März 2019 - FIM4L - lists3.daasi.de

Re: [Fim4l] [refeds] Deprecating eduPersonTargetedID
by Peter Gietz 08 Apr '19

08 Apr '19

Hi all, as Peter rightly mentioned, FIM4L is a rather new activity that is currently taking up speed and visibility. A first website should be available this week. A charter and a recommendation document are in the making, the latter is still very raw. Although we see it as a library driven approach with focus on library requirements and standpoints towards scientific publishers (and RA21), the list is open to anyone that wants to contribute to FIM for libraries. Of course the recommendation document will contain attributes and thus discussions like this thread are relevant for the group. Nevertheless be aware that not all publishers have state of the art SAML SP implementations and providing EPTI might still be necessary for a while. Of course the recommendation document is a good place to push the newer and of course better alternative pairwise-id and we thank Peter S. to bring this up on that list. Since we are talking about a specification that was finalized this January, we cannot expect adaption in an SP community rather conservative towards software. As the RA21 in its announcement to support Coco mentions "Specifically, the service provider should only ask for eduPersonEntitlement and, optionally, a pseudonymous pairwise user identifier (e.g., eduPersonTargetedID)" we were discussing this on the fim4l list. Such a formulation, also mentioning the SAML subjectID specification and its pairwise-id (as preferred option), is the current idea. If important specifications like eduPerson deprecates EPTI, we might change that as well. But as I said: recommendation is one thing, changing software to consume other IDs another. BTW: a presentation on FIM4L is planned for the next REFEDS f2f in Tallinn. I am looking forward to that. Cheers, Peter G. Am 22.03.2019 um 15:45 schrieb Peter Schober: > * Peter Schober <peter.schober(a)univie.ac.at> [2019-03-22 15:37]: >> * Nick Roy <nroy(a)internet2.edu> [2019-03-22 15:16]: >>> What is FIM4L? I agree this recommendation is bad. >> Raoul mentioned it here recently: >> https://lists.refeds.org/sympa/arc/refeds/2019-03/msg00007.html > I found out a bit about it and reported back here: > https://lists.refeds.org/sympa/arc/refeds/2019-03/msg00013.html > > I've since also discovered (and subscribed to) the mailing list > http://lists.daasi.de/listinfo/fim4l > > None of this is for me to share but since the above info is all > publicly and independently discoverable I guess those of you > interested in joining this effort and discussing the essentials of > access to institutionally licensed resources could do so, same way I > did. > It is an effort "by the libraries", though (plus selected institutions > and federation folks, seemingly), so I'm probably more tolerated than > welcome at this point (and progressively so the more I speak up about > such issues ;)). > > -peter -- Peter Gietz, CEO DAASI International GmbH Europaplatz 3 D-72072 Tübingen Germany phone: +49 7071 407109-0 fax: +49 7071 407109-9 email: peter.gietz(a)daasi.de web: www.daasi.de Sitz der Gesellschaft: Tübingen Registergericht: Amtsgericht Stuttgart, HRB 382175 Geschäftsleitung: Peter Gietz

5 7

Presenting FIM4L at the REFEDS meeting in June
by Licia Florio 04 Apr '19

04 Apr '19

Dear all, I just a quick chat with Nicole (REFEDS coordinator) about FIM4L. Although work in FIM4L has only started recently, it would be good to have a presentation at the upcoming REFEDS.The next REFEDS meeting will be co-located with TNC (but REFEDS attendance is free of charge).For more information please refer to https://refeds.org/. Is there somebody planning to be at TNC that could present on it? Cheers, Licia

4 4

Meeting April 4, 3-4 pm CET
by Jos Westerbeke 03 Apr '19

03 Apr '19

Dear all, According to the latest poll<https://doodle.com/poll/28bwm5wzyu862gkd> the next meeting would be held at April 4, 3-4 pm CET. We will meet online at: meet.google.com/ppq-dqwn-zgo<https://meet.google.com/ppq-dqwn-zgo> I'll send an invitation soon. Agenda proposal: - Welcome - Discuss finalization of FIM4L proto-charter<https://docs.google.com/document/d/17EllwItlnB3fYhJ2ZNpX6Z1gUfF1948ORRvtbIA…> (editing, how to publish) - FIM4L guidelines and recommendations<https://docs.google.com/document/d/1pIaEXfw9ZWnXM4p6Dd2Lri7RFWKgr7ObKLEGfUy…> - Use of FIM4L email list: Technical discussions included? and recent adoption of GEANT Data Protection Code of Conduct by RA21. Please allow me to list here all our current members. I think it's good to know to whom we are talking through emails and in meetings. And we welcome all new participants! ---------------------------- Please remove this section when replying/forwarding this email. ------ Libraries: Peter van Boheemen (Wageningen University) Bernd Oberknapp (Albert-Ludwigs-Universität Freiburg) Jiri Pavlik (AARC / Moravian Library) Petr Zabicka (Moravian Library) Jos Westerbeke (Erasmus University Rotterdam) Caroline Checkley (University of Essex) Mimi Calter (Stanford University) Partners: Sander Engelberts (OCLC) Licia Florio (GEANT) Peter Gietz (AARC / DAASI International) Leif Johansson (RA21 / SUNet) Vasso Kalaitzi (LIBER) Barbara Monticini (GARR) Raoul Teeuwen (SURFnet) Maarten Kremers (SURFnet) Astrid Verheusen (LIBER) Mark Williams (Jisc) Ilona Trtikova (CESNET) Heather Flanagan (RA21, REFEDS, FIM4R, IT consultant) Anna Keclikova (CzechELib consortium) Peter Schober (University of Vienna) Stefan Paetow (Jisc) ------------------------------- With kind regards, Jos Jos Westerbeke Library IT Specialist / Demandmanager | Erasmus University Rotterdam, Library | Burgemeester Oudlaan 50 | 3062PA Rotterdam | jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl> | +31 640295513

3 2

Stanfords statement
by Jos Westerbeke 29 Mär '19

29 Mär '19

Hi all, For your interest: "Protecting Patron Privacy in Digital Resources<https://scholarlykitchen.sspnet.org/2019/03/13/guest-post-protecting-patron…>" on Scholarly Kitchen. Stanford library made a statement<https://library.stanford.edu/using/special-policies/statement-patron-privac…> recently about patrons privacy. I think this statement perfectly aligns with our work. It draws the libraries' concerns and underlines the importance of our work. FIM4L should have the ability to make e-resource access with SSO better than using IP based access. Libraries cannot win the fight for preserving patron privacy by keep using IP based access. I think we even have to encourage SSO access (when Open Access without authentication is not possible) in order to "... carefully structure [SSO access] to minimize exposure of patron data as much as possible, but always to ensure disclosure of any PII that may be transmitted." According to the article. all the best, Jos Jos Westerbeke Library IT Specialist / Demandmanager | Erasmus University Rotterdam, Library | Burgemeester Oudlaan 50 | 3062PA Rotterdam | jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl> | +31 640295513

5 9

FW: [lis-e-resources] IP authentication - to switch off or not to switch off
by Raoul Teeuwen 29 Mär '19

29 Mär '19

I guess the below post is interesting for people on this list as well. Kindest regards, Raoul On 27/03/2019, 10:57, "outreach(a)ra21.simplelists.com<mailto:outreach@ra21.simplelists.com> on behalf of Julia Wallace" <outreach(a)ra21.simplelists.com<mailto:outreach@ra21.simplelists.com> on behalf of julia(a)RA21.org<mailto:julia@RA21.org>> wrote: Hi everyone Some interesting insights here (assumed mainly / exclusively UK). Regards, Julia From: An informal open list set up by UKSG - Connecting the Information Community [mailto:LIS-E-RESOURCES@JISCMAIL.AC.UK] On Behalf Of Barwick, Marie Sent: Wednesday, March 27, 2019 9:29 AM To: LIS-E-RESOURCES(a)JISCMAIL.AC.UK Subject: [lis-e-resources] IP authentication - to switch off or not to switch off Dear all, Q. “Some years ago we switched off IP access on campus in favour of relying on shibboleth authentication and our proxy server from on and off campus. There is some resistance to this now with some users advising that we are the only University that have done this so I would be very interested to find out if any others have also switched off IP authentication, and any feedback that they have received following this”? Many thanks for all of your comments that I received in respect of this questions. Out of 12 institutions that responded, 5 of you did have IP authentication switched on from on-campus but 5 of you (including Warwick) didn’t and a further 2 are in the process of moving away from it. There were also responses from some institutions who did offer IP authentication but were interested in moving away from this. It has been very useful for us to learn about the different experiences and approaches to authentication and has given us a better view of the landscape of this challenging issue. As promised, here is a summary of the comments which have been anonymised. ******************************************************************************************************************************************************************************************** “I’m considering switching off IP access at XXXXXXXXXXXXXX and using OCLC’s hosted EZproxy as the recommended access route and Shibboleth as a back-up option. Drivers include a more consistent user experience on and off-campus, better security, and another is that I’m involved in a pilot with OCLC for a new analytics service they’re developing for EZproxy. Currently the tool would only provide a snapshot of usage whereas I think the stats would be more useful if they included all” “We have received similar feedback around complexities of shibboleth authentication for students and academics when working off-campus. I personally don’t think this is specifically an issue with shibboleth or IP based authentication, but more the varied approach to implementation of sign-in links on different platforms. But this is also compounded by a sharp rise in expectations over the last few years where authentication in the consumer market (Amazon, Google, Twitter etc.) has vastly improved and reduced the need to remember a number of passwords and authentication routes/clicks. What this means for us and our students is that they see the 100 or so content platforms subscribed to by an institution as essentially the same thing in terms of how routes to access should work (as this is their experience elsewhere), they are provided by a single institution so why wouldn’t access simply work exactly the same across all of them – especially when on-campus SSO is standard. For the record, we currently have a mixed economy of IP and Shibboleth (preferring wayfless shibb routes wherever possible) but are also likely to be implementing EZ Proxy soon to help reduce some of the friction for off campus access” “Lack of IP authentication has also been raised as an issue by academic colleagues at XXXXXXXXX. Like others we favour Shibboleth but also use EZproxy. We have a restricted profile that we use for Walk-In users. As well as providing a Consistent experience (although this is vulnerable to the challenge that it is consistently difficult compared with IP authentication) it also allows us to provide access to our network to folk who are not, in strict licensing terms, members of the University (something academic colleagues have also requested)” “We always favour Shibboleth authentication using WAYFless url’s when possible and have done this for a number of years. For resources that only support IP we use a proxy server. Our reasoning being that it is easier for the students if the logging in experience is the same both on and off campus (rather than relying on IP when on campus and then having to login when off campus). Recently we have migrated to single sign-on so thinking about it, this probably isn’t the case anymore, with access being seamless in a lot of cases from on campus but requiring a login from off” “We use PingFederate (SAML) and EZproxy on campus. IP is no longer an option because we have a web filter in operation which obscures our IP range. The latter set up has caused some issues because we have found that, if we go direct to a site, we are sometimes recognised as another organisation using the same web filter. They have presumably provided the eresource supplier with the shared web filter IP range” “Same here. We use a range of authentication but obviously Shibboleth is more secure than IP and we are trying to move that way. It’s hard to do it with everything though so would be really interested to hear others experiences” “We do not do this – we have access via a mixture of Shibboleth, IP and EZproxy – but I would be very interested to hear the responses to this thread, if you were able to collate and share with the group” “Here at XXXXXXXXX we don’t IP authenticate to any resources, preferring to use Shib or EZProxy. Both of these methods work pretty seamlessly for us and to my knowledge we’ve not had any complaints about not using IP. Given the increasing occurrence of reported/detected eResource misuse (whether intentional or deliberate) I’d prefer we have definite user accountability to be able to deal with such instances when they occur. (It not that this is prolific, but we get maybe one every month or so that we need to investigate)” “We are in the process of doing the same, wherever possible, we don’t have a proxy server so some, although not much IP recognition will remain. We are linking WAYFlessly where we can and are discovering, in the process, that WAYFless linking via the Alma link resolver is not quite as developed as the literature would indicate, including for some fairly big suppliers such as Emerald and JSTOR” “I would not choose to do so although I can see the benefit it might bring in monitoring usage by department and so on. We have integrated Shibboleth into our single sign-on system including EZproxy. However, we know that more than half the users access content via internet search engines. Many users do not know about Shibboleth, even if they are shown it as an access option at the beginning of their studies / during information literacy sessions. The lack of uniformity in the signing on process is another concern. Also some publishers still do not offer federated access. It is useful to offer redundancy in access including via anonymous IP authentication or a VPN client without the need for extra clicks. Otherwise overall usage is impacted adversely” “I’d be very interested to see what other institutions do. We’re also on IP, EZproxy and Shibboleth at the moment. Would Shibboleth-only authentication present problems for walk-in users for instance?” Best wishes, Marie Marie Barwick | Resources Manager (Serials e-Resources and Digital Access) Resource Acquisitions and Digital Access | Library | University of Warwick<http://www2.warwick.ac.uk/> m.s.barwick(a)warwick.ac.uk<mailto:m.s.barwick@warwick.ac.uk> | External: 02476 573011 | Internal:73011 The Library | University of Warwick | Coventry | CV4 7AL | Find us on the interactive map<http://www2.warwick.ac.uk/about/visiting/maps/interactive/> lis-e-resources is a UKSG list - http://www.uksg.org UKSG groups also available on Facebook and LinkedIn Follow us on Twitter: https://twitter.com/UKSG To unsubscribe from this list please go to http://www.simplelists.com/confirm.php?u=5BIgC6Wynh2gSnqJeLuIcsPlyXSwYNLx

2 1

security example
by Jos Westerbeke 22 Mär '19

22 Mär '19

Hi all, Just happened: "Login details exposed online due to Elsevier data breach" as published yesterday in our university magazine<https://www.erasmusmagazine.nl/en/2019/03/21/login-details-exposed-online-d…>. A few hours later, library director comes to me: Do we exchange personal information to Elsevier? Hmm, IP address based: No. Also SSO: [check] only pseudo identifier. Answer: No, non PII. One hour later, email from DPO: Please explain what do we exchange to Elsevier? Blabla, transient identifier bla bla... "Alright, great!" We happy, but Elsevier should be happy too! (about us at least;) Conclusion: Security is an important topic in our recommendations too... Have a good weekend! Jos

3 2

Invitation: FIM4L meeting @ Thu 4 Apr 2019 15:00 - 16:00 (CEST) (fim4l@lists.daasi.de)
by jos.westerbeke＠eur.nl 22 Mär '19

22 Mär '19

You have been invited to the following event. Title: FIM4L meeting Agenda:- Welcome- Discuss finalisation of FIM4L proto-charter (editing, how to publish)- FIM4L guidelines and recommendations - Use of FIM4L email list: Technical discussions included?and recent adoption of GEANT Data Protection Code of Conduct by RA21. When: Thu 4 Apr 2019 15:00 – 16:00 Central European Time - Amsterdam Joining info: meet.google.com/ppq-dqwn-zgo <https://meet.google.com/ppq-dqwn-zgo> Calendar: fim4l(a)lists.daasi.de Who: * jos.westerbeke(a)eur.nl- organiser * fim4l(a)lists.daasi.de Event details: https://www.google.com/calendar/event?action=VIEW&eid=NmhtdWowdm5hM2JodmMyY… Invitation from Google Calendar: https://www.google.com/calendar/ You are receiving this courtesy email at the account fim4l(a)lists.daasi.de because you are an attendee of this event. To stop receiving future updates for this event, decline this event. Alternatively, you can sign up for a Google account at https://www.google.com/calendar/ and control your notification settings for your entire calendar. Forwarding this invitation could allow any recipient to modify your RSVP response. Learn more at https://support.google.com/calendar/answer/37135#forwarding

1 0

Fwd: RA21 Adopts GEANT Data Protection Code of Conduct
by Jiri Pavlik 21 Mär '19

21 Mär '19

FYI ---------- Forwarded message --------- From: Julia Wallace <julia(a)ra21.org> Date: Fri, Mar 15, 2019 at 10:05 AM Subject: RA21 Adopts GEANT Data Protection Code of Conduct Privacy Matters! The RA21 project is pleased to announce its endorsement of the GEANT Data Protection Code of Conduct. Earlier this year (2019), the RA21 Security & Privacy group endorsed the GEANT Data Protection Code of Conduct as guidance that RA21 should follow: data minimization, purpose limitation, data retention, and more. What does data minimization mean in an RA21 context, where users are trying to access scholarly information resources, particularly in an academic setting? It means that unless the Service Provider (such as a publisher or other content vendor) has a specific agreement with an Identity Provider (IdP - usually an individual’s institution) to receive additional data the IdP should only send anonymous and pseudonymous identifiers to the Service Provider. Specifically, the service provider should only ask for eduPersonEntitlement and, optionally, a pseudonymous pairwise user identifier (e.g., eduPersonTargetedID). In the case that the IdP sends more attributes than those one or two requested by the Service Provider, the Service Provider must not collect or store that data under any circumstance. The endorsement of the GEANT Data Protection Code of Conduct and the specifics around what attributes may be requested feeds directly into the upcoming NISO Recommended Practices for Improved Access to Institutional Information Resources, expected to go out for public comment in the next few weeks. Expect another announcement from us as soon as that comment period opens.

4 15

initial questions
by Peter Schober 21 Mär '19

21 Mär '19

Dear all, I've recently subscribed to this list due to Raoul dropped its short name (FIM4L) on another mailing list and from then finding a czech language presentations on the Internet with contained links to this mailing list. The "charter" document referenced by Jiří yesterday answers a few of my questions with regard to the background (and possibly funding) of this effort but raises others (E.g. Why is this not a REFEDS Working Group? How come the identity federation community at large has never heard of this and has not been given a chance to provide input but eduGAIN, GEANT and REFEDS are already listed as "parties involved in this effort"? etc.) Both the charter and especially the "FIM4L guidelines and recommendations" documents referenced in the mail yesterday are fraught with issues, IMHO, both substantial and structural/editorial. So how do you want to handle this? Should I wait like everyone else who hasn't been invited into this effort until you consider those documents ready for wider publication? Or do you want to gather more input now -- but then why limit that additional input to myself only because I've managed to even find this list and not the wider community? Best regards, -peter

5 7

Next FIM4L call
by Jiri Pavlik 17 Mär '19

17 Mär '19

Dear all, you can indicate your availability for next on-line FIM4L call - https://doodle.com/poll/28bwm5wzyu862gkd In the call we will discuss finalisation of FIM4L proto-charter - https://docs.google.com/document/d/17EllwItlnB3fYhJ2ZNpX6Z1gUfF1948ORRvtbIA… FIM4L guidelines and recommendations - https://docs.google.com/document/d/1pIaEXfw9ZWnXM4p6Dd2Lri7RFWKgr7ObKLEGfUy… and recent adoption of GEANT Data Protection Code of Conduct by RA21. Best regards Jiri Pavlik, Moravian Library

1 0