- FIM4L - lists3.daasi.de

Re: [Fim4l] [refeds] Deprecating eduPersonTargetedID
by Peter Gietz 08 Apr '19

08 Apr '19

Hi all, as Peter rightly mentioned, FIM4L is a rather new activity that is currently taking up speed and visibility. A first website should be available this week. A charter and a recommendation document are in the making, the latter is still very raw. Although we see it as a library driven approach with focus on library requirements and standpoints towards scientific publishers (and RA21), the list is open to anyone that wants to contribute to FIM for libraries. Of course the recommendation document will contain attributes and thus discussions like this thread are relevant for the group. Nevertheless be aware that not all publishers have state of the art SAML SP implementations and providing EPTI might still be necessary for a while. Of course the recommendation document is a good place to push the newer and of course better alternative pairwise-id and we thank Peter S. to bring this up on that list. Since we are talking about a specification that was finalized this January, we cannot expect adaption in an SP community rather conservative towards software. As the RA21 in its announcement to support Coco mentions "Specifically, the service provider should only ask for eduPersonEntitlement and, optionally, a pseudonymous pairwise user identifier (e.g., eduPersonTargetedID)" we were discussing this on the fim4l list. Such a formulation, also mentioning the SAML subjectID specification and its pairwise-id (as preferred option), is the current idea. If important specifications like eduPerson deprecates EPTI, we might change that as well. But as I said: recommendation is one thing, changing software to consume other IDs another. BTW: a presentation on FIM4L is planned for the next REFEDS f2f in Tallinn. I am looking forward to that. Cheers, Peter G. Am 22.03.2019 um 15:45 schrieb Peter Schober: > * Peter Schober <peter.schober(a)univie.ac.at> [2019-03-22 15:37]: >> * Nick Roy <nroy(a)internet2.edu> [2019-03-22 15:16]: >>> What is FIM4L? I agree this recommendation is bad. >> Raoul mentioned it here recently: >> https://lists.refeds.org/sympa/arc/refeds/2019-03/msg00007.html > I found out a bit about it and reported back here: > https://lists.refeds.org/sympa/arc/refeds/2019-03/msg00013.html > > I've since also discovered (and subscribed to) the mailing list > http://lists.daasi.de/listinfo/fim4l > > None of this is for me to share but since the above info is all > publicly and independently discoverable I guess those of you > interested in joining this effort and discussing the essentials of > access to institutionally licensed resources could do so, same way I > did. > It is an effort "by the libraries", though (plus selected institutions > and federation folks, seemingly), so I'm probably more tolerated than > welcome at this point (and progressively so the more I speak up about > such issues ;)). > > -peter -- Peter Gietz, CEO DAASI International GmbH Europaplatz 3 D-72072 Tübingen Germany phone: +49 7071 407109-0 fax: +49 7071 407109-9 email: peter.gietz(a)daasi.de web: www.daasi.de Sitz der Gesellschaft: Tübingen Registergericht: Amtsgericht Stuttgart, HRB 382175 Geschäftsleitung: Peter Gietz

5 7

Notes: FIM4L call, 4 April 2019
by Heather Flanagan 05 Apr '19

05 Apr '19

(Action items in bold) Attending: Jos Westerbeke, Peter van Boheemen, Sander Engelberts, Jiri Pavlik, Peter Gietz, Barbara Monticini, Martini Torma, Raoul Teeuwen, Vasso Kalaitzi, Martina Tormar, Heather Flanagan - Welcome * Who is there * Who takes care of notes Heather will take care of notes today and in the future we’ll consider where to put them for more collaborative note taking. - Discuss finalization of FIM4L proto-charter <https://docs.google.com/document/d/17EllwItlnB3fYhJ2ZNpX6Z1gUfF1948ORRvtbIA…> * editing * how to publish Vasso: this is a good document as a basis for discussion within LIBER. They have more than 400 members that will need to be made aware fo the conversation. Will work on this further the week of April 15; her focus will not be on the technical components but instead on communicating the message. Peter: Regarding LIBER, is it likely this activity will become a LIBER working group? Since we do want this to be a library-led initiative, a LIBER working group would be a good thing. Vasso: A working group may be the outcome, not a starting point. It has to be part of the overall strategy before a working group can fully form; communication needs to happen first, and that’s where this document will be helpful. The conference in June will be a good target for generalized conversation. Peter: if there are any requirements that LIBER might have that impact our draft charter, would like to make sure the charter has the right structure for a LIBER working group (less work to do later). Vasso: Will use the existing document to discuss with the committee chairs; no more changes are needed in the document to make the scope and value proposition clear. Jos: The document is a great start. We do need to do an editorial pass to take care of things like expanding acronyms, clarifying language so it sounds less like a legal document. If someone wants to add something, please do so within the next week. Jos: Regarding how to publish, we now have a website (short term: https://daasi.de/fim4l <https://daasi.de/fim4l>, long term: fim4l.org) and it can be published there. Vasso: Note that LIBER working groups are closed; only LIBER members may participate. Instead, LIBER may put this forward as an initiative. What are the categories of stakeholders participating at this moment? That needs to be clear in the charter so we get ALL stakeholders engaged. Peter: Libraries, NRENS/identity federations, publishers, IT service/infrastructure providers are some of the stakeholder groups. We can group them like this in the charter. Jos: as a library, we would like to have a policy and a set of recommendations that allows us to choose from a set of options that would allow us alternatives when connecting to a publisher. So we need all the stakeholders involved since getting those options will require more than one group’s actions. Peter: Also involved in a FIM4R (Federated Identity Management for Researchers) group, which overlaps into an RDA interest group. Perhaps FIM4L could be the same, with FIM4L being bigger and then a LIBER-specific interest group. Vasso: An interesting idea, but it will take a few weeks to discuss with LIBER steering. - web page strawman * more content in the about section * publication of the charter * publication of a list of participants Peter: The website came out of the need for a landing page to point to after a presentation. It needs more text in the about page. There is no logo (yet) which is something we might want to think about. If/when we move this to it’s own web space (and not a Daasi-hosted site) we need infrastructure - web server, CMS - and we need to know who will own/manage the content. Jos: We need a clear and plain message on the problem that libraries are facing and the proposed solution. We have some time to figure this out; this may end up hosted with LIBER, but they need a few weeks to consider how they will be involved. Peter: We need to be clear as to who can/should be listed on the web page as participating. Propose that we personalize the list of who is participating (name and organization) in the charter, and include those people on the website. - Use of FIM4L email list: * Technical discussions included? (not sure if neccessary) * moderated or not? Jos: Not sure we can use the list where everyone is involved for in-depth technical discussions. Raoul: Perhaps create another - a high level list, and another for technical discussion Sander: Should we even have a technical discussion list, or should we just follow the RA21 and NREN guidance? Heather: Would much rather this group have enough technical knowledge that they can discuss and decide if the recommendations of other organizations are appropriate for this group. For example, the debate on whether RA21 should continue to recommend eduPersonTargetedID instead of the more current standard of a SAML pair-wise identifier should be discussed here and feedback offered to during the public commend period on RA21. Jos: Agreed, but we have to account for the fact that people on the list range from Directors of large organizations that do not want to see the technical detail. Peter: We need low-level technical discussion, esp. for the recommendations/guidelines text. So, support a general FIM4L mailing list, and a technical discussion list about our guideline. Action: we will create a second mailing list for technical discussion. Peter: Mailing list policies - the lists aren’t totally open, but the current policy is to let anyone who isn’t a spammer in. But would rather have the group decide whether that’s the right policy. How open should these two mailing lists be? Proposal: everyone who subscribes should be required to write a short introduction as to why they are joining. Jos: Right now, everyone knows everyone on the list, so requiring the introductions is a good idea. Peter: there are currently 31 members on the list. We can request that each of those people send an introduction, and those that don’t get removed from the list. Other Peter: if we could store those bios somewhere so that future people could also have that history and information about people on the list, that would be helpful. Jos: Will send out an email to the list requesting that members do introduction. Barbara: In mailman, there is a configurable option to set a welcome message that can be set to automatically request they send an introduction to the list. Peter: Will set that message after Jos sends out his request for introductions. - FIM4L guidelines and recommendations <https://docs.google.com/document/d/1pIaEXfw9ZWnXM4p6Dd2Lri7RFWKgr7ObKLEGfUy…> * general scope * level of technical details * political frame - recent adoption of GEANT Data Protection Code of Conduct by RA21 Heather: Will send a note to the mailing list explaining what’s happened within RA21 re: the GEANT DPCoCo

5 4

RA21's endorsement of the GEANT Data Protection Code of Conduct
by Heather Flanagan 05 Apr '19

05 Apr '19

Action item from today’s call: - recent adoption of GEANT Data Protection Code of Conduct by RA21 Heather: Will send a note to the mailing list explaining what’s happened within RA21 re: the GEANT DPCoCo Hello all, We didn’t have time to cover this on the call today, so I promised to send out an email to let folks know what’s happened here. Back at the end of January of this year, the RA21 Security and Privacy working group met to discuss whether they were willing to request that the RA21 initiative as a whole endorse the GEANT Data Protection Code of Conduct. Members of that group, which included publishers, librarians, and federated identity infrastructure people, agreed that the principles in the code of conduct were definitely worth endorsing. That said, they were only willing to endorse version 1, as version 2 is still considered a draft. Version 1 does not apply to Service Providers outside the EU, and does not cover GDPR, but the principles of data minimization, etc, are important in and of themselves to endorse in any federated service. The working group requested that any future work related to RA21 keep an eye on this space so that when version 2 of the code of conduct is finalized, whatever group is governing RA21 (or its successors) consider whether to endorse that future version. I wrote up a blog post <https://ra21.org/index.php/2019/02/28/ra21-adopts-refeds-data-protection-co…> on the RA21 website about this. Please let me know if you have any questions! Heather

3 6

Presenting FIM4L at the REFEDS meeting in June
by Licia Florio 04 Apr '19

04 Apr '19

Dear all, I just a quick chat with Nicole (REFEDS coordinator) about FIM4L. Although work in FIM4L has only started recently, it would be good to have a presentation at the upcoming REFEDS.The next REFEDS meeting will be co-located with TNC (but REFEDS attendance is free of charge).For more information please refer to https://refeds.org/. Is there somebody planning to be at TNC that could present on it? Cheers, Licia

4 4

Meeting April 4, 3-4 pm CET
by Jos Westerbeke 03 Apr '19

03 Apr '19

Dear all, According to the latest poll<https://doodle.com/poll/28bwm5wzyu862gkd> the next meeting would be held at April 4, 3-4 pm CET. We will meet online at: meet.google.com/ppq-dqwn-zgo<https://meet.google.com/ppq-dqwn-zgo> I'll send an invitation soon. Agenda proposal: - Welcome - Discuss finalization of FIM4L proto-charter<https://docs.google.com/document/d/17EllwItlnB3fYhJ2ZNpX6Z1gUfF1948ORRvtbIA…> (editing, how to publish) - FIM4L guidelines and recommendations<https://docs.google.com/document/d/1pIaEXfw9ZWnXM4p6Dd2Lri7RFWKgr7ObKLEGfUy…> - Use of FIM4L email list: Technical discussions included? and recent adoption of GEANT Data Protection Code of Conduct by RA21. Please allow me to list here all our current members. I think it's good to know to whom we are talking through emails and in meetings. And we welcome all new participants! ---------------------------- Please remove this section when replying/forwarding this email. ------ Libraries: Peter van Boheemen (Wageningen University) Bernd Oberknapp (Albert-Ludwigs-Universität Freiburg) Jiri Pavlik (AARC / Moravian Library) Petr Zabicka (Moravian Library) Jos Westerbeke (Erasmus University Rotterdam) Caroline Checkley (University of Essex) Mimi Calter (Stanford University) Partners: Sander Engelberts (OCLC) Licia Florio (GEANT) Peter Gietz (AARC / DAASI International) Leif Johansson (RA21 / SUNet) Vasso Kalaitzi (LIBER) Barbara Monticini (GARR) Raoul Teeuwen (SURFnet) Maarten Kremers (SURFnet) Astrid Verheusen (LIBER) Mark Williams (Jisc) Ilona Trtikova (CESNET) Heather Flanagan (RA21, REFEDS, FIM4R, IT consultant) Anna Keclikova (CzechELib consortium) Peter Schober (University of Vienna) Stefan Paetow (Jisc) ------------------------------- With kind regards, Jos Jos Westerbeke Library IT Specialist / Demandmanager | Erasmus University Rotterdam, Library | Burgemeester Oudlaan 50 | 3062PA Rotterdam | jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl> | +31 640295513

3 2

Fwd: FIM4L website & news?
by Peter 03 Apr '19

03 Apr '19

Hi all! This is to inform you that we now have a website strawman (https://daasi.de/fim4l) and that there is a nice blog / news story on Jiri's talk about FIM4L and about FIM4L. Any comments to the website text welcome. Jir and I tried to make it rather short for now. So we have sort of gone public. Of course the links to the two documents are not online, since still work in progress. But the finalized versions 1.0 can be published there as well. On the long term we can move this to the domain fim4l.org. But for this blog, we needed something quick. One more point: I would very much like to publish a list of participants in this activity. What would you think? Of course we would only publish the names of those participants who gave us the written permission (including via email) to do so. Cheers, Peter -------- Weitergeleitete Nachricht -------- Betreff: Re: FIM4L website & news? Datum: Mon, 1 Apr 2019 16:53:02 +0000 Von: Laura Durnford <laura.durnford(a)geant.org> An: Peter <peter.gietz(a)daasi.de> Kopie (CC): Jiri Pavlik <jiri.pavlik(a)mzk.cz>, Jennifer Vosseler <jennifer.vosseler(a)daasi.de> Great, many thanks Peter. The story is live on the AARC site here: https://aarc-project.eu/library-community-to-build-on-aarc-outputs-with-new… I have already posted it on the GEANT community blog page here: https://blog.geant.org/2019/04/01/library-community-to-build-on-aarc-output… and it will go out in the newsletter tomorrow. I will do social media dissemination some time a little later in the week. Cheers! Laura Laura Durnford Senior Communications Officer GÉANT M: +31 (0) 6517 76721 Skype: ldurnford -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72072 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de <http://www.daasi.de> DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

2 1

"AARC: Library community to build on AARC outputs with new FIM4L initiative"
by Raoul Teeuwen 01 Apr '19

01 Apr '19

https://aarc-project.eu/library-community-to-build-on-aarc-outputs-with-new… Kindest regards, Raoul Teeuwen SURFnet | Productmanager Trust & Identity | Kantoren Hoog Overborch (Hoog Catharijne) | Moreelsepark 48 - 3511 EP Utrecht | tel:0887873496 | tel:+31641195989 | raoul.teeuwen(a)surfnet.nl<mailto:raoul.teeuwen@surfnet.nl> | www.surfnet.nl<http://www.surfnet.nl> | route: www.surf.nl/over-surf/contact-met-surf<https://www.surf.nl/over-surf/contact-met-surf>

1 0

Stanfords statement
by Jos Westerbeke 29 Mär '19

29 Mär '19

Hi all, For your interest: "Protecting Patron Privacy in Digital Resources<https://scholarlykitchen.sspnet.org/2019/03/13/guest-post-protecting-patron…>" on Scholarly Kitchen. Stanford library made a statement<https://library.stanford.edu/using/special-policies/statement-patron-privac…> recently about patrons privacy. I think this statement perfectly aligns with our work. It draws the libraries' concerns and underlines the importance of our work. FIM4L should have the ability to make e-resource access with SSO better than using IP based access. Libraries cannot win the fight for preserving patron privacy by keep using IP based access. I think we even have to encourage SSO access (when Open Access without authentication is not possible) in order to "... carefully structure [SSO access] to minimize exposure of patron data as much as possible, but always to ensure disclosure of any PII that may be transmitted." According to the article. all the best, Jos Jos Westerbeke Library IT Specialist / Demandmanager | Erasmus University Rotterdam, Library | Burgemeester Oudlaan 50 | 3062PA Rotterdam | jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl> | +31 640295513

5 9

FW: [lis-e-resources] IP authentication - to switch off or not to switch off
by Raoul Teeuwen 29 Mär '19

29 Mär '19

I guess the below post is interesting for people on this list as well. Kindest regards, Raoul On 27/03/2019, 10:57, "outreach(a)ra21.simplelists.com<mailto:outreach@ra21.simplelists.com> on behalf of Julia Wallace" <outreach(a)ra21.simplelists.com<mailto:outreach@ra21.simplelists.com> on behalf of julia(a)RA21.org<mailto:julia@RA21.org>> wrote: Hi everyone Some interesting insights here (assumed mainly / exclusively UK). Regards, Julia From: An informal open list set up by UKSG - Connecting the Information Community [mailto:LIS-E-RESOURCES@JISCMAIL.AC.UK] On Behalf Of Barwick, Marie Sent: Wednesday, March 27, 2019 9:29 AM To: LIS-E-RESOURCES(a)JISCMAIL.AC.UK Subject: [lis-e-resources] IP authentication - to switch off or not to switch off Dear all, Q. “Some years ago we switched off IP access on campus in favour of relying on shibboleth authentication and our proxy server from on and off campus. There is some resistance to this now with some users advising that we are the only University that have done this so I would be very interested to find out if any others have also switched off IP authentication, and any feedback that they have received following this”? Many thanks for all of your comments that I received in respect of this questions. Out of 12 institutions that responded, 5 of you did have IP authentication switched on from on-campus but 5 of you (including Warwick) didn’t and a further 2 are in the process of moving away from it. There were also responses from some institutions who did offer IP authentication but were interested in moving away from this. It has been very useful for us to learn about the different experiences and approaches to authentication and has given us a better view of the landscape of this challenging issue. As promised, here is a summary of the comments which have been anonymised. ******************************************************************************************************************************************************************************************** “I’m considering switching off IP access at XXXXXXXXXXXXXX and using OCLC’s hosted EZproxy as the recommended access route and Shibboleth as a back-up option. Drivers include a more consistent user experience on and off-campus, better security, and another is that I’m involved in a pilot with OCLC for a new analytics service they’re developing for EZproxy. Currently the tool would only provide a snapshot of usage whereas I think the stats would be more useful if they included all” “We have received similar feedback around complexities of shibboleth authentication for students and academics when working off-campus. I personally don’t think this is specifically an issue with shibboleth or IP based authentication, but more the varied approach to implementation of sign-in links on different platforms. But this is also compounded by a sharp rise in expectations over the last few years where authentication in the consumer market (Amazon, Google, Twitter etc.) has vastly improved and reduced the need to remember a number of passwords and authentication routes/clicks. What this means for us and our students is that they see the 100 or so content platforms subscribed to by an institution as essentially the same thing in terms of how routes to access should work (as this is their experience elsewhere), they are provided by a single institution so why wouldn’t access simply work exactly the same across all of them – especially when on-campus SSO is standard. For the record, we currently have a mixed economy of IP and Shibboleth (preferring wayfless shibb routes wherever possible) but are also likely to be implementing EZ Proxy soon to help reduce some of the friction for off campus access” “Lack of IP authentication has also been raised as an issue by academic colleagues at XXXXXXXXX. Like others we favour Shibboleth but also use EZproxy. We have a restricted profile that we use for Walk-In users. As well as providing a Consistent experience (although this is vulnerable to the challenge that it is consistently difficult compared with IP authentication) it also allows us to provide access to our network to folk who are not, in strict licensing terms, members of the University (something academic colleagues have also requested)” “We always favour Shibboleth authentication using WAYFless url’s when possible and have done this for a number of years. For resources that only support IP we use a proxy server. Our reasoning being that it is easier for the students if the logging in experience is the same both on and off campus (rather than relying on IP when on campus and then having to login when off campus). Recently we have migrated to single sign-on so thinking about it, this probably isn’t the case anymore, with access being seamless in a lot of cases from on campus but requiring a login from off” “We use PingFederate (SAML) and EZproxy on campus. IP is no longer an option because we have a web filter in operation which obscures our IP range. The latter set up has caused some issues because we have found that, if we go direct to a site, we are sometimes recognised as another organisation using the same web filter. They have presumably provided the eresource supplier with the shared web filter IP range” “Same here. We use a range of authentication but obviously Shibboleth is more secure than IP and we are trying to move that way. It’s hard to do it with everything though so would be really interested to hear others experiences” “We do not do this – we have access via a mixture of Shibboleth, IP and EZproxy – but I would be very interested to hear the responses to this thread, if you were able to collate and share with the group” “Here at XXXXXXXXX we don’t IP authenticate to any resources, preferring to use Shib or EZProxy. Both of these methods work pretty seamlessly for us and to my knowledge we’ve not had any complaints about not using IP. Given the increasing occurrence of reported/detected eResource misuse (whether intentional or deliberate) I’d prefer we have definite user accountability to be able to deal with such instances when they occur. (It not that this is prolific, but we get maybe one every month or so that we need to investigate)” “We are in the process of doing the same, wherever possible, we don’t have a proxy server so some, although not much IP recognition will remain. We are linking WAYFlessly where we can and are discovering, in the process, that WAYFless linking via the Alma link resolver is not quite as developed as the literature would indicate, including for some fairly big suppliers such as Emerald and JSTOR” “I would not choose to do so although I can see the benefit it might bring in monitoring usage by department and so on. We have integrated Shibboleth into our single sign-on system including EZproxy. However, we know that more than half the users access content via internet search engines. Many users do not know about Shibboleth, even if they are shown it as an access option at the beginning of their studies / during information literacy sessions. The lack of uniformity in the signing on process is another concern. Also some publishers still do not offer federated access. It is useful to offer redundancy in access including via anonymous IP authentication or a VPN client without the need for extra clicks. Otherwise overall usage is impacted adversely” “I’d be very interested to see what other institutions do. We’re also on IP, EZproxy and Shibboleth at the moment. Would Shibboleth-only authentication present problems for walk-in users for instance?” Best wishes, Marie Marie Barwick | Resources Manager (Serials e-Resources and Digital Access) Resource Acquisitions and Digital Access | Library | University of Warwick<http://www2.warwick.ac.uk/> m.s.barwick(a)warwick.ac.uk<mailto:m.s.barwick@warwick.ac.uk> | External: 02476 573011 | Internal:73011 The Library | University of Warwick | Coventry | CV4 7AL | Find us on the interactive map<http://www2.warwick.ac.uk/about/visiting/maps/interactive/> lis-e-resources is a UKSG list - http://www.uksg.org UKSG groups also available on Facebook and LinkedIn Follow us on Twitter: https://twitter.com/UKSG To unsubscribe from this list please go to http://www.simplelists.com/confirm.php?u=5BIgC6Wynh2gSnqJeLuIcsPlyXSwYNLx

2 1

security example
by Jos Westerbeke 22 Mär '19

22 Mär '19

Hi all, Just happened: "Login details exposed online due to Elsevier data breach" as published yesterday in our university magazine<https://www.erasmusmagazine.nl/en/2019/03/21/login-details-exposed-online-d…>. A few hours later, library director comes to me: Do we exchange personal information to Elsevier? Hmm, IP address based: No. Also SSO: [check] only pseudo identifier. Answer: No, non PII. One hour later, email from DPO: Please explain what do we exchange to Elsevier? Blabla, transient identifier bla bla... "Alright, great!" We happy, but Elsevier should be happy too! (about us at least;) Conclusion: Security is an important topic in our recommendations too... Have a good weekend! Jos

3 2