Users' Blackbaud ID being added to UNWANTED Blackbaud service ?

Eric Wong

Hello all,


We have been putting a lot of efforts to prepare for the Blackbaud ID SSO Authentication (replace our existing LDAP authentication) before the deadline of this summer.


It comes to my attention that having the users' Blackbaud ID created will also mean setting up profile for them on Blackbaud products. They can sign-in www.blackbaud.com, community.blackbaud.com ...... That is completely unwanted.


One may said I'm thinking too much; how possible could the users realize that they can login to other blackbaud.com websites? The fact is...never under estimate what our users will do. I can guarantee someone out of our 3600 users will point it out within a week.


One may also said I'm too sensitive; what could be the problem of having 3600 users being able to login to other blackbaud.com websites? The situation is...Blackbaud is adding our users to the service/platforms we did not ask for nor authorized.

Imagine an innocent Grade 3 student could login community.blackbaud.com and input his/her personal information.





What's worse, look like anyone who has Blackbaud ID will be searchable.

That is completely unacceptable. Our students would be looked up and connected by strangers. I am sure our school will not allow that.









I sincerely hope this post/message can initiate gathering your feedback and comments, and even being escalated our concerns to the Blackbaud development teams.


Thank you for reading.

Eric




 

Janet Wittenberg

Hi Eric,

I will look into this right away.  Although we are aware that a user could find their way to the user profile at www.blackbaud.com, since they have no other permissions related to your organization, we did not anticipate they would have access to any other services.

I agree giving students (or parents, or other constituents who do not related directly as customers of Blackbaud) access to the Blackbaud community is problematic for all of us.  Stay tuned and I will post back more information here.

Eric Wong

Hello Janet,


Thank you for your prompt reply. I can see community.blackbaud.com is blocking my test user accounts from logging in.

I hope there will be solutions for our concerns on this post as well as single-sign-out.


Thanks a lot.

Regards

Eric



 

Ray Bergman

Hi Eric Wong‍ 


One thing to consider is that as a peer-to-peer community, we don't allow test accounts in the Blackbaud Community.  Each user that joins community is, in fact, a person.  We do our best to police those that register accounts under screen names, fake names, or generic terms such as the name of their business.  Users here deserve to know who they are speaking to and we stand behind that policy.


Regards,


Ray Bergman

Blackbaud Community Management Team

Ray.Bergman@Blackbaud.com

Eric Wong

Hello Ray,


? Thank you for replying. I am glad you talk about Blackbaud Community policy. We have 2 questions to the Blackbaud Community Management Team:

1. Do you aware of the Blackbaud ID accounts were provisioned to the Blackbaud Community without the users physically clicking through the actual Community sign-up process?
2. Is there any part of the terms or policy that allows Blackbaud to register users to the Blackbaud Community without the users' authorization or consent?

As stated in this post, we did not create those test accounts on Blackbaud Community. We are working on the transition of Education Management (formerly “ON” products) login page to authentication users via Blackbaud ID SSO instead of LDAP integration. https://community.blackbaud.com/forums/viewtopic/502/44627 

I wish you would have never needed to spend time on cleaning up the test accounts we just use for our On Suites. 


I have a colleague who has never registered nor joined Blackbaud Community, but his Backbaud ID profile was being added to Blackbaud Community without his attention. His profile with name is now become searchable.

There is another colleague pointed out that she has been requested to be added as friend by other Blackbaud Community members. She wondered how could they find her.


Janet has replied me separately. Blackbaud should allow the customers to keep using the existing LDAP Authentication until the issues have been addressed and resolved.


Thank you for reading.

Regards

Eric


 

Crystal Bruce

Jumping in, Eric!


Questions:

1) In order to join the Blackbaud Community, there is a 4-step onboarding process. Members can use their Blackbaud single sign on, but they'd still have to go through onboarding manually, so nothing about it is automatic.


2) Absolutely not. Blackbaud does not auto register members to the Community without their authorization or consent.


Can you email me the colleague's name? crystal.bruce@blackbaud.com. I can go in and see the actions he or she took.


Members can find other members by searching for them by name under the "members" section.


Thanks!