<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
p.msonormal0, li.msonormal0, div.msonormal0
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif}
span.EmailStyle19
{font-family:"Calibri",sans-serif;
color:#1F497D}
span.EmailStyle21
{font-family:"Calibri",sans-serif;
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
-->
</style><style type="text/css" id="owaParaStyle"></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">I'm working on a blog post about this very issue and am thankful to everyone who has shared their stories/struggles so far.
<div><br>
</div>
<div>I'd like to know of any vendors that are insisting on receiving personal identifying info (PII), i.e., we won't let the library enable off campus access without passing PII. I've heard rumors but I'd like to substantiate if I can. </div>
<div><br>
<div>Lisa<br>
<div><br>
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:13px; font-family:Tahoma">
<div style="font-size:13px; font-family:Tahoma">
<p class="MsoNormal" style="margin-bottom:12pt"><a tabindex="0" name="_MailAutoSig"><span style="color:#1f497d">--</span></a></p>
<p class="MsoNormal" style="margin-bottom:12pt"><a name="_MailAutoSig"><span style="color:#1f497d">Lisa Janicke Hinchliffe
<br>
Professor/ Coordinator for Information Literacy Services and Instruction<br>
University Library, University of Illinois, 1408 West Gregory Drive, Urbana, Illinois 61801
<br>
</span></a><a href="mailto:ljanicke@illinois.edu"><span style="color:blue">ljanicke@illinois.edu</span></a><span style="color:#1f497d">, 217-333-1323 (v), 217-244-4358 (f)
</span></p>
<p class="MsoNormal" style="margin-bottom:12pt"><a tabindex="0" name="_MailAutoSig"></a></p>
<span><span style="color:#1f497d"></span></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF985390" style="direction: ltr;"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Eril-l [eril-l-bounces@lists.eril-l.org] on behalf of Heather Shipman [heather.shipman@cornell.edu]<br>
<b>Sent:</b> Friday, November 03, 2017 8:27 AM<br>
<b>To:</b> Sibley, Jean J; Kathleen Folger<br>
<b>Cc:</b> Dodson Donna; eril-l@lists.eril-l.org<br>
<b>Subject:</b> Re: [Eril-l] Switching from EZ proxy to Shibboleth/Open Athens/SAML Where do I begin?<br>
</font><br>
</div>
<div></div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Hi, all,</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">I’m also interested in Kathleen’s question about opaque identifiers. Really, really,
<i>really</i> interested.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">We’ve discovered that our Shibboleth (configured by central campus IT, many years ago and without input from the library) is sending vendors personally identifying
information, including to InCommons, which we think means any platform using InCommons to authenticate via Shibboleth would get PI info. We’ve already caught one platform associating usernames with usage data, though I don’t think they realized that the SSO
“usernames” were identifying.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">We intend to seal this privacy hole in our Shib, but since it’s been around so long, we expect there to be a lot of cleanup to do.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">I’d like to hear how other institutions have solved this problem, or related ones – particularly as more and more organizations are talking about how great
it would be to switch from proxy to Shibboleth. This privacy leak really worries us. And I’d love to hear from
<i>platforms</i> who support opaque identifiers on how this works on their side, so we can work the problem from both ends.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">On a related note – I’ve heard a
<i>lot</i> of people respond to questions about privacy with something about great security. (I don’t mean to point a finger at you, Jean – this comes up in almost every privacy conversation I’ve ever had with people outside our core e-resources unit, even
some of our own higher-ups.) I think we need to push back against the common conflation of security with privacy – they’re not the same. It’s easy to securely send private information; that’s why security exists. It’s the existence of that private information,
and it <i>being collected and sent to begin with, </i>that we need to hammer more on. “We have good security” is not a sufficient privacy policy.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"><img id="Picture_x0020_1" src="cid:image001.jpg@01D35485.F3560200" alt="Thumbnail2" height="93" width="74"></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Heather Shipman</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">E-book Acquisitions and Management Specialist
</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">110 Olin Library, Cornell University</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"><a href="mailto:Heather.shipman@cornell.edu" target="_blank"><span style="color:#0563C1">Heather.shipman@cornell.edu</span></a></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Eril-l [mailto:eril-l-bounces@lists.eril-l.org]
<b>On Behalf Of </b>Sibley, Jean J<br>
<b>Sent:</b> Friday, November 03, 2017 8:12 AM<br>
<b>To:</b> Kathleen Folger <kfolger@umich.edu><br>
<b>Cc:</b> Dodson Donna <ddodson@mountida.edu>; eril-l@lists.eril-l.org<br>
<b>Subject:</b> Re: [Eril-l] Switching from EZ proxy to Shibboleth/Open Athens/SAML Where do I begin?</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Hi Kathleen, Our Shibboleth authentication is a single sign-on (username and password) through our CAS (Central Authentication Service). This is a secure service.
I’m not sure which identifier each vendor supports. Each of them was willing to work with us. Sounds like you will need to get your IT department involved. – Good luck! Jean</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Kathleen Folger [<a href="mailto:kfolger@umich.edu" target="_blank">mailto:kfolger@umich.edu</a>]
<br>
<b>Sent:</b> Thursday, November 2, 2017 6:14 PM<br>
<b>To:</b> Sibley, Jean J <<a href="mailto:bjsibley@wm.edu" target="_blank">bjsibley@wm.edu</a>><br>
<b>Cc:</b> Dodson Donna <<a href="mailto:ddodson@mountida.edu" target="_blank">ddodson@mountida.edu</a>>;
<a href="mailto:eril-l@lists.eril-l.org" target="_blank">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> Re: [Eril-l] Switching from EZ proxy to Shibboleth/Open Athens/SAML Where do I begin?</span></p>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal">Hi Jean,</p>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">Were you able to set up Shibboleth authentication using an opaque identifier so there's no release of personally identifiable information? If so, do you know which identifier each of the vendors you mentioned supports?</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">We've run into an issue recently with our campus IT department not supporting the opaque identifier that another vendor said was the only one they supported. I'm trying to get a sense of what identifiers are most commonly supported by the
library vendor community to make sure our campus IT department will support it. Thanks!</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">-Kathleen</p>
</div>
</div>
<div>
<p class="MsoNormal"><br clear="all">
</p>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="background:white">_________________________________________<br>
Kathleen M. Folger, Electronic Resources Officer<br>
University of Michigan Library<br>
312 Hatcher North<br>
Ann Arbor, MI 48109-1190<br>
V:(734) 764-9375<br>
F:(734) 764-0259<br>
<a href="mailto:kfolger@umich.edu" target="_blank">kfolger@umich.edu</a></span></p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<p class="MsoNormal">My pronouns are she, her, hers – what are yours? </p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal">On Thu, Nov 2, 2017 at 3:09 PM, Sibley, Jean J <<a href="mailto:bjsibley@wm.edu" target="_blank">bjsibley@wm.edu</a>> wrote:</p>
<blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0in 0in 0in 6.0pt; margin-left:4.8pt; margin-top:5.0pt; margin-right:0in; margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Hi Donna, We recently switched from EZProxy to Shibboleth for over 200 databases from our major vendors – Ebsco, Gale, and ProQuest.
</span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">I started out working with our IT department – but once you learn what parameters are needed it’s pretty straightforward. Some vendors let you do it
yourself through the vendor’s administrator module. For some, you can email support and fill out a form. Basically, you need to know your institution’s IDP entity ID, federation, and scope.
</span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Also, the URLs for your resources need to be changed to remove your proxy prefix and/or sometimes append shibboleth and an account ID. I learned the
hard way on this and had to re-do over a hundred URLs.</span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">In the long run it has greatly improved our off-campus access to resources. And no more Oops! errors. So when we go to buy a new product, one of the
first things I ask is if they can be Shibboleth-authenticated – since many resources don’t play nice with EZProxy – and the stanzas change all the time.</span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D">Good luck! – Jean</span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:9.0pt; font-family:"Calibri",sans-serif; color:#00B050">Jean Sibley</span></p>
<p class="MsoNormal" style=""><span style="font-size:9.0pt; font-family:"Calibri",sans-serif; color:#00B050">Serials & Electronic Resources Librarian</span></p>
<p class="MsoNormal" style=""><span style="font-size:9.0pt; font-family:"Calibri",sans-serif; color:#00B050">William & Mary Libraries | The College of William and Mary</span></p>
<p class="MsoNormal" style=""><span style="font-size:9.0pt; font-family:"Calibri",sans-serif; color:#00B050">P:
<a href="tel:(757)%20221-3103" target="_blank">757.221.3103</a> | E: <a href="mailto:bjsibley@wm.edu" target="_blank">
bjsibley@wm.edu</a></span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Calibri",sans-serif; color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style=""><b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> Eril-l [mailto:<a href="mailto:eril-l-bounces@lists.eril-l.org" target="_blank">eril-l-bounces@lists.eril-l.org</a>]
<b>On Behalf Of </b>Dodson Donna<br>
<b>Sent:</b> Thursday, November 2, 2017 2:16 PM<br>
<b>To:</b> <a href="mailto:eril-l@lists.eril-l.org" target="_blank">eril-l@lists.eril-l.org</a><br>
<b>Subject:</b> [Eril-l] Switching from EZ proxy to Shibboleth/Open Athens/SAML Where do I begin?</span></p>
</div>
</div>
<p class="MsoNormal" style=""> </p>
<div id="m_905638892538462958divtagdefaultwrapper">
<p><span style="font-family:"Calibri",sans-serif; color:black">Hello,</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">I am in the process of researching authentication methods for our students and faculty who use our databases and ejournals on and off campus. We currently have a library consortium managed EZ Proxy
but our director would like to switch to something in-house that we could manage. We fear that the EZ proxy is often serving as a barrier to the information resources we strive to make accessible to our community. Has anyone made the transition from EZ Proxy
to Shibboleth/Open Athens/SAML? I would love to hear more about the process and the details- what are the new products we need to buy? Do you have preferred vendors for these new products? Did you have to work with your IT department or is it something you
did yourself? Any and all comments are welcome.</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">Thanks in Advance!</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black">-Donna Dodson</span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<p><span style="font-family:"Calibri",sans-serif; color:black"> </span></p>
<div id="m_905638892538462958Signature">
<div name="divtagdefaultwrapper">
<div>
<div>
<div>
<div>
<p class="MsoNormal" style=""><strong><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">Donna Dodson</span></strong><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black"><br>
Electronic Resources Coordinator </span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Arial",sans-serif; color:black">Department of Instructional Technology and Learning Resources</span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">Wadsworth Library</span><span style="font-size:11.0pt; font-family:"Arial",sans-serif; color:black"><br>
</span><span style="font-size:11.0pt; font-family:"Tahoma",sans-serif; color:black"><br>
</span><strong><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">Mount Ida College</span></strong><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">
</span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">777 Dedham Street</span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">Newton, MA 02459</span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Arial",sans-serif; color:black">T
<a href="tel:(617)%20928-4010" target="_blank">(617) 928-4010</a></span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">E
</span><span style="font-size:11.0pt; font-family:"Tahoma",sans-serif; color:black"><a href="mailto:ddodson@mountida.edu" id="m_905638892538462958LPNoLP" target="_blank"><span style="font-size:10.0pt; font-family:"Arial",sans-serif">ddodson@mountida.edu</span></a></span></p>
</div>
<div>
<p class="MsoNormal" style=""><span style="font-size:11.0pt; font-family:"Arial",sans-serif; color:black"><a href="http://www.mountida.edu/" id="m_905638892538462958LPNoLP" target="_blank">www.mountida.edu/</a></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Eril-l mailing list<br>
<a href="mailto:Eril-l@lists.eril-l.org" target="_blank">Eril-l@lists.eril-l.org</a><br>
<a href="http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org" target="_blank">http://lists.eril-l.org/listinfo.cgi/eril-l-eril-l.org</a></p>
</blockquote>
</div>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>