National Science Foundation to include InCommon and R&S support status and plans as part of any proposal to their Campus Cyberinfrastructure program (cf. “NSF CC* Program Criteria” section in the Appendices). By integrating InCommon, R&S, and Baseline Expectations into the criteria for proposals submitted to funding agencies, the gap between central IT and researchers can be narrowed. InCommon should engage with funding agencies to emphasize the importance this infrastructure plays in enabling collaboration by streamlining integration with research applications. 4.5 Operate an InCommon IdP as a service Far more impactful than a TIER default, InCommon should provide an IdP as a service (IdPaaS) with R&S attribute release enabled. Rather than hosting this service directly, InCommon could potentially work with a commercial partner, as modeled by the existing, and successful, Certificate Service. IdPaaS is of value especially to campuses that wish to rely on commercial authentication or IdM products since they would not need to operate their own Shibboleth IdP - their authentication and attribute service (LDAP or Active Directory in most cases) could instead be connected to InCommon’s IdPaaS, and the campus need not be responsible for maintaining any aspect of their IdP’s operation. An InCommon IdPaaS will make federation easier for more current and prospective InCommon Participants, and the more that campuses rely on it, the easier it is for InCommon to directly improve the utility of the federation for enabling research and academic collaboration, rather than undertaking exhaustive and largely ineffective change management campaigns. R&S and multi-factor authentication are two capabilities that could be brought to IdPaaS customers that directly bear on research and academic collaboration. 4.6 Improve support for Service Providers Despite their importance to the R&S Category, InCommon support for Service Providers appears to be lacking. Awareness of the R&S Category among SPs is also low. Unlike Identity Providers, however, SP operators usually immediately understand the value of joining the Category. As one SP operator stated, “It is a huge pain (and not possible) to talk to all the IdP operators, and sometimes not even successful at that, to get even just a username (eppn, targeted id, just something!) passed along.” Other SP operators have noted difficulty with getting registered for the R&S Category. Additional and specific outreach efforts to Service Providers will need to be made by InCommon to ensure the success of R&S. Some of these efforts could include clarifying and simplifying the SP registration process, providing feedback during the process, and directly contacting existing SPs, asking them to join the Category. 4.7 Improve R&S documentation for IdPs and SPs Although some improvements to the R&S documentation have been recently made, the paths for Identity Providers and Service Providers should be separated. The documentation for Identity Providers needs to be as straightforward and easy to follow as possible, with links to additional documentation for exceptions and other special use cases. Further, since declaration of R&S support by IdPs is self-attested, the Federation Manager should be enhanced to enable Site Admins to self-declare without filling out a form and subsequent manual processing by InCommon staff. 4.8 Rethink InCommon’s R&S outreach efforts For communication and outreach purposes, “Research & Scholarship Entity Category” isn’t very catchy and is confusing for many institutions (e.g. “We don’t do research.”) Use a new tag line, perhaps “Enable Collaboration Services.” 4.9 Remove the legacy “InCommon-only” R&S category Currently, two options are given to InCommon participants to support R&S: InCommon-only or all R&S service providers. Participants that adopted the early, InCommon-only, R&S Category may not realize that their IdP does not support international R&S SPs as well as US-based ones that require REFEDS R&S. Since the REFEDS R&S Category provides similar privacy protection as Section 9 of the InCommon Participation Agreement, InCommon should undertake to remove these impediments by removing the old category and converting legacy R&S IdPs to the REFEDS standard. 5 Appendices 5.1 Working Group Charter The Attributes for Collaboration and Federation Working Group will: 1. Develop (and Execute if time permits) a Roadmap for Adoption of Attribute Release Policies (using the draft Steering Roadmap as a starting point) 1. Outreach [Steering] - Identify the needed stakeholder groups, and identify or create the content and use cases that can educate those groups. 2. Survey [Working Group] - Possible survey of the community on why attributes are NOT being released - identify obstacles (maybe webinar?) - completed by campus stakeholders as well as IAM person. 3. Consent [Working Group] - Determine where “Consent” fits into the roadmap 4. Communication [ALL] - Create a communication plan to inform InCommon Participants of recommendations and steps being taken to enable basic federated access 1. Recommend a default Attribute Release Policy (ARP) for InCommon participants 1. Global R&S for R&S SPs (See: Research and Scholarship Category and the R&S Attribute Bundle) 2. Recommended ARP for all other SPs - in addition to, or a subset of, R&S 1. Review and enhance online content for IdP admins so they have a clear set of steps to follow to implement the desired approach (including possibly consent) once campus policy decisions have been approved. 2. Discuss making some level of attribute release (e.g. R&S) part of a future version of the AAC’s Baseline Expectations for Trust in Federations. 5.2 One-on-One Interview Questions 1. Are you aware of the Research and Scholarship Category? 2. If you were previously aware of the R&S Category, are you planning to participate? If not, why not? If so, why? 3. If you were not aware of the R&S Category, is this something you would be interested in joining? If not, why not? If so, why? 4. If you are planning to join the R&S Category, when do you think you’ll join? 5. How should Incommon/Internet2 raise awareness of the R&S Category? If objections/reasons for not joining are technical in nature. 1. What type of technical assistance would be helpful to your organization? 2. Would better or more clear technical documentation help? If objections/reasons for not joining are philosophical in nature (i.e. my institution doesn’t do research). 1. Would additional information about the R&S Category be helpful? 2. Would information about research and collaborative work occurring at similar non-research based institutions be helpful? 3. Would information about the service providers available through the R&S Category be helpful? If objections/reasons for not joining are risk-based. 1. Would information about the type/nature of the data released be helpful? 2. Would a risk assessment from Internet2/Incommon be useful? 5.3 NSF Campus Cyberinfrastructure (CC*) Program Criteria In November of 2017, the National Science Foundation included Criteria into their Campus Cyberinfrastructure (NSF CC*) relating to InCommon, R&S, and Baseline Expectations: The plan should include the campus status and plans with respect to federated identity and specifically InCommon, including: if the campus is registered with InCommon as supporting the Research and Scholarship (R&S) Entity Category to streamline integration with research applications (see https://spaces.internet2.edu/display/InCFederation/Research+and+Scholarship+Category ); and if the campus meets the InCommon Baseline Expectations for Trust in Federation (see https://spaces.internet2.edu/download/attachments/110336475/TI.34.1-BaselineExpectations-v1-2016-09.pdf?api=v2 ). https://www.nsf.gov/pubs/2018/nsf18508/nsf18508.htm 5.4 R&S Adoption Rates Within InCommon The following graph shows uptake of the REFEDS R&S Category for IdPs and SPs and legacy InCommon-only R&S IdPs as of March 2018. With about 500 IdPs in InCommon, that’s about 16% REFEDS R&S and a similar percentage of legacy R&S IdPs. The total number of IdPs continues to grow, but those supporting R&S (REFEDS or legacy InCommon) has remained steady since 2014 at around 30% of IdPs. ________________ 5.5 Survey Questions Q1.1 The InCommon federation has three standing committees that help guide federation operations and activities: The Steering Committee, The Technical Advisory Committee, and the Community Trust and Assurance Committee. Occasionally, these committees spin up working groups to perform targeted analyses and direction setting. This is a survey from the Attributes for Collaboration and Federation Working Group, which is sponsored by all three of those committees. You may review the charter for this group here. As part of this group’s work, we are soliciting information from both members and potential members of InCommon. This poll is intended to give the working group a sense of how institutions think about support for the InCommon Research and Scholarship Category (R&S). Learn more about R&S here and the R&S "bundle" here. Informed Consent Statement: Brad Christ of the Information Technology department at Southern Oregon University is conducting this research. If you have questions about the research project and/or you would like to see the results of this project, contact Brad Christ at (541) 552-6451 or brad.christ@sou.edu Your participation is voluntary and you may stop taking this survey at any time without penalty. The survey should take less than 10 minutes to complete. By continuing, you are confirming that you are at least 18 years old and are giving your informed consent to participate in the study. Q1.2 Institution Name ________________________________________________________________ Q1.3 Is your institution currently a member of InCommon? * Yes (1) * No (2) Q1.4 How familiar are you with InCommon? * Extremely familiar (1) * Very familiar (2) * Moderately familiar (3) * Slightly familiar (4) * Not familiar at all (5) Q2.1 How familiar are you with the Research and Scholarship Category? * Extremely familiar (1) * Very familiar (2) * Moderately familiar (3) * Slightly familiar (4) * Not familiar at all (5) Q2.2 Check all that you knew prior to this survey about the Research and Scholarship Category: * The Research and Scholarship Category enables access to global services offered by services from the Modern Language Association, CERN, the NIH, and many others. (3) * Research and Scholarship Category service providers are reviewed by federation operators, including InCommon, before being allowed to participate. (1) * Attributes released under the Research and Scholarship Category often fall under FERPA directory information for many institutions. (2) * By default, attributes from participating institutions are only released to service providers designated and approved under the Research and Scholarship Category. (6) * Attribute release under the Research and Scholarship Category can be limited to only InCommon service providers. (4) Q2.3 How should InCommon raise awareness of the Research and Scholarship Category? ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ Q2.4 Does your institution already participate or is it planning to participate in the Research and Scholarship Category? * Already participate (5) * Definitely yes (1) * Probably yes (2) * Probably not (3) * Definitely not (4) Q2.5 Why not? (select all that apply) * Don't see the value in the R&S Category (1) * Not familiar enough with the R&S Category to decide affirmatively (2) * My institution doesn't do research (3) * Unsure of the technical requirements (4) * Risk-based concerns about participation (5) * Other priorities take precedence (6) * Other: (7) ________________________________________________ Q2.6 When do you expect to join the Research and Scholarship Category? * 1-3 months (1) * 3-6 months (2) * Within 1 year (3) * Other: (4) ________________________________________________ Q2.7 What, if any, anything, would persuade your institution to join the Research and Scholarship Category? (select all that apply) * Information about participation and services available through the Research and Scholarship Category (1) * Information about other, especially non-research based institutions, participating in the Research and Scholarship Category (2) * Additional technical information/documentation (3) * Technical assistance (4) * Information about risk (5) * Other: (6) ________________________________________________ Q2.8 Anything else you'd like to add? ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ Q3.1 Why hasn't your institution joined InCommon? (select all that apply) * Don't know enough about InCommon (1) * Annual cost is too high (2) * Value of InCommon seems very low for my institution (3) * We don't have the requisite infrastructure in place (directory, SAML single-sign-on, etc.) (4) * My institution doesn't possess the technical knowledge or expertise (5) * Planning to join, but haven't yet (6) * Other: (7) ________________________________________________ Q3.2 What, if any, anything, would persuade your institution to join InCommon? (select all that apply) * Information about participation and services available through InCommon (1) * Information about other, especially non-research based institutions, participating in InCommon (2) * Additional technical information/documentation (3) * Technical assistance (4) * Information about risk (5) * Other: (6) ________________________________________________ Q3.3 Anything else you'd like to add? ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ ________________________________________________________________ 5.6 Survey Results Is your institution currently a member of InCommon? # Answer % Count 1 Yes 92.86% 91 2 No 7.14% 7 Total 100% 98 ________________ How familiar are you with InCommon? # Answer % Count 1 Extremely familiar 25.51% 25 2 Very familiar 30.61% 30 3 Moderately familiar 35.71% 35 4 Slightly familiar 8.16% 8 5 Not familiar at all 0.00% 0 Total 100% 98 ________________ How familiar are you with the Research & Scholarship Category? # Answer % Count 1 Extremely familiar 18.99% 15 2 Very familiar 22.78% 18 3 Moderately familiar 7.59% 6 4 Slightly familiar 17.72% 14 5 Not familiar at all 32.91% 26 Total 100% 79 ________________ Check all that you knew prior to this survey about the Research and Scholarship Category: # Answer % Count 3 The Research and Scholarship Category enables access to global services offered by services from the Modern Language Association, CERN, the NIH, and many others. 21.86% 40 1 Research and Scholarship Category service providers are reviewed by federation operators, including InCommon, before being allowed to participate. 20.77% 38 2 Attributes released under the Research and Scholarship Category often fall under FERPA directory information for many institutions. 17.49% 32 6 By default, attributes from participating institutions are only released to service providers designated and approved under the Research and Scholarship Category. 21.86% 40 4 Attribute release under the Research and Scholarship Category can be limited to only InCommon service providers. 18.03% 33 Total 100% 183 Does your institution already participate or is it planning to participate in the Research and Scholarship Category? # Answer % Count 2 Probably yes 25.64% 20 3 Probably not 25.64% 20 1 Definitely yes 3.85% 3 4 Definitely not 3.85% 3 5 Already participate 41.03% 32 Total 100% 78 ________________ Why not? (select all that apply) # Answer % Count 1 Don't see the value in the R&S Category 6.45% 2 2 Not familiar enough with the R&S Category to decide affirmatively 35.48% 11 3 My institution doesn't do research 19.35% 6 4 Unsure of the technical requirements 6.45% 2 5 Risk-based concerns about participation 6.45% 2 6 Other priorities take precedence 9.68% 3 7 Other: 16.13% 5 Total 100% 31 When do you expect to join the Research and Scholarship Category? # Answer % Count 1 1-3 months 4.76% 1 2 3-6 months 0.00% 0 3 Within 1 year 38.10% 8 4 Other: 57.14% 12 Total 100% 21 ________________ What, if any, anything, would persuade your institution to join the Research and Scholarship Category? (select all that apply) # Answer % Count 1 Information about participation and services available through the Research and Scholarship Category 25.71% 9 2 Information about other, especially non-research based institutions, participating in the Research and Scholarship Category 31.43% 11 3 Additional technical information/documentation 17.14% 6 4 Technical assistance 5.71% 2 5 Information about risk 11.43% 4 6 Other: 8.57% 3 Total 100% 35 ________________ Why hasn't your institution joined InCommon? (select all that apply) # Answer % Count 1 Don't know enough about InCommon 20.00% 2 2 Annual cost is too high 0.00% 0 3 Value of InCommon seems very low for my institution 40.00% 4 4 We don't have the requisite infrastructure in place (directory, SAML single-sign-on, etc.) 40.00% 4 5 My institution doesn't possess the technical knowledge or expertise 0.00% 0 6 Planning to join, but haven't yet 0.00% 0 7 Other: 0.00% 0 Total 100% 10 ________________ Q3.2 - What, if any, anything, would persuade your institution to join InCommon? (select all that apply) # Answer % Count 1 Information about participation and services available through InCommon 42.86% 3 2 Information about other, especially non-research based institutions, participating in InCommon 14.29% 1 3 Additional technical information/documentation 14.29% 1 4 Technical assistance 0.00% 0 5 Information about risk 0.00% 0 6 Other: 28.57% 2 Total 100% 7 Page [a]refresh after accepting changes to Recommendation headings, if you do.