3

I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, he has verify that he posesses email account that ends with ...@stanford.edu. Sometimes department may have they own subdomain like ids may end with ...@cs.stanford.edu.The people that need to be allowed access to application could be faculty & students as well.

Is this a solid way of determining whether the person belongs to the claiming institute ? Any issues with this & how could this be made more better ?

Improve this question
0

4 Answers 4

Reset to default
4

I know several universities/collages that leave email addresses to their alumnus. So only thing that you can check is that the person WAS associated with the university at some point of time.

A

Improve this answer
1
  • This is correct. I've been out of uni for many years now, yet I still have access to my uni email account, and still get monthly emails from the student union department!
    – Polynomial
    May 29, 2012 at 14:46
3

The most commonly used technique is to send an email to that address, containing a one time link they need to follow to confirm they received the email.

There are potential flaws with this (such as someone who can gain access to the email without actually being a member of that institution) but as a simple solution which doesn't require you to interface with the databases of the institutions involved or carry out manual confirmation it can be effective.

What are the risks involved if the wrong people gain access? Is it a major issue, or are you just trying to prevent opportunist individuals who may wish to freeload on your service?

Improve this answer
2
  • I think the question might be partially asking how to check whether an email address is from *@stanford.edu when it could be *@cs.stanford.edu or *@xyz.stanford.edu and still be valid, i.e. you need simply to specify valid addresses as being *@stanford.edu and *@*.stanford.edu, surely?
    – Savara
    May 29, 2012 at 9:37
  • If previous contact with the individual is available (i.e. they logon to the website to create an account) you can collect a challenge question/answer to be entered when the email validation link is clicked. However you would need to also consider what occurs with a password reset etc.. If the user is not asked for a challenge when resetting a password it might be a moot point to ask for one on email validation.
    – Bernie White
    May 29, 2012 at 9:50
0

Microsoft is working on a technology called UProve that allows people to keep privacy controls while letting certain websites know if they are a student, citizen, married, etc. Each component of the information is secured and in the users control (though they can't tamper it).

In this case they could share the studentID with your website.

http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/uprove.aspx

Update

Verified, anonymized student IDs is on the roadmap for this project https://github.com/zeropki and https://twitter.com/zero_pki

Improve this answer
-1

As far as I know many Hellenic Univercities provide their own login panel. So you can implement various methodologies - strategies depending the univercity (I assume that other univercities offer a similar solution).

The weakest one is to verify via email and periodically need to re-verify their emails (eg. once a year). The strongest one is to verify via univectity's login panel. Also you can provide multiple screens for example on the first one choose the university and on the second one to either offer a directly to login or register depending the univercity.

Also many Univercities offer VPN connections (as far as I know in Hellenic Univercities) so you can verify if some user is connected via a univercity in a multi factor login:

  • First of all check the ip if belongs to a univercity.
  • Then the user offers the credentials either for registration or login.
  • Login should permited if an ip belongs to a univercity.

An alternative approach you can keep a regex/wildcarded database with the valid univercity emails and combined with the approach of verifying one per year their emails shoud be a practical and viable solution for you.

Furthermore, in the case of using seperate authentication mechanism depending on univercity, I suggest to use strategy software engineering pattern and depending the univercity to apply different registration mechanisms. You can choose the strategy via a factory pattern and keeping a distingtive name where the list of univercities is stored eg. on the database store an extra column named auth_mechanism and if univercity supports OAUTH authentication & authorization mechanism then store the OAUTH value.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.