An authentication platform

Many resources require password-authenticated access, whether to track the academic progress of students, store user preferences, or control and monitor service usage. Naturally, users would much rather have a single username and password which grants access to all resources instead of separate credentials for each service, and this is the aim of Unified Sign On (USO).

Under USO, every student and member of staff in a school is issued with a personal user account. For pupil protection, usernames are based on first and last names plus local authority, but do not reveal age, gender or school information. This has the added benefit that usernames do not change when people move between Atomwide supported establishments in the same authority.

A secure web-based management facility allows accounts to be added, edited and retired. To maintain the accuracy of data following its adoption, USO supports automated update tools that extract information directly from a school’s MIS.

An identity provider

USO must be able to respond appropriately to any subsequent query to determine whether or not to grant, or advise of the eligibility for, access to secured or otherwise restricted services, applications and resources, and to use the profile data to personalise the end user’s experience of online applications wherever appropriate.

In many, but not all, instances, the aim is to enable a user to access services wherever they are entitled, but without revealing any more of the user’s status, location, or identity, than is absolutely necessary and as previously agreed between Atomwide and the provider. This applies equally whether or not the application being accessed uses Shibboleth.