How does the June 26, 2019 release affect your users with Blackbaud ID?

Janet Wittenberg

If you are already transitioning to Blackbaud ID, be aware that this release changes who logs in with Blackbaud ID. However, we’ve taken steps to ensure users’ login experiences are not disrupted until you take further action.
 
With the Wednesday, June 26th release, we are making changes to Blackbaud ID authentication so individual users can be enabled, and we’ve removed the requirement to change the authentication method of all users in a particular role.
 
With these changes, you will now run a Connect process on users to enable them for BBID and set their Blackbaud ID usernames in one step. Enabling roles is no longer required and users must have a Blackbaud ID username in order to be converted to a BBID-authenticated user at their next log in.
 
Follow the instructions below to make sure your users are still setup correctly for the login experience you expect on or after June 26th.
 
As of June 26th: Go to Core > Security > Blackbaud ID Authentication and view the list of Unregistered users.
Filter the list by Role. 


 

• For users in roles which were already enabled to use Blackbaud ID, but have not yet logged in for the first time, if they do not have a Blackbaud ID username, you should review them in the Unregistered list. Select them and use Connect to setup their Blackbaud ID username from their contact email and change their next login experience to use Blackbaud ID.  Users that did already have a Blackbaud ID Username set from the old “Assign Username” task and were in Awaiting Response status should still be there and require no action.  They should use the email address in Blackbaud ID Username for their next login attempt. 
• For users in roles which were not yet enabled to use Blackbaud ID, you will use the new bulk management tasks to reset the Blackbaud ID username and Connect the users when you are ready to change their login experience.  
  • We’ve used a data fix to remove the Blackbaud ID username. This enables those users to continue to login with their old credentials (username and password) for now.  We did this to ensure your school stayed in control of whether any user’s login experience would change, rather than automatically changing with the monthly release. 
  • To change their login experience, find users with Unregistered status and then Connect them in bulk to reset their Blackbaud ID username to their contact email.
• Users that have already successfully logged in with Blackbaud ID are in the status ‘Registered’ and are unaffected by this release.

 
If you had planned to enable roles for Blackbaud ID on a particular date in the future, on that date you will now use the Bulk task to Connect those same users.  Remember you can still filter by role to find those users in the Unregistered list.   Be sure the contact email is set correctly for those users.  Contact email will become the email address they’ll use on the login page to login to your Education Management solution.
 
We certainly hope after this transition step you will find the new page a better experience to manage users and Blackbaud ID.

 

Janet Wittenberg Blackbaud

Here are some initial questions and answers:


Q1. We only want to manage Teacher and Student via SSO. So everyone else that is left in Unregistered should be managed by ON AUTH - Right?

A - Correct. Users who authenticate with legacy Username and Password will remain in Unregistered status.


Q2. Is there anything we need to do with ON Auth users, or will stay the same - meaning nothing we need to do?

A. There is no action to take an any existing users.


Q3. Any new student that gets enrolled, will they be connected automatically (Awaiting Response status)? Same for Faculty?

A.  New users added that should be authenticated via Blackbaud ID will appear in the Unregistered list until you "Connect" them with a Blackbaud ID Username. You can also use the Data Import under User Management > BBID Username to accomplish this. We are looking in to making the Connect an option via the Add User task so that you can do it at the same time.

Although this is an 'extra' step - it is the most important step so that your SSO users can start right away by typing their full email address on the login page and authenticate via your IdP.


 

Ademola Popoola

Janet -


Thanks for the information.


Please point me in the direction of how to handle graduating students who used a school email account for BBID/SSO authentication. Those email accounts will be suspended a few months after graduation. These students will now be classified as alumni and will need another method for accessing ON/EMS.


Is there available documentation for tackling this use-case?


Best!

Brian Hoyt

In the release notes from today https://www.blackbaud.com/files/support/helpfiles/education/k12/release-notes/Content/ReleaseNotes/release-notes.html there is very detailed response to the graduating students issue for BBID.