InC-Lib-Vendor

["Kenney, Norman" <>]

David et al,

 

Answers for RefWorks-COS:

 

1. What are the minimum attributes you require from an Identity Provider for basic Shibboleth authentication?

 

Required: eduPersonTargetedID OR eduPersonPrincipalName.

Optional: eduPersonScopedAffiliation

 

 

2. What additional services, if any, do you provide through Shibboleth beyond basic login, for example, personalization. If you do provide additional services, what is required to enable them?

 

Some "personalization" is an inherent part of our resource. We create an individual user account associated with the user's unique ID (ePTID or ePPN). Login via Shibboleth is always directly into this user account. Shibboleth is not used for anything other than authentication and (optionally) authorization. In particular, no user associated attributes are accepted other than the aforementioned ePTID, ePPN, and ePSA.

 

 

3. Do you support "WAYFless" access, that is, access that does not require a user to identify where they are from in order to reach his or her local authentication system?

 

Yes. A link to our Shibboleth-protected resource that includes a providerID parameter results in redirection to the IdP and "lazy session" establishment.

 

 

4. Do you support direct Shibboleth-authenticated links to resources?

 

The WAYFless link mentioned above is the only such link we support.

 

 

5. Who should libraries contact if they want to set up Shibboleth access to your site or if they have questions or problems?

 

 

 

Thanks for your efforts.

 

Norman Kenney

RefWorks-COS

 

 

From: David Kennedy [mailto:]
Sent: Thursday, July 09, 2009 6:29 AM
To: Kenney, Norman
Cc:
Subject: Refworks and InCommon Library Services Collaboration

 

Norman,

I am writing you on behalf of the InCommon Library Services Collaboration.

We represent a group of research libraries who are working to expand the use of Shibboleth among members of the InCommon federation. As part of that effort, we are gathering information from vendors about how they have implemented Shibboleth. By making this information more accessible, we hope to make it easier for libraries to use the technology. We also would like to help develop common practices among vendors that would simplify the implementation process for everyone involved and make Shibboleth an attractive option for users.

We think that expanding the use of Shibboleth will help you in various ways:

   1. Provide a more secure means of access than IP authentication.
   2. Provide better tools for identifying who is responsible when breaches occur.
   3. Make it possible for users to take advantage of personalized features on a site without requiring them to open a local account maintained by the vendor.
   4. Help to start moving away from IP-based authentication and the overhead it requires.

We ask that you answer the following questions, as they relate to your products and services:

   1. What are the minimum attributes you require from an Identity Provider for basic Shibboleth authentication?
   2. What additional services, if any, do you provide through Shibboleth beyond basic login, for example, personalization. If you do provide additional services, what is required to enable them?
   3. Do you support "WAYFless" access, that is, access that does not require a user to identify where they are from in order to reach his or her local authentication system?
   4. Do you support direct Shibboleth-authenticated links to resources?
   5. Who should libraries contact if they want to set up Shibboleth access to your site or if they have questions or problems?

We appreciate your willingness to help us in this effort.

David Kennedy, Duke University
Adam Chandler, Cornell University
Andy Ingham, University of North Carolina, Chapel Hill
Jonathan Lavigne, Stanford University
Kent Percival, University of Guelph
Joy Veronneau, Cornell University
Jason Zavar, OCLC
Fred Zhang, Michigan State University
Foster Zhang, Johns Hopkins University

[please send response email to ]

-----
David Kennedy
Systems Programmer
Perkins Library, Duke University
(919) 613-6831