<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hello. This was part of the impetus for my "Licensing Privacy" work. You can find all the white papers and related webinars here:
<a href="https://publish.illinois.edu/licensingprivacy/">https://publish.illinois.edu/licensingprivacy/</a> Unfortunately, though there was a lot of interest, I'm not sure many libraries have privacy at the top of their priority stack. Lisa</div>
<div class="elementToProof" id="Signature">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<div style="margin-top: 9.75pt; margin-bottom: 12pt;" class="elementToProof">
<p style="margin: 0in;" class="elementToProof"><span style="font-size: 11pt; color: rgb(31, 73, 125);">____ </span></p>
<p style="background-color: white; margin: 0in;" class="elementToProof"><span style="font-size: 11pt; color: black;"> </span></p>
<p style="background-color: white; margin: 0in;" class="elementToProof"><span style="font-size: 11pt; color: black;">Lisa Janicke Hinchliffe</span></p>
<p style="background-color: white; margin: 0in;" class="elementToProof"><span style="font-size: 11pt; color: black;">Professor &</span><span style="font-size: 11pt; color: black; background-color: white;"> Coordinator for Research Professional Development</span><span style="font-size: 11pt; color: black;">,
University Library</span></p>
<p style="background-color: white; margin: 0in;" class="elementToProof"><span style="font-size: 11pt; color: black;">Affiliate Faculty, School of Information Sciences, Center for Social & Behavioral Science, European Union Center, & Center for Global Studies</span></p>
<p style="background-color: white; margin: 0in;" class="elementToProof"><span style="font-size: 11pt; color: black;">Library 434, University of Illinois, 1408 West Gregory Drive, Urbana, Illinois 61801</span></p>
<p style="background-color: white; margin: 0in 0in 12pt;" class="elementToProof">
<span style="font-size: 11pt; color: rgb(5, 99, 193);"><u><a style="margin-top: 0px; margin-bottom: 0px;" class="OWAAutoLink" id="OWA71aca858-8e7c-1878-21f6-748387a82149" href="mailto:ljanicke@illinois.edu">ljanicke@illinois.edu</a></u></span><span style="font-size: 11pt; color: black;">,
217-333-1323 (v), 217-244-4358 (f)</span><span style="color: black;"> </span></p>
<p style="background-color: white; margin: 0in;" class="elementToProof"> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg">
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>From:</b> Eril-l <eril-l-bounces@lists.eril-l.org> on behalf of Electronic Resources in Libraries discussion list via Eril-l <eril-l@lists.eril-l.org><br>
<b>Sent:</b> Monday, November 10, 2025 9:37 AM<br>
<b>To:</b> ERIL-L listserv <eril-l@lists.eril-l.org><br>
<b>Subject:</b> [Eril-l] SSO/SAML and attributes vendors want but maybe don't need? data grab?</div>
<div style="direction: ltr;"> </div>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi, all.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm still trying to understand what the vendor movements away from IP authentication and especially for off-campus users mean, and have gotten some help from Gemini.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
UPEI belongs to the Canadian Access Federation (CAF), and we use MS Azure as our SSO system for our IdP.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As I understand it, all our vendors need to know about our users is the same as what they knew about them when using ezproxy for off-campus access, which is that this user has authenticated as a UPEI valid user.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
According to a sample test I ran, our IdP doesn't send out any specific attributes, but it does tell the service provider that this person is a valid UPEI person and provides a persistent "name" code that is anonymized.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Below is how Gemini explained it:</div>
<div style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px 0px 1.25em 40px; max-width: 100%; min-width: 0px; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So, while the service provider learned <span style="font-weight: 600;">nothing</span> about your personal identity (not your name, role, or email), it learned
<span style="font-weight: 600;">everything</span> it needs to know about your institutional context.</div>
<div style="direction: ltr; text-align: left; text-indent: 0px; margin: 1.25em 0px 1.25em 40px; max-width: 100%; min-width: 0px; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
By accepting this SAML assertion, the service provider is implicitly saying: "I have received a digitally signed, unforgeable message from the official authentication authority for UPEI, and that authority vouches for the fact that they have successfully authenticated
one of their valid users."</div>
<div style="direction: ltr; text-align: left; text-indent: 0px; margin: 1.25em 0px 0px 40px; max-width: 100%; min-width: 0px; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This is the core of federated identity: authentication is handled entirely by the home institution. The service provider doesn't need to know
<i>who</i> you are, only <i>that</i> UPEI has confirmed you are a legitimate member of its community.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
However, almost all of the library providers I have dealt with so far to configure SSO authentication have required us to take extra steps to provide them with more specific "attributes" like "eduPersonScopedAffiliation", and sometimes even PII (personally
identifiable information) including first and last name and email address.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The vendor could use that persistent "pseudonym" code allow this specific UPEI user to create whatever kind of personalized account services (eg saving searches) that vendor's platform has.</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So it seems to my suspicious mind that our vendors are taking advantage of the move towards SSO to get from us far more user-specific data than they actually need to provide the services we are paying for. They didn't have a problem for decades with providing
their content to users who offered nothing more than our Ezproxy server's IP address. But suddenly they "need" PII to provide that same access?</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is anyone/any library organization pushing back on this? What can we librarians do? Do we have to work with our IT depts to convince them to get their SAML/SSO providers (like Microsoft for Azure) to include more anonymizing options so we can send fake names
and email addresses when our vendors demand them?</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I would guess that the European institutions have already been able to solve this, given the GDPR (which we in North America badly need too). How did you do it? What did you say to the vendors? Are there any "magic words" to get them to admit they don't need
all those attributes they are demanding from us?</div>
<div id="x_Signature">
<div style="direction: ltr; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="background-color: rgb(255, 255, 255); margin: 0px;">
<div style="direction: ltr; text-align: left; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36);">
<span style="background-color: white;">Melissa Belvadi</span></div>
<div style="direction: ltr; text-align: left; background-color: white; margin: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36);">
Collections Librarian</div>
<div style="direction: ltr; text-align: left; background-color: white; margin: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36);">
University of Prince Edward Island</div>
<div style="direction: ltr; text-align: left; background-color: white; margin: 0px; font-family: Arial, Helvetica, sans-serif; color: rgb(32, 33, 36);">
<span style="font-size: 9.75pt;"><a style="margin: 0px;" class="x_OWAAutoLink" id="OWA94c41b66-9055-646c-620e-55bfa1ae1ca5" href="mailto:mbelvadi@upei.ca">mbelvadi@upei.ca</a> 9</span><span style="font-size: 12.79px;">02-566-0581</span></div>
<div style="direction: ltr; text-align: left; background-color: white; margin: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 12.79px; color: rgb(32, 33, 36);">
ORCID iD: 0000-0002-4433-0189</div>
<div style="direction: ltr; text-align: left; background-color: white; margin: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36);">
my <a style="margin: 0px;" data-auth="NotApplicable" title="https://outlook.office365.com/owa/calendar/0fbab27c909e4493be65313bd66d66b6@upei.ca/5fa60af92c6d451c9ddf90c0bb11e00f15552192987609852692/calendar.html" class="x_OWAAutoLink" id="OWA693b284d-eca2-60fa-14fe-22bf83a074f2" href="https://urldefense.com/v3/__https://outlook.office365.com/owa/calendar/0fbab27c909e4493be65313bd66d66b6@upei.ca/5fa60af92c6d451c9ddf90c0bb11e00f15552192987609852692/calendar.html__;!!DZ3fjg!-VRwLrVGNMHfCm7xFMjw34Hi3lP2qcO-At1crRZlVKanPqvHYPbtVoeuePR3_F0TTPuulaAGWR8ZIJj9AOThqro$">
public calendar</a></div>
</div>
<div style="direction: ltr; text-align: left; background-color: rgb(255, 255, 255); margin: 0px;">
<span style="font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36); background-color: white;">My pronouns are
</span><span style="font-family: "Google Sans", Roboto, Arial, sans-serif; font-size: 14px; color: rgb(31, 31, 31); background-color: rgba(68, 71, 70, 0.08);">ಅವರು/ಅವರನ್ನು</span></div>
<div style="direction: ltr; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36);">
<span style="background-color: white;">My emails are sent during the hours that I work and I understand that you will respond during the hours that you work.</span></div>
<div style="direction: ltr; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(32, 33, 36);">
<span style="background-color: white;"><br>
</span></div>
<div style="direction: ltr; font-family: Arial, Helvetica, sans-serif; font-size: 9.75pt; color: rgb(0, 0, 0);">
<span style="background-color: white;">Make an appointment: Use YouCanBookMe <a data-auth="NotApplicable" class="OWAAutoLink" id="OWA5dee689d-c0ba-192f-fd59-21f9faa9bf1a" href="https://urldefense.com/v3/__https://mbelvadi.youcanbook.me/__;!!DZ3fjg!-VRwLrVGNMHfCm7xFMjw34Hi3lP2qcO-At1crRZlVKanPqvHYPbtVoeuePR3_F0TTPuulaAGWR8ZIJj9BGAKrRk$">
https://mbelvadi.youcanbook.me/</a><br>
or for other MS365 / Outlook users, including UPEI people:</span></div>
<table style="direction: ltr;" id="x_x_x_pbpsiglinktable">
<tbody>
<tr>
<td style="direction: ltr;"><a data-auth="NotApplicable" class="x_OWAAutoLink" id="OWA228a463c-7a39-ef33-7520-6b6b8aa2cfca" href="https://urldefense.com/v3/__https://outlook.office.com/bookwithme/user/0fbab27c909e4493be65313bd66d66b6@upei.ca?anonymous&ismsaljsauthenabled&ep=bwmEmailSignature__;!!DZ3fjg!-VRwLrVGNMHfCm7xFMjw34Hi3lP2qcO-At1crRZlVKanPqvHYPbtVoeuePR3_F0TTPuulaAGWR8ZIJj9emOOpko$"><img size="820" data-outlook-trace="F:2|T:2" src="cid:2d397b68-5ac1-4410-9e44-e6b36733a881"></a></td>
<td style="direction: ltr;"></td>
<td style="direction: ltr;">
<div style="direction: ltr; color: rgb(0, 120, 212);"><a style="color: rgb(0, 120, 212); text-decoration: none;" data-auth="NotApplicable" class="x_OWAAutoLink" id="OWA6cad8f3a-fe2e-ae79-aed4-b41b67d10de1" href="https://urldefense.com/v3/__https://outlook.office.com/bookwithme/user/0fbab27c909e4493be65313bd66d66b6@upei.ca?anonymous&ismsaljsauthenabled&ep=bwmEmailSignature__;!!DZ3fjg!-VRwLrVGNMHfCm7xFMjw34Hi3lP2qcO-At1crRZlVKanPqvHYPbtVoeuePR3_F0TTPuulaAGWR8ZIJj9emOOpko$">Book
time to meet with me</a></div>
</td>
<td style="direction: ltr;"></td>
</tr>
</tbody>
</table>
</div>
</body>
</html>