SHIBBLE-ME-THISONE LIBRARIAN’S FORAY INTO

SHIBBOLETH FOR BETTER ACCESSAN ILLUSTRATED NARRATIVE

ATHENA HOEPPNERELECTRONIC RESOURCES LIBRARIAN

UNIVERSITY OF CENTRAL FLORIDA

@CYBRGRL #INTERNETLIBRARIAN

CAMPUSSERVICE

RESEARCHER AT HOME

DREADED PAYWALL

PUBLISHERSITE

CAMPUSSERVICE

THE LONG CONFUSING SLOGLIBRARYSERVER

PUBLISHERSITE

YET ANOTHER LOGINPROXYSERVER

MEDIATEDREQUESTS

PUBLISHERSITE

LIBRARYSERVER

PERSPECITVE…VPN!

SECURITY.ACCESS!

SHIBBOLETH DAYDREAMS

• SHIBBOLETH IS WIDELY USED BYLIBRARIES AND LIBRARY VENDORS.

• TURN SHIBBOLETH ON AND OFF INVENDOR ADMIN

• LOTS OF USER ATTRIBUTES SHARED

• SIGNED IN USERS WILL BE ABLE TOUSE WILD-WEB LINKS

• MOVE BETWEEN UCF SYSTEMSWITHOUT SIGNING IN

• PERSONALIZED EXPERIENCE

• GRANULAR ACCESS CONTROL

DIFFERENT PRIORITIESENTERPRISE

SINGLE SIGN ON.MANAGED IDS.

SECURITY.

BUT, LIBRARY

ACCESS…

THINGS I LEARNED…SHIBBOLETH IS

• STANDARDS BASED

• OPEN SOURCE

• MIDDLEWARE

• SINGLE SIGN-ONACROSS OR WITHINORGANIZATIONALBOUNDARIES.

• CREATED BYINCOMMON, A SUB-PROJECT OF INTERNET2

HTTPS://SHIBBOLETH.NET/ABOUT/

SHIBBOLETH IN CONTEXT• NOT-FOR-PROFIT

NETWORKING CONSORTIUM

• FOR U.S. RESEARCH ANDEDUCATION COMMUNITIES

HTTPS://SHIBBOLETH.NET/CONSORTIUM/

UNITED FEDERATION OF PLANETS

• OPERATES THE IDENTITYFEDERATION FOR INTERNET2

• IDENTITY PROVIDERS GETSINGLE SIGN-ON AND PRIVACYPROTECTION

• SERVICE PROVIDERS GETACCESS CONTROL

HTTP://WWW.INTERNET2.EDU/PRODUCTS-SERVICES/TRUST-IDENTITY-MIDDLEWARE/INCOMMON-FEDERATION

THINGS I LEARNED…• SECURITY ASSERTION MARKUPLANGUAGE (SAML)

• XML-BASED COMMUNICATIONOF USER AUTHENTICATION, ENTITLEMENT, ANDATTRIBUTES.

• SAML ALLOWS ENTITIES TOMAKE ASSERTIONS ABOUTUSERS TO OTHER ENTITIES, SUCH AS A PARTNER COMPANYOR ANOTHER ENTERPRISEAPPLICATION.

HTTPS://WWW.OASIS-OPEN.ORG/COMMITTEES/TC_HOME.PHP?WG_ABBREV=SECURITY

CAMPUSSERVICE

TEACHER AT HOME

USERCREDENTIALS

LDAP

AUTHENTI-CATION

CAMPUSSERVICE

INTERNAL DIALOG

LDAP

AUTHENTI-CATION / USER INFO

USERCREDENTIALS

HE IS A UCF EDU-PERSON

CHECK ON THIS GUY FOR ME…

YEAH. HERE’S HIS NAME AND

OTHER DATA.

ATTRIBUTESASSERTATIONS

OK. HE IS ENTITLED

TO MY SERVICE,

USERCRED

DO YOU KNOW THIS

GUY?

HE GETS A COOKIE

MENEWHILE IN I.T. …

ENTERPRISE-WIDE FEDERATED ID AND SSO:

• LEANING MANAGEMENT SYSTEM

• OPAC/LIBRARY ACCOUNTS

• ILLIAD

• EZPROXY

SINGLE SIGN ON!!

ON TO THE LIBRARY…LIBRARYSERVER HE HAS A

COOKIE.

HERE ARE HIS ATTRIBUTES

EXTERNAL SERVICEPROVIDERS

LIBRARY VENDORS IN INCOMMONFEDERATATION:

• HATHI TRUST

• EBSCOHOST

• PROQUEST

• EBL• ELSEVIER

• JSTOR• …HTTPS://SPACES.INTERNET2.EDU/DISPLAY

/INCLIBRARY/TARGETRESOURCES

HTTPS://SPACES.INTERNET2.EDU/DISPLAY/INCLIBRARY/REGISTRYOFRESOURCES

OK

ENABLE, PLEASE!!

THEY GET OUR

ENTITYid, AND WE’LL ASSERT

eduPERSON

PAYWALL REDUXPUBLISHER

SITE

??!

WAYF – WHERE ARE YOUFROM PUBLISHER

SITE

SINGLE SIGN-ON!HE HAS A COOKIE.

I ASSERT HE IS A UCF eduPERSON.

PUBLISHERSITE

INCOMMON BESTPRACTICES FOR LIBRARIES• AUTHORIZATION VIA EDUPERSON

ATTRIBUTES

• IMPLEMENT WAYFLESS URLS

• IMPLEMENT AUTHENTICATED DIRECTLINKS TO RESOURCES.

• SHIBBOLETH ENABLE EZPROXY

• USE SHIBBOLETH-READY EZPROXYSTARTING POINT URLS

HTTPS://SPACES.INTERNET2.EDU/DISPLAY/INCLIBRARY/BEST+PRACTICES

SINGLE SIGN ON ACCESS!

EZPROXY SHIBB URLS

• EZPROXY STARTING POINT URLSHTTPS://LOGIN.EZPROXY.UCF.EDU/LOGIN&URL=

• SHIBBOLIZEDHTTPS://LOGIN.EZPROXY.UCF.EDU/LOGIN?AUTH=SHIBB&URL=

• WORKS WELL WITH LIBX TO PROXY ON THE FLY

• UCF DEPLOYED IN: SFX, EBSCOHOSTDISCOVERY… WAITING TO USE IN OTHER SERVICES

CAVEATS: • SOME EXTERNAL SYSTEMS ARE READY FOR THIS. • GOES STRAIGHT TO THE FEDERATED ID LOGIN -

BYPASSES OLD LIBRARY ID LOGIN,

INEVITABLE PAYWALLS

LibX

ONE LOGINHE HAS A COOKIE.

HERE ARE HIS

ATTRIBUTES

PUBLISHERSITE

PROXYSERVER

MEDIATEDREQUESTS

PUBLISHERSITE

LibX

LIBRARIAN SHIBBOLETHSUMMARY• CAMPUS SINGLE SIGN-ON WITH FEDERATED ID• LOTS OF ENTRY POINTS FROM MANY UCF SERVICES

• LOG IN FROM ONE SYSTEM MAY ALLOWS ACCESS TOTHE OTHER FEDERATION SHIBBOLETH-ENABLEDSERVICES

•WAYF ON SHIBBOLETH-ENABLED VENDOR SITES

•STILL NEED EZPROXIED LINKS FOR MOST LIBRARYCONTENT

•SHIBBOLETH ENABLED STARTINGPOINT URLS ANDLIBX ARE A PARTIAL SOLUTION FOR SEAMLESSACCESS

PRACTICAL STEPS FORLIBRARIANSASK I.T. TO ENABLE LIBRARYPARTNERS

SHIBBOLIZE EZPROXY

EXPLAIN VPN LIMITATIONS TOFACULTY

PROMOTE A CUSTOM LIBX

ASK VENDORS TO PARTICIPATE ININCOMMON

THANK YOU!ATHENA HOEPPNER

ATHENA@UCF.EDU

@CYBRGRL

SELECTED GLOSSARY

• ASSERTION - THE IDENTITY INFORMATION PROVIDED BY AN IDENTITY PROVIDER TO A SERVICE PROVIDER.• ATTRIBUTE - A SINGLE PIECE OF INFORMATIO. SOME ATTRIBUTES ARE GENERAL; OTHERS ARE PERSONAL. SOME

SUBSET OF ALL ATTRIBUTES DEFINES A UNIQUE INDIVIDUAL. EXAMPLES OF AN ATTRIBUTE ARE NAME ANDENROLLMENT.

• ATTRIBUTE STATEMENT: ASSERTS THAT A SUBJECT IS ASSOCIATED WITH CERTAIN ATTRIBUTES. AN ATTRIBUTE

IS SIMPLY A NAME-VALUE PAIR. RELYING PARTIES USE ATTRIBUTES TO MAKE ACCESS-CONTROL DECISIONS.• AUTHENTICATION STATEMENTS: STATEMENT THAT THE PRINCIPAL DID INDEED AUTHENTICATE WITH THE

IDENTITY PROVIDER AT A PARTICULAR TIME USING A PARTICULAR METHOD OF AUTHENTICATION

• AUTHORIZATION DECISION STATEMENT: ASSERTS THAT A SUBJECT IS PERMITTED TO PERFORM ACTION A ONRESOURCE R GIVEN EVIDENCE E.

• EDUPERSON - AN LDAP OBJECT CLASS TO FACILITATE INTER-INSTITUTIONAL APPLICATIONSPROVIDER URL, AND THE NETWORK ADMINISTRATOR.

• ENTITYID - ID THAT IDENTIFIES AN ENTERPRISE IN A FEDERATION. USUALLY A URL THAT POINTS TO AN XML FILE OF INFO ABOUT THE ENTITY, SUCH AS THE ID

• FEDERATED IDENTITY - MANAGEMENT OF IDENTITY INFORMATION BETWEEN MEMBERS OF A FEDERATION.• IDENTITY PROVIDER (IDP) - THE SYSTEM THAT AUTHENTICATES AN ENTITY

• SERVICE PROVIDER (SP) - MAKES ONLINE RESOURCES AVAILABLE TO USERS BASED IN PART ON INFORMATIONABOUT THEM THAT IT RECEIVES FROM OTHER INCOMMON PARTICIPANTS.

• WHERE ARE YOU FROM (WAYF) - A SERVER USED BY THE SHIBBOLETH SOFTWARE TO DETERMINE WHAT AUSER'S HOME ORGANIZATION IS.

HTTP://EN.WIKIPEDIA.ORG/WIKI/SECURITY_ASSERTION_MARKUP_LANGUAGE#SAML_ASSERTIONS

SOME LINKS TO PLAY WITH

DIRECT LINKS TO ARTICLES:• INTELLIGENT LIBRARIES AND APOMEDIATORS:

DISTINGUISHING BETWEEN LIBRARY 3.0 AND LIBRARY2.0.

• PERSPECTIVE VOLUME RENDERED MOTION: GAININGINSIGHTS VIRTUALLY

PROXIED WITH AUTH=SHIBB:• INTELLIGENT LIBRARIES AND APOMEDIATORS

• PERSPECTIVE VOLUME RENDERED MOTION

PROXIED WITHOUT AUTH=SHIBB:• INTELLIGENT LIBRARIES AND APOMEDIATORS

• PERSPECTIVE VOLUME RENDERED MOTION