InCommon Library Services

[Foster Zhang <>]

At JHU, the situation are little different, we are using the hybrid 
environment for ebscohost. Ezproxy is configured to use wayfless url, and I 
have "mistakenly" entered both of ScopedAffiliation AND eduPersonEntitlement 
in the Ebscohost admin interface.

It worked well, until David Kennedy asked me if Ebscohost needs both of the 
affiliation and ePE for shib to work, I checked Ebscohost documentation and 
was told they only need one of the attributes. So I went to the admin 
interface to remove ScopedAffiliation, and our user failed the permission 
after the change. I email to the support, the answer is that, yes, ebscohost 
only need one of the attributes, but since JHU release both, their system 
will use both to determine. I had to put the scopedaffiliation back.

Now we have problem that one of our retired professors cannot access 
ebscohost, and I do not know what the scopedaffiliation will be for that 
person (maybe empty/lacking). I am stuck on this. I wish that ebscohost can 
do what their instruction says only use one of the attributes. 

My email contact was responsive, up to the point that I asked the one 
attribute required question.

Here is the ebscohost tech support I used:
David Love
Customer Account Specialist
EBSCO Publishing
1-800-653-2726 ext 2715


I will try to send email to him again, asking ePEntitlement to be used only 
for JHU Shibb access.

Foster Zhang
JHU Library systems

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Ingham, Andy
Sent: Thursday, April 14, 2011 10:41 AM
To: Steven Carmody; inc-librsvcs
Cc: Joanne Schwendner
Subject: Re: [inc-librsvcs] trouble shooting shib-enabled ebsco

Steve --

We've been in a holding pattern with Ebsco for at least 6 months.

The crux of the issue for us has been their requirement that BOTH
ScopedAffiliation AND eduPersonEntitlement (ePE) be released to their SP.

We can obviously do that, the problem is that we entitle (give the ePE to)
people for whom we CANNOT give authoritative ScopedAffiliations.  This is
because our LDAP contains records for two organizations that have separate
but related ID management systems (unchealthcare.org and northcarolina.edu
(the 16-campus umbrella University of North Carolina)).

Therefore, we would have a segment of our population that can successfully
use our proxy server (which only requires the ePE) that would fail on
authorization going directly to Ebsco via Shib.

And yes, they've essentially stopped responding to me as well.


Andy

On 4/14/11 7:42 AM, "Steven Carmody" 
<>
 wrote:

>Brown has begun a project to evaluate the hybrid environment described
>by this group's work -- adding Shibboleth-enabled access to the existing
>IP-based authentication to content providers.
>
>We've begun testing Shib-enabled access to EBSCO. We've made the changes
>at the EBSCO admin screens, and our IDP logs indicate that we're
>releasing the correct attributes. However, EBSCO isn't "authorizing" our
>browser user. We've been working with EBSCO staff, but no progress. More
>recently, they've stopped responding.
>
>Does anyone on this list have experience working with EBSCO ? Any
>"tricks" to get this to work ? Any suggestions on how to get EBSCO to
>work with us ?
>
>Thanks!