Access Control

What is Access Control

The Access Control feature allows for easy and efficient control over who affiliates with your organization. This access control feature limits who can access courses with your organization's subscription by cross-checking that the email address the learner provides while affiliating with your organization is from your authorized domain. The domain is the last two segments of an email address; for example in "tester@campus.state.edu", the domain is "state.edu" and would include subdomains such as "campus.state .edu" and "office.state.edu". The Access Control by Email Domain option utilizes the organization's email address field in the institution profile, not the learner’s primary email on the account, to allow learners to affiliate with multiple organization. There is no cost for utilizing Access Control.

For the most autonomous approach to Access Control, CITI Program recommends utilizing our Single Sign-On (SSO) option.

This article will cover:

• Access Control by Email Domain Options
• Organizational Requirements to Use Access Control by Email Domain
• Access Control by Email Domain Administrator
• FAQs
• Alternative Access Control Options (SSO)

Access Control by Email Domain Options

Access Control by Email Domain is an option that restricts user affiliation with an organization based on their email address. When a user creates an account on the website, they can request affiliation with an organization to access specific courses offered by that organization. However, to maintain control over who can affiliate, the organization administrator sets approved email domains (e.g., .edu, .org, or a specific company domain). Only users with an email address matching one of these approved domains can affiliate with the organization, ensuring secure and appropriate access to its courses.
 

• By default, when learners affiliate with a new institution they are presented with the message below

 

• On the institution profile page it is recommended to enter their institutional email address, but not required

 

• When the Access Control by Email Domain feature is turned on, the learner is requested to enter an email address from the listed organization's authorized domain. In this example we are using institution "Access Control Test" and domain "demo.test" or ".test". [new affiliates will need to validate their emails]

The CITI Program has developed three versions of Access Control by Email Domain to allow flexibility in how your institution administers this feature.

Warn
This option provides a request for the learner to enter an email address from the authorized domain but will allow learners who do not enter an authorized domain email address to affiliate and take courses with no intervention from the organization's administrator. The administrator can request a list of learners affiliated without an authorized domain email address from the CITI Program Helpdesk for review.

Message when Warn option is selected and email address entered is not on authorized domain list

Screen
The learner will be placed in a pending queue if they affiliate with an email address not on of your authorized domain list. Designated screening organizational administrators will receive an email when pending requests are in the queue and can review the pending requests for manual approval or denial to affiliate. The learner will not be able to access the courses at your institution until they are approved. If denied, their affiliation will be removed. 

Message when Screen option is selected and email address entered is not on authorized domain list

Strict
The learner must enter an email address from the authorized domain in order to proceed with affiliation or courses. There is no way for the learner to proceed with affiliation without an authorized domain email.

Message when Strict option is selected and email entered is not on authorized domain list

Organizational Requirements to Use Access Control

There are several things to consider when selecting what type of Access Control is best suited for your organization.  The chart and text below detail the organizational requirements and suggestions for each of the options of Access Control.

Warn is a good option if you have many affiliates without an authorized domain email,  you do not want to administer pending requests, or would like to use more specific verbiage by listing your organization's domain in the request for an institutional email without restricting access.  

Requirements

• At least one authorized organizational email domain. 

Screen is a good option if you have some affiliates without email addresses at your authorized domain and can dedicate administrative time to review pending affiliation requests.

Requirements

• At least one authorized organizational email domain
• Identify at least one organizational Access Control by Email Domain administrator at your organization to administer pending request if using the Screen option
• Provide informational text ,specific to the organization, with who to contact at the organization for Access Control by Email Domain issues if using Screen or Strict options. Information should include a name, email, and phone number for learner's to contact to resolve organizational level issues regarding access control 

Strict is a good option if all your affiliates will have an email address from your authorized domain. 

Requirements

• At least one authorized organizational email domain
• All learners must have an email address at the domain if using Strict option
• Provide informational text ,specific to the organization, with who to contact at the organization for Access Control by Email Domain issues if using Screen or Strict options. Information should include a name, email, and phone number for learner's to contact to resolve organizational level issues regarding access control
• Clean-up of current records required if using Strict option. Our help desk staff can assist with this

Single Sign-on (SSO) is a good option for organizations that would like a more automated/unmanned approach. SSO will redirect an organizations affiliates to the organizational login portal where they will be required to enter credentials issued by the organization directly. (i.e. organizational email/username/password)

Technical Requirements/Additional Information

• SSO General Information
• SSO Technical Information

Access Control Administrator

Screen Option Only

Your organization will need to assign an administrator for Access Control by Email Domain when utilizing the Screen option. The role of the administrator is to work with-in the CITI Program interface to manage the pending requests to affiliate with your organization when the email address entered is not on the authorized domain list. 

When using the Screen option, the learner is placed in a pending status and receives the following error message when an email address not from the authorized email domain is entered. 

The learner will see the organization listed as pending on their course page until approved or denied by an administrator.
 

Clicking on Pending will present the learner with a message that their request to affiliate is pending until administrator approval and provides the option to update their profile with an email address from the authorized domain to gain access.

Administrators will receive an email alerting them of any new pending requests twice a day at 9 AM and 3 PM Eastern US time.  Requests that have already been approved or denied will not trigger an email alert. 

Administrators can access the pending requests and logs from their Admin menu.

After logging into a CITI Program account, click on the Admin tab at the top of the page then click on Pending Request(s).
 

The administrator can deny or allow affiliation for learners who did not provide an email address from the authorized domain on the Pending Requests page.

Select the Allow or Deny checkbox to resolve the pending requests then click Submit. 

Any requests without a checkbox selected will remain outstanding on the Pending Requests page. 
 

When a learner's request for access without an authorized domain email is allowed, the learner receives access to the courses under the subscription.
Learners who are allowed by an administrator are validated for one year. After the one year validation period the learner will be requested to enter an email from authorized domain upon their next log in. If the email address entered is not on the authorized domain, the learner will be placed in a pending status for administrator intervention.

When access is denied by an administrator the organization is removed from the learner's account and the learner receives an email stating their access was denied. The email includes organizational contact information to resolve the issue if further intervention is needed. 

Administrators can review logs of the approved and denied requests by logging into a CITI Program account, clicking on the Admin tab and selecting Access Control Logs.

The administrator can use the Access Control Logs page to search results or download an Excel spreadsheet for review. 

FAQs

Q. Can more than one authorized domain be listed?
A. Yes

Q. Is there an additional cost associated with Access Control?
A. No

Q. Can this feature be used to block addresses from specified domains?
A. No

Q. What other subscription access control options does the CITI Program offer?
A. At this time we also offer a Single Sign On (SSO) service. 


For more information regarding Access Control email us at support@citiprogram.org or call 888.529.5929.