- FIM4L - lists3.daasi.de

Webinar Nov. 25th - please share
by Jos Westerbeke 13 Nov '20

13 Nov '20

Hi all, Could you please share the information about our upcoming webinar on your social media like twitter and LinkedIn? Webinar: FIM Principles & Recommendations for Libraries. Wednesday, November 25, 2020, 3:00 PM - 4:00 PM (Amsterdam) Registration: https://www.anymeeting.com/AccountManager/RegEv.aspx?PIID=EF55D889804C30 This will be the agenda: 15:00 - Introduction 15:05 - Multiple choice questions by web poll 15:10 - Presentation 15:30 - Panel discussion (Lee, Peter G., Jiri, Heather, Jos) 15:50 - Poll/questions 16:00 - End Thanks! Jos

1 0

Fwd: InCites additional registration flow
by Davide Vaghetti 11 Nov '20

11 Nov '20

Hi, We've finally sent the mail and we'll let you of any follow up. Thanks everyone for the contributes, Davide & Jiri -------- Forwarded Message -------- Subject: InCites additional registration flow Date: Wed, 11 Nov 2020 15:25:54 +0100 From: Davide Vaghetti <davide.vaghetti(a)garr.it> To: josef.jilek(a)clarivate.com, eniko.szasz(a)clarivate.com, heidi.muller(a)clarivate.com, science.shibbolethsupport(a)clarivate.com CC: Jiri Pavlik <jpavlik(a)cesnet.cz> Dear Clarivate representatives, prompted by some users in Italy, we have found that Clarivate's InCites introduced a registration flow after a successful institutional login. Users are compelled to register an email address and to set an additional password in order to access to InCites. This is breaking the trust model at the base of the federated authentication and attributes releasing. The attributes needed to provide access to the service should be listed in the metadata and not requested in a separate flow that is unseen by the Home Organization Identity Provider and the Identity Federation. We kindly ask you to eliminate the registration flow and we suggest you follow the below recommendations that have been developed by FIM4L working group [1], which is composed by Librarians, Publishers and Identity Specialists from the Research and Education Identity Federation environment: - Don't ask users to create a new account after they have been authenticated by their institution. Link user institutional identity to InCites user account. - List all the required attributes in InCites SP metadata published to eduGAIN (for example eduPersonScopedAffiliation, eduPersonEntitlement, Pairwise Subject Identifier). - Implement a Seamless Access [2] sign in button and WAYF. - Declare compliance with the GÉANT Data Protection Code of Conduct [3] in InCites SP metadata in eduGAIN. - Declare compliance with the assertions of the REFEDS Sirtfi framework [4] in InCites SP metadata in eduGAIN. A great additional benefit in following FIM4L recommendations is that you can leverage the SeamlessAccess.org free discovery service and standardised sign in button developed in collaboration with NISO and International Association of STM Publishers. Kind regards, Davide Vaghetti (IDEM GARR AAI) and Jiri Pavlik (eduID.cz) on behalf of FIM4L [1] https://www.fim4l.org/?page_id=257 [2] https://seamlessaccess.org/ [3] https://wiki.geant.org/display/eduGAIN/Recipe+for+a+Service+Provider [4] https://refeds.org/sirtfi -- Davide Vaghetti Consortium GARR Tel: +390502213158 Mobile: +393357779542 Skype: daserzw

1 0

Re: [Fim4l] Fwd: InCites now requires users to supply email address and create a new set of credentials
by Jiri Pavlik 10 Nov '20

10 Nov '20

Hi Davide, perfect for me :-) Cheers Jiri On Mon, Nov 9, 2020 at 12:27 PM Davide Vaghetti <davide.vaghetti(a)garr.it> wrote: > On 09/11/20 12:07, Jiri Pavlik wrote: > > Hi Davide, > > > > great, I slightly edited the text to change the original GARR > > perspective to FIM4L one. > > Thanks! > > > > > I'd suggest to address the letter to following Clarivate representatives: > > josef.jilek(a)clarivate.com <mailto:josef.jilek@clarivate.com> > > eniko.szasz(a)clarivate.com <mailto:eniko.szasz@clarivate.com> > > heidi.muller(a)clarivate.com <mailto:heidi.muller@clarivate.com> > > It works for me. I suggest to give some time for the people in the list > to comment on the letter and then I'd sent it by noon Tomorrow if that's > ok for you. > > Cheers, > Davide > > > > > > > Cheers > > > > Jiri > > > > > > > > > > On Mon, Nov 9, 2020 at 11:31 AM Davide Vaghetti <davide.vaghetti(a)garr.it > > <mailto:davide.vaghetti@garr.it>> wrote: > > > > Hello Jiri, > > > > On 09/11/20 10:16, Jiri Pavlik wrote: > > > Hi Davide, > > > > > > I think we can prepare the cover letter at the Google Drive > > document [1] > > > and once the letter is sent to Clarivate representatives put a > copy to > > > FIM4L > > > documents [2]. Sounds good? > > > > > > > Sure! I've gave it a go with the text I've already prepared a few > weeks > > ago. I think it does some refining, but it should work as a start. > > > > Cheers, > > Davide > > > > > Cheers > > > > > > Jiri > > > > > > > > > > > > > > 1. > https://docs.google.com/document/d/1W1ZhKdJXkBiOvhKcm1PDvcUaPVrbFlKJmKU1_Wg… > > > 2. https://www.fim4l.org/?page_id=269 > > > > > > On Mon, Nov 9, 2020 at 10:02 AM Davide Vaghetti > > <davide.vaghetti(a)garr.it <mailto:davide.vaghetti@garr.it> > > > <mailto:davide.vaghetti@garr.it <mailto:davide.vaghetti@garr.it>>> > > wrote: > > > > > > Hello Jiri, > > > > > > thanks for this! I totally agree with the recommendations and > > I'll be > > > happy to help writing a cover letter if needed. > > > > > > I also have a side proposal/request on top of it. IMO it would > > be great > > > if the letter sent to Clarivate could be published on the > > fim4l website, > > > so I, as others, could openly refer to it for further > > communications > > > with Clarivate. > > > > > > What do you think? > > > > > > Cheers, > > > Davide > > > > > > On 09/11/20 09:38, Jiri Pavlik wrote: > > > > Dear all, > > > > > > > > I believe that everyone is happy about our recommendations > for > > > Clarivate > > > > regarding federated authentication at InCites - > > > > > > > > > > > > > > https://docs.google.com/document/d/1W1ZhKdJXkBiOvhKcm1PDvcUaPVrbFlKJmKU1_Wg… > > > > > > > > I am going to reach out Clarivate representatives within few > > days > > > with Cc > > > > to FIM4L list as we agreed on FIM4L WG call last week. > > > > > > > > Kind regards > > > > > > > > Jiri > > > > > > > > > > > > On Fri, Oct 23, 2020 at 7:27 PM Peter Gietz > > <peter.gietz(a)daasi.de <mailto:peter.gietz@daasi.de> > > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>> > > > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de> > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>>>> wrote: > > > > > > > > Hi Jiri, > > > > > > > > Thanks for the update. > > > > > > > > Cheers, > > > > > > > > Peter > > > > > > > > Am 20.10.20 um 10:27 schrieb Jiri Pavlik: > > > >> Hi Peter, > > > >> > > > >> we discussed what we can do on a call with Davide and > Peter > > > >> Schober and > > > >> agreed that FIM4L should approach Clarivate regarding > bad > > > >> federated authentication > > > >> implementation. There is a draft what FIM4L could > > suggest to > > > >> Clarivate: > > > >> > > > >> > > > > > > https://docs.google.com/document/d/1W1ZhKdJXkBiOvhKcm1PDvcUaPVrbFlKJmKU1_Wg… > > > >> > > > >> All the best > > > >> > > > >> Jiri > > > >> > > > >> > > > >> > > > >> On Mon, Oct 19, 2020 at 7:08 PM Peter Gietz > > > <peter.gietz(a)daasi.de <mailto:peter.gietz@daasi.de> > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>> > > > >> <mailto:peter.gietz@daasi.de > > <mailto:peter.gietz@daasi.de> <mailto:peter.gietz@daasi.de > > <mailto:peter.gietz@daasi.de>>>> > > > wrote: > > > >> > > > >> Hi all, > > > >> > > > >> welcome here Davide, your presence here is much > > appreciated. > > > >> > > > >> Yes it is obvious that more and more publishers see > a > > > value in > > > >> collecting data ... > > > >> > > > >> May be we should think about a page on our website > > with a > > > list of > > > >> "Publishers that are conformant with the FIM4L > > > >> recommendations". This > > > >> could be an insentive for publishers to not go the > > way we > > > >> observed here. > > > >> Just an idea.... > > > >> > > > >> What else could we do to convince publishers to be > > > conformant? > > > >> > > > >> Cheers, > > > >> > > > >> Peter > > > >> > > > >> Am 12.10.2020 um 09:22 schrieb Jos Westerbeke: > > > >> > Hello Davide, > > > >> > > > > >> > Thanks for joining and for your email. > > > >> > > > > >> > Things are coming together at a perfect timing I > > guess. > > > >> We're almost ready to publish the final version of > > FIM4L > > > >> Principles & Recommendations. > > > >> > > > > >> > The idea is that libraries worldwide can refer to > > a common > > > >> accepted document which describes how we > > (libraries) want to > > > >> establish federated SSO connections with publishers. > > > >> > > > > >> > Since a few weeks we have a new website where you > > can find > > > >> this document: https://www.fim4l.org/?page_id=257 > > > >> > > > > >> > But be patient: I'll send an announcement to this > > list, > > > >> probably by the end of this week, with a new > > graphical update > > > >> of the FIM4L Principles & Recommendations. > > > >> > > > > >> > When all things ready, the official published > > document will > > > >> be backed by Europe LIBER libraries (400+) and may > > be of > > > great > > > >> value for you to refer too by speaking with > publishers. > > > >> > > > > >> > All the best! > > > >> > Jos > > > >> > > > > >> > Jos Westerbeke > > > >> > Library IT Specialist / Demandmanager | Erasmus > > University > > > >> Rotterdam | Burgemeester Oudlaan 50, Library | > 3062PA > > > >> Rotterdam | jos.westerbeke(a)eur.nl > > <mailto:jos.westerbeke@eur.nl> > > > <mailto:jos.westerbeke@eur.nl <mailto:jos.westerbeke@eur.nl>> > > > >> <mailto:jos.westerbeke@eur.nl > > <mailto:jos.westerbeke@eur.nl> > > > <mailto:jos.westerbeke@eur.nl <mailto:jos.westerbeke@eur.nl>>> > > | +31 640295513 > > > >> > > > > >> > > > > >> > Op 09-10-20 16:43 heeft FIM4L namens Davide > Vaghetti > > > >> <fim4l-bounces(a)lists.daasi.de > > <mailto:fim4l-bounces@lists.daasi.de> > > > <mailto:fim4l-bounces@lists.daasi.de > > <mailto:fim4l-bounces@lists.daasi.de>> > > > >> <mailto:fim4l-bounces@lists.daasi.de > > <mailto:fim4l-bounces@lists.daasi.de> > > > <mailto:fim4l-bounces@lists.daasi.de > > <mailto:fim4l-bounces@lists.daasi.de>>> namens > > > >> davide.vaghetti(a)garr.it > > <mailto:davide.vaghetti@garr.it> <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it>> > > > <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it> <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it>>>> > > > >> geschreven: > > > >> > > > > >> > Hello Heather, > > > >> > > > > >> > On 09/10/20 15:54, Heather Flanagan wrote: > > > >> > > Hello and welcome, Davide! > > > >> > > > > > >> > > I’m not sure if you’re asking a question > > about what > > > >> Clarivate is doing, > > > >> > > if you’re asking if anyone has knowledge of > > other > > > >> similar patterns, or > > > >> > > if this is just an FYI? > > > >> > > > > > >> > > > > >> > Yes, good point. Well, the thing is that > > Clarivate's > > > >> behavior is the > > > >> > exact opposite of the FIM4L recommendations, > > so I'd > > > like > > > >> the advice of > > > >> > this community in how to deal with this > > Publisher and > > > >> possibly doing it > > > >> > not alone. > > > >> > > > > >> > As Peter was pointing out, Clarivate's > additional > > > >> registration flow is > > > >> > breaking federated access and probably some > > contracts > > > >> and privacy law as > > > >> > well, but I'd prefer to restrain from the > > legalities at > > > >> least until it > > > >> > strictly necessary. Not to count that IDEM, > > as other > > > >> identity > > > >> > federations, are not direct parties in this > > type of > > > >> contracts. > > > >> > > > > >> > Cheers, > > > >> > Davide > > > >> > > > > >> > > Heather Flanagan — Translator of Geek to > Human > > > >> > > > > > >> > > > > > > https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fspherical… > > > >> > > On Oct 9, 2020, 2:45 AM -0700, Davide > Vaghetti > > > >> > > <davide.vaghetti(a)garr.it > > <mailto:davide.vaghetti@garr.it> > > > <mailto:davide.vaghetti@garr.it <mailto: > davide.vaghetti(a)garr.it>> > > > >> <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it> > > > <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it>>>>, wrote: > > > >> > >> Hello everyone, > > > >> > >> > > > >> > >> I've sent this message to the FOG mailing > > list about > > > >> Clarivate's InCites > > > >> > >> additional registration flow, but some > > Colleagues > > > >> suggested that FIM4L > > > >> > >> would have been a better venue for the > topic. > > > >> > >> > > > >> > >> Regards, > > > >> > >> Davide > > > >> > >> > > > >> > >> -------- Forwarded Message -------- > > > >> > >> Subject: InCites now requires users to > > supply email > > > >> address and create a > > > >> > >> new set of credentials > > > >> > >> Date: Wed, 7 Oct 2020 19:18:52 +0200 > > > >> > >> From: Davide Vaghetti > > <davide.vaghetti(a)garr.it <mailto:davide.vaghetti@garr.it> > > > <mailto:davide.vaghetti@garr.it <mailto: > davide.vaghetti(a)garr.it>> > > > >> <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it> > > > <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it>>>> > > > >> > >> To: fog(a)lists.refeds.org > > <mailto:fog@lists.refeds.org> > > > <mailto:fog@lists.refeds.org <mailto:fog@lists.refeds.org>> > > <mailto:fog@lists.refeds.org <mailto:fog@lists.refeds.org> > > > <mailto:fog@lists.refeds.org <mailto:fog@lists.refeds.org>>> > > > >> > >> > > > >> > >> Hello everyone, > > > >> > >> > > > >> > >> some IdP admins and Librarians alerted us > > about > > > >> Clarivate's InCites > > > >> > >> requiring an additional users registration > > after the > > > >> Institutional > > > >> > >> login. The flow is similar to what Elsevier > > > >> introduced in sciencedirect, > > > >> > >> but then rolled back, last year: > > > >> > >> > > > >> > >> - it starts on > > > >> > > > > > > https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fincites.c… > > > >> > >> - a user select "Sign in" and then > > "Institutional > > > >> (Shibboleth) Sign In" > > > >> > >> - once the authN flow is finished, the > user is > > > >> requested to register an > > > >> > >> email address and then to set a password > > to access > > > >> InCites > > > >> > >> > > > >> > >> As in the case of Elsevier, the above has > > not been > > > >> anticipated in any > > > >> > >> way from Clarivate, which so far was > letting > > > users in > > > >> with just a > > > >> > >> transient nameid and ePSA. > > > >> > >> > > > >> > >> Regards, > > > >> > >> Davide > > > >> > >> -- > > > >> > >> Davide Vaghetti > > > >> > >> Consortium GARR > > > >> > >> Tel: +390502213158 > > > >> > >> Mobile: +393357779542 > > > >> > >> Skype: daserzw > > > >> > >> > > _______________________________________________ > > > >> > >> FIM4L mailing list > > > >> > >> FIM4L(a)lists.daasi.de > > <mailto:FIM4L@lists.daasi.de> > > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>>> > > > >> > >> > > > >> > > > > > > https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.daas… > > > >> > > > > >> > -- > > > >> > Davide Vaghetti > > > >> > Consortium GARR > > > >> > Tel: +390502213158 > > > >> > Mobile: +393357779542 > > > >> > Skype: daserzw > > > >> > > _______________________________________________ > > > >> > FIM4L mailing list > > > >> > FIM4L(a)lists.daasi.de > > <mailto:FIM4L@lists.daasi.de> <mailto:FIM4L@lists.daasi.de > > <mailto:FIM4L@lists.daasi.de>> > > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>>> > > > >> > > > > >> > > > > > > https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.daas… > > > >> > > > > >> > > > > >> > _______________________________________________ > > > >> > FIM4L mailing list > > > >> > FIM4L(a)lists.daasi.de > > <mailto:FIM4L@lists.daasi.de> <mailto:FIM4L@lists.daasi.de > > <mailto:FIM4L@lists.daasi.de>> > > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>>> > > > >> > http://lists.daasi.de/listinfo/fim4l > > > >> > > > >> -- > > > >> > > > >> Peter Gietz, CEO > > > >> > > > >> DAASI International GmbH > > > >> Europaplatz 3 > > > >> D-72072 Tübingen > > > >> Germany > > > >> > > > >> phone: +49 7071 407109-0 > > > >> fax: +49 7071 407109-9 > > > >> email: peter.gietz(a)daasi.de > > <mailto:peter.gietz@daasi.de> <mailto:peter.gietz@daasi.de > > <mailto:peter.gietz@daasi.de>> > > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de> > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>>> > > > >> web: www.daasi.de <http://www.daasi.de> > > <http://www.daasi.de> > > > <http://www.daasi.de> > > > >> > > > >> Sitz der Gesellschaft: Tübingen > > > >> Registergericht: Amtsgericht Stuttgart, HRB 382175 > > > >> Geschäftsleitung: Peter Gietz > > > >> > > > >> _______________________________________________ > > > >> FIM4L mailing list > > > >> FIM4L(a)lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>> > > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>>> > > > >> http://lists.daasi.de/listinfo/fim4l > > > >> > > > > -- > > > > > > > > Peter Gietz, CEO > > > > > > > > DAASI International GmbH > > > > Europaplatz 3 > > > > D-72072 Tübingen > > > > Germany > > > > > > > > phone: +49 7071 407109-0 > > > > fax: +49 7071 407109-9 > > > > email: peter.gietz(a)daasi.de > > <mailto:peter.gietz@daasi.de> <mailto:peter.gietz@daasi.de > > <mailto:peter.gietz@daasi.de>> > > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de> > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>>> > > > > web: www.daasi.de <http://www.daasi.de> > > <http://www.daasi.de> <http://www.daasi.de> > > > > > > > > Sitz der Gesellschaft: Tübingen > > > > Registergericht: Amtsgericht Stuttgart, HRB 382175 > > > > Geschäftsleitung: Peter Gietz > > > > > > > > > > > > _______________________________________________ > > > > FIM4L mailing list > > > > FIM4L(a)lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>> > > > > http://lists.daasi.de/listinfo/fim4l > > > > > > > > > > -- > > > Davide Vaghetti > > > Consortium GARR > > > Tel: +390502213158 > > > Mobile: +393357779542 > > > Skype: daserzw > > > > > > > -- > > Davide Vaghetti > > Consortium GARR > > Tel: +390502213158 > > Mobile: +393357779542 > > Skype: daserzw > > > > -- > Davide Vaghetti > Consortium GARR > Tel: +390502213158 > Mobile: +393357779542 > Skype: daserzw >

2 3

Re: [Fim4l] Fwd: InCites now requires users to supply email address and create a new set of credentials
by Jiri Pavlik 09 Nov '20

09 Nov '20

Hi Davide, great, I slightly edited the text to change the original GARR perspective to FIM4L one. I'd suggest to address the letter to following Clarivate representatives: josef.jilek(a)clarivate.com eniko.szasz(a)clarivate.com heidi.muller(a)clarivate.com Cheers Jiri On Mon, Nov 9, 2020 at 11:31 AM Davide Vaghetti <davide.vaghetti(a)garr.it> wrote: > Hello Jiri, > > On 09/11/20 10:16, Jiri Pavlik wrote: > > Hi Davide, > > > > I think we can prepare the cover letter at the Google Drive document [1] > > and once the letter is sent to Clarivate representatives put a copy to > > FIM4L > > documents [2]. Sounds good? > > > > Sure! I've gave it a go with the text I've already prepared a few weeks > ago. I think it does some refining, but it should work as a start. > > Cheers, > Davide > > > Cheers > > > > Jiri > > > > > > > > 1. > https://docs.google.com/document/d/1W1ZhKdJXkBiOvhKcm1PDvcUaPVrbFlKJmKU1_Wg… > > 2. https://www.fim4l.org/?page_id=269 > > > > On Mon, Nov 9, 2020 at 10:02 AM Davide Vaghetti <davide.vaghetti(a)garr.it > > <mailto:davide.vaghetti@garr.it>> wrote: > > > > Hello Jiri, > > > > thanks for this! I totally agree with the recommendations and I'll be > > happy to help writing a cover letter if needed. > > > > I also have a side proposal/request on top of it. IMO it would be > great > > if the letter sent to Clarivate could be published on the fim4l > website, > > so I, as others, could openly refer to it for further communications > > with Clarivate. > > > > What do you think? > > > > Cheers, > > Davide > > > > On 09/11/20 09:38, Jiri Pavlik wrote: > > > Dear all, > > > > > > I believe that everyone is happy about our recommendations for > > Clarivate > > > regarding federated authentication at InCites - > > > > > > > > > https://docs.google.com/document/d/1W1ZhKdJXkBiOvhKcm1PDvcUaPVrbFlKJmKU1_Wg… > > > > > > I am going to reach out Clarivate representatives within few days > > with Cc > > > to FIM4L list as we agreed on FIM4L WG call last week. > > > > > > Kind regards > > > > > > Jiri > > > > > > > > > On Fri, Oct 23, 2020 at 7:27 PM Peter Gietz <peter.gietz(a)daasi.de > > <mailto:peter.gietz@daasi.de> > > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>>> > wrote: > > > > > > Hi Jiri, > > > > > > Thanks for the update. > > > > > > Cheers, > > > > > > Peter > > > > > > Am 20.10.20 um 10:27 schrieb Jiri Pavlik: > > >> Hi Peter, > > >> > > >> we discussed what we can do on a call with Davide and Peter > > >> Schober and > > >> agreed that FIM4L should approach Clarivate regarding bad > > >> federated authentication > > >> implementation. There is a draft what FIM4L could suggest to > > >> Clarivate: > > >> > > >> > > > https://docs.google.com/document/d/1W1ZhKdJXkBiOvhKcm1PDvcUaPVrbFlKJmKU1_Wg… > > >> > > >> All the best > > >> > > >> Jiri > > >> > > >> > > >> > > >> On Mon, Oct 19, 2020 at 7:08 PM Peter Gietz > > <peter.gietz(a)daasi.de <mailto:peter.gietz@daasi.de> > > >> <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>>> > > wrote: > > >> > > >> Hi all, > > >> > > >> welcome here Davide, your presence here is much > appreciated. > > >> > > >> Yes it is obvious that more and more publishers see a > > value in > > >> collecting data ... > > >> > > >> May be we should think about a page on our website with a > > list of > > >> "Publishers that are conformant with the FIM4L > > >> recommendations". This > > >> could be an insentive for publishers to not go the way we > > >> observed here. > > >> Just an idea.... > > >> > > >> What else could we do to convince publishers to be > > conformant? > > >> > > >> Cheers, > > >> > > >> Peter > > >> > > >> Am 12.10.2020 um 09:22 schrieb Jos Westerbeke: > > >> > Hello Davide, > > >> > > > >> > Thanks for joining and for your email. > > >> > > > >> > Things are coming together at a perfect timing I guess. > > >> We're almost ready to publish the final version of FIM4L > > >> Principles & Recommendations. > > >> > > > >> > The idea is that libraries worldwide can refer to a > common > > >> accepted document which describes how we (libraries) want > to > > >> establish federated SSO connections with publishers. > > >> > > > >> > Since a few weeks we have a new website where you can > find > > >> this document: https://www.fim4l.org/?page_id=257 > > >> > > > >> > But be patient: I'll send an announcement to this list, > > >> probably by the end of this week, with a new graphical > update > > >> of the FIM4L Principles & Recommendations. > > >> > > > >> > When all things ready, the official published document > will > > >> be backed by Europe LIBER libraries (400+) and may be of > > great > > >> value for you to refer too by speaking with publishers. > > >> > > > >> > All the best! > > >> > Jos > > >> > > > >> > Jos Westerbeke > > >> > Library IT Specialist / Demandmanager | Erasmus > University > > >> Rotterdam | Burgemeester Oudlaan 50, Library | 3062PA > > >> Rotterdam | jos.westerbeke(a)eur.nl > > <mailto:jos.westerbeke@eur.nl> > > >> <mailto:jos.westerbeke@eur.nl > > <mailto:jos.westerbeke@eur.nl>> | +31 640295513 > > >> > > > >> > > > >> > Op 09-10-20 16:43 heeft FIM4L namens Davide Vaghetti > > >> <fim4l-bounces(a)lists.daasi.de > > <mailto:fim4l-bounces@lists.daasi.de> > > >> <mailto:fim4l-bounces@lists.daasi.de > > <mailto:fim4l-bounces@lists.daasi.de>> namens > > >> davide.vaghetti(a)garr.it <mailto:davide.vaghetti@garr.it> > > <mailto:davide.vaghetti@garr.it <mailto:davide.vaghetti@garr.it>>> > > >> geschreven: > > >> > > > >> > Hello Heather, > > >> > > > >> > On 09/10/20 15:54, Heather Flanagan wrote: > > >> > > Hello and welcome, Davide! > > >> > > > > >> > > I’m not sure if you’re asking a question about > what > > >> Clarivate is doing, > > >> > > if you’re asking if anyone has knowledge of other > > >> similar patterns, or > > >> > > if this is just an FYI? > > >> > > > > >> > > > >> > Yes, good point. Well, the thing is that Clarivate's > > >> behavior is the > > >> > exact opposite of the FIM4L recommendations, so I'd > > like > > >> the advice of > > >> > this community in how to deal with this Publisher > and > > >> possibly doing it > > >> > not alone. > > >> > > > >> > As Peter was pointing out, Clarivate's additional > > >> registration flow is > > >> > breaking federated access and probably some > contracts > > >> and privacy law as > > >> > well, but I'd prefer to restrain from the > legalities at > > >> least until it > > >> > strictly necessary. Not to count that IDEM, as other > > >> identity > > >> > federations, are not direct parties in this type of > > >> contracts. > > >> > > > >> > Cheers, > > >> > Davide > > >> > > > >> > > Heather Flanagan — Translator of Geek to Human > > >> > > > > >> > > > https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fspherical… > > >> > > On Oct 9, 2020, 2:45 AM -0700, Davide Vaghetti > > >> > > <davide.vaghetti(a)garr.it > > <mailto:davide.vaghetti@garr.it> > > >> <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it>>>, wrote: > > >> > >> Hello everyone, > > >> > >> > > >> > >> I've sent this message to the FOG mailing list > about > > >> Clarivate's InCites > > >> > >> additional registration flow, but some Colleagues > > >> suggested that FIM4L > > >> > >> would have been a better venue for the topic. > > >> > >> > > >> > >> Regards, > > >> > >> Davide > > >> > >> > > >> > >> -------- Forwarded Message -------- > > >> > >> Subject: InCites now requires users to supply > email > > >> address and create a > > >> > >> new set of credentials > > >> > >> Date: Wed, 7 Oct 2020 19:18:52 +0200 > > >> > >> From: Davide Vaghetti <davide.vaghetti(a)garr.it > > <mailto:davide.vaghetti@garr.it> > > >> <mailto:davide.vaghetti@garr.it > > <mailto:davide.vaghetti@garr.it>>> > > >> > >> To: fog(a)lists.refeds.org > > <mailto:fog@lists.refeds.org> <mailto:fog@lists.refeds.org > > <mailto:fog@lists.refeds.org>> > > >> > >> > > >> > >> Hello everyone, > > >> > >> > > >> > >> some IdP admins and Librarians alerted us about > > >> Clarivate's InCites > > >> > >> requiring an additional users registration after > the > > >> Institutional > > >> > >> login. The flow is similar to what Elsevier > > >> introduced in sciencedirect, > > >> > >> but then rolled back, last year: > > >> > >> > > >> > >> - it starts on > > >> > > > https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fincites.c… > > >> > >> - a user select "Sign in" and then "Institutional > > >> (Shibboleth) Sign In" > > >> > >> - once the authN flow is finished, the user is > > >> requested to register an > > >> > >> email address and then to set a password to > access > > >> InCites > > >> > >> > > >> > >> As in the case of Elsevier, the above has not > been > > >> anticipated in any > > >> > >> way from Clarivate, which so far was letting > > users in > > >> with just a > > >> > >> transient nameid and ePSA. > > >> > >> > > >> > >> Regards, > > >> > >> Davide > > >> > >> -- > > >> > >> Davide Vaghetti > > >> > >> Consortium GARR > > >> > >> Tel: +390502213158 > > >> > >> Mobile: +393357779542 > > >> > >> Skype: daserzw > > >> > >> _______________________________________________ > > >> > >> FIM4L mailing list > > >> > >> FIM4L(a)lists.daasi.de > > <mailto:FIM4L@lists.daasi.de> <mailto:FIM4L@lists.daasi.de > > <mailto:FIM4L@lists.daasi.de>> > > >> > >> > > >> > > > https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.daas… > > >> > > > >> > -- > > >> > Davide Vaghetti > > >> > Consortium GARR > > >> > Tel: +390502213158 > > >> > Mobile: +393357779542 > > >> > Skype: daserzw > > >> > _______________________________________________ > > >> > FIM4L mailing list > > >> > FIM4L(a)lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>> > > >> > > > >> > > > https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.daas… > > >> > > > >> > > > >> > _______________________________________________ > > >> > FIM4L mailing list > > >> > FIM4L(a)lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>> > > >> > http://lists.daasi.de/listinfo/fim4l > > >> > > >> -- > > >> > > >> Peter Gietz, CEO > > >> > > >> DAASI International GmbH > > >> Europaplatz 3 > > >> D-72072 Tübingen > > >> Germany > > >> > > >> phone: +49 7071 407109-0 > > >> fax: +49 7071 407109-9 > > >> email: peter.gietz(a)daasi.de <mailto:peter.gietz@daasi.de> > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>> > > >> web: www.daasi.de <http://www.daasi.de> > > <http://www.daasi.de> > > >> > > >> Sitz der Gesellschaft: Tübingen > > >> Registergericht: Amtsgericht Stuttgart, HRB 382175 > > >> Geschäftsleitung: Peter Gietz > > >> > > >> _______________________________________________ > > >> FIM4L mailing list > > >> FIM4L(a)lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > <mailto:FIM4L@lists.daasi.de <mailto:FIM4L@lists.daasi.de>> > > >> http://lists.daasi.de/listinfo/fim4l > > >> > > > -- > > > > > > Peter Gietz, CEO > > > > > > DAASI International GmbH > > > Europaplatz 3 > > > D-72072 Tübingen > > > Germany > > > > > > phone: +49 7071 407109-0 > > > fax: +49 7071 407109-9 > > > email: peter.gietz(a)daasi.de <mailto:peter.gietz@daasi.de> > > <mailto:peter.gietz@daasi.de <mailto:peter.gietz@daasi.de>> > > > web: www.daasi.de <http://www.daasi.de> <http://www.daasi.de > > > > > > > > Sitz der Gesellschaft: Tübingen > > > Registergericht: Amtsgericht Stuttgart, HRB 382175 > > > Geschäftsleitung: Peter Gietz > > > > > > > > > _______________________________________________ > > > FIM4L mailing list > > > FIM4L(a)lists.daasi.de <mailto:FIM4L@lists.daasi.de> > > > http://lists.daasi.de/listinfo/fim4l > > > > > > > -- > > Davide Vaghetti > > Consortium GARR > > Tel: +390502213158 > > Mobile: +393357779542 > > Skype: daserzw > > > > -- > Davide Vaghetti > Consortium GARR > Tel: +390502213158 > Mobile: +393357779542 > Skype: daserzw >

1 0

Fwd: InCites now requires users to supply email address and create a new set of credentials
by Davide Vaghetti 09 Nov '20

09 Nov '20

Hello everyone, I've sent this message to the FOG mailing list about Clarivate's InCites additional registration flow, but some Colleagues suggested that FIM4L would have been a better venue for the topic. Regards, Davide -------- Forwarded Message -------- Subject: InCites now requires users to supply email address and create a new set of credentials Date: Wed, 7 Oct 2020 19:18:52 +0200 From: Davide Vaghetti <davide.vaghetti(a)garr.it> To: fog(a)lists.refeds.org Hello everyone, some IdP admins and Librarians alerted us about Clarivate's InCites requiring an additional users registration after the Institutional login. The flow is similar to what Elsevier introduced in sciencedirect, but then rolled back, last year: - it starts on https://incites.clarivate.com - a user select "Sign in" and then "Institutional (Shibboleth) Sign In" - once the authN flow is finished, the user is requested to register an email address and then to set a password to access InCites As in the case of Elsevier, the above has not been anticipated in any way from Clarivate, which so far was letting users in with just a transient nameid and ePSA. Regards, Davide -- Davide Vaghetti Consortium GARR Tel: +390502213158 Mobile: +393357779542 Skype: daserzw

7 11

Library principles
by Jos Westerbeke 06 Nov '20

06 Nov '20

Hi all, For those who like to know why FIM4L exists, I've found a great speech of Lisa Hinchliffe about privacy and intellectual freedom. "Free People Read Freely". Thank you, Lisa! Recorded at the Elsevier webinar<https://www.elsevier.com/connect/library-connect/webinar-its-not-about-the-…> of Oct. 7th. Presentation of Lisa starts at: 00:09:10. Please mind our upcoming webinar. Wednesday, November 25, 2020, 3:00 PM - 4:00 PM CET.<https://www.anymeeting.com/AccountManager/RegEv.aspx?PIID=EF55D889804C30> And please share FIM4L Recommendations v.1.0<https://zenodo.org/record/4118124#.X5GqWUIzblx> Wish you all a good and healthy weekend! Jos

1 0

FIM4L news
by Jos Westerbeke 28 Okt '20

28 Okt '20

Hello everyone, It has been time for an informative message for a while. But now here it is! FIM4L is a non-profit initiative led by libraries which includes creating recommendations for configuring federated SSO authentication for library e-resources. With a special focus on privacy. The LIBER working group<https://libereurope.eu/strategy/research-infrastructures/fim4l/> (The EU part and currently base of FIM4L) has done some great work behind the scenes. - Final version Recommendations - We're happy to announce the publication<https://zenodo.org/record/4118124#.X5Ka00Izbly> of FIM4L's recommendations! Yesterday, it's published on Zenodo<https://zenodo.org/record/4118124#.X5GqWUIzblx> (Open Science platform) as an official LIBER(400+ EU libraries) publication. It's a new graphically updated version including an infographic of the two main recommendations to choose from: 4.A and 4.B named as Transitory Access and Personalized Access. We had to choose up to three editors, for citing purposes. (Peter G. Jiri and me) But authors are many of you, as we already have listed on the website. Thanks to everyone making this possible! You can find this version also on the FIM4L website<https://www.fim4l.org/?page_id=257>. Click on PDF. - Website - We have a new website. The website is hosted at HEAL-LINK<https://www.heal-link.gr/en/home-2/>. (Thanks, Leonidas.) We have our own logo. (Thanks, Peter, DAASI.) Please take a look at FIM4L.org<https://www.fim4l.org/>. It's all done for free, thanks to many dedicated volunteers like you, who just like their work;) - Talks with Elsevier - Several members of the LIBER working group are involved in talks with Elsevier. Elsevier is working on a project which includes the drafting of privacy principles for federated authentication. They asked FIM4L to be a sounding board. We represented the FIM4L principles which was appreciated. All just started and we'll let you know the progress. - SeamlessAccess.org - The FIM4L recommendations align with the entity categories<https://seamlessaccess.org/posts/2020-07-08-entitycategories/> developed by Seamless Access: "Anonymous Authorization" matches with FIM4L recommendation 4.A and "Pseudonymous Authorization" with 4.B. Thank you both SA and FIM4L representatives for the cooperation! - Consultation for Cambridge University Press - Cambridge University Press (CUP) requested recommendations regarding institutional sign in. Recommendations were discussed within FIM4L working group, passed to CUP and we are waiting for a feedback from CUP. - Approaching Clarivate regarding InCites - Bad federated authentication practices were spotted by several federation operators at Clarivate InCites. Recommendations are discussed within the FIM4L working group currently and will be passed to Clarivate. - Webinar - At Wednesday, November 25, 2020, 3:00 PM - 4:00 PM (Amsterdam) we will have a webinar<https://www.anymeeting.com/AccountManager/RegEv.aspx?PIID=EF55D889804C30> hosted by LIBER. Welcome! (Please register<https://www.anymeeting.com/AccountManager/RegEv.aspx?PIID=EF55D889804C30>) Kind regards, Jos Jos Westerbeke Library IT Specialist/manager | Erasmus University Rotterdam, Library | Burgemeester Oudlaan 50 | 3062PA Rotterdam | jos.westerbeke(a)eur.nl<mailto:jos.westerbeke@eur.nl> | +31 640295513

2 1

intro
by Davide Vaghetti 14 Okt '20

14 Okt '20

Hello everyone, my name is Davide Vaghetti, I work for GARR and I'm currently leading the Italian Identity Federation IDEM and I'm also working in the GEANT GN4-3 project as the eduGAIN Service owner. I've joined because I'm interested in the topics and I have something I'd like to share with the FIM4L community. I consent that my name is published on the FIM4L website. Cheers, Davide -- Davide Vaghetti Consortium GARR Tel: +390502213158 Mobile: +393357779542 Skype: daserzw

2 1

Fwd: InCites now requires users to supply email address and create a new set of credentials
by Davide Vaghetti 09 Okt '20

09 Okt '20

Hello everyone, I've sent the message below to the FOG mailing list about Clarivate's InCites additional registration flow, but then some Colleagues suggested that FIM4L would have been a better venue for the topic. I'm eager to have your opinions on the subject. Regards, Davide -------- Forwarded Message -------- Subject: InCites now requires users to supply email address and create a new set of credentials Date: Wed, 7 Oct 2020 19:18:52 +0200 From: Davide Vaghetti <davide.vaghetti(a)garr.it> To: fog(a)lists.refeds.org Hello everyone, some IdP admins and Librarians alerted us about Clarivate's InCites requiring an additional users registration after the Institutional login. The flow is similar to what Elsevier introduced in sciencedirect, but then rolled back, last year: - it starts on https://incites.clarivate.com - a user select "Sign in" and then "Institutional (Shibboleth) Sign In" - once the authN flow is finished, the user is requested to register an email address and then to set a password to access InCites As in the case of Elsevier, the above has not been anticipated in any way from Clarivate, which so far was letting users in with just a transient nameid and ePSA. Regards, Davide -- Davide Vaghetti Consortium GARR Tel: +390502213158 Mobile: +393357779542 Skype: daserzw

2 1

FW: Welcome to the "FIM4L" mailing list (Andreas Waldvogel)
by Waldvogel Andreas 11 Aug '20

11 Aug '20

==>short intro Andreas Waldvogel, MAS LIS, Programme Executive Online Library Globethics.net Library Please see my profile on LinkedIn: https://www.linkedin.com/in/waldvogelandreas/ Interested in RA21/Seamless Access and GetFTR Though no experience with Federated Identity Management (Shibboleth/Athens) As we at Globethics.net (https://repository.globethics.net ) Still use EZproxy for managing remote or rather campus wide access to restricted resources I fully support the LIBER recommendations for (minimum) attribute release ==> consent to publish your name on website (name and affiliation only) yes, do please use my name and affiliation on your website with thanks and regards Andreas Waldvogel Programme Executive Online Library Globethics.net waldvogel(a)globethics.net Tel.: +41 (0) 22 791 63 42 Skype: awaldvogel_ge Globethics.net Head Office 150 route de Ferney, CH 1211 Geneva 2, Switzerland www.globethics.net Follow us: Facebook, Twitter and Linked In -----Original Message----- From: FIM4L <fim4l-bounces(a)lists.daasi.de> On Behalf Of fim4l-request(a)lists.daasi.de Sent: 07 August 2020 08:37 To: Waldvogel Andreas <waldvogel(a)globethics.net> Subject: Welcome to the "FIM4L" mailing list (Digest mode) Welcome to the FIM4L(a)lists.daasi.de mailing list! --------------------------------------------------------------------------- The email list of FIM4L is growing. That's a good thing; we get attention from libraries, NREN's, and many supportive partners, from EU, Africa and the US. To keep track of all participants of FIM4L, we ask every participant for a short introduction. At least your name, function and affiliation. And why you're on FIM4L would be nice too. Just because many of the list don't know everyone involved. We also want to ask you whether you're fine with publishing your institution and personal name on the http://fim4l.org website. So, could you please write to the list: short intro consent to publish your name on website (name and affiliation only) --------------------------------------------------------------------------- To post to this list, send your message to: fim4l(a)lists.daasi.de General information about the mailing list is at: http://lists.daasi.de/listinfo/fim4l If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: http://lists.daasi.de/options/fim4l/waldvogel%40globethics.net You can also make such adjustments via email by sending a message to: FIM4L-request(a)lists.daasi.de with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe without confirmation. It is: salam007 Normally, Mailman will remind you of your lists.daasi.de mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you.

1 0