InCommon Library Services

["Ingham, Andy" <>]

Just FYI, I had an EXTENSIVE conversation with Dustin MacIver of EbscoHost
(he and I co-presented yesterday at NASIG --
http://www.nasig.org/conference_program.cfm )

I think I was able to drive home the importance of the "entitlement-only"
authorization that we've pushed for in the InC-Library best practices
recommendations.

I'm hopeful that we will be hearing some good news on this front in the
next couple of months.

Andy

On 4/14/11 12:14 PM, "Foster Zhang" 
<>
 wrote:

>At JHU, the situation are little different, we are using the hybrid
>environment for ebscohost. Ezproxy is configured to use wayfless url, and
>I have "mistakenly" entered both of ScopedAffiliation AND
>eduPersonEntitlement in the Ebscohost admin interface.
>
>It worked well, until David Kennedy asked me if Ebscohost needs both of
>the affiliation and ePE for shib to work, I checked Ebscohost
>documentation and was told they only need one of the attributes. So I
>went to the admin interface to remove ScopedAffiliation, and our user
>failed the permission after the change. I email to the support, the
>answer is that, yes, ebscohost only need one of the attributes, but since
>JHU release both, their system will use both to determine. I had to put
>the scopedaffiliation back.
>
>Now we have problem that one of our retired professors cannot access
>ebscohost, and I do not know what the scopedaffiliation will be for that
>person (maybe empty/lacking). I am stuck on this. I wish that ebscohost
>can do what their instruction says only use one of the attributes.
>
>My email contact was responsive, up to the point that I asked the one
>attribute required question.
>
>Here is the ebscohost tech support I used:
>David Love
>Customer Account Specialist
>EBSCO Publishing
>1-800-653-2726 ext 2715
>
>
>I will try to send email to him again, asking ePEntitlement to be used
>only for JHU Shibb access.
>
>Foster Zhang
>JHU Library systems
>
>-----Original Message-----
>From: 
>
>[mailto:]
> On Behalf Of Ingham, Andy
>Sent: Thursday, April 14, 2011 10:41 AM
>To: Steven Carmody; inc-librsvcs
>Cc: Joanne Schwendner
>Subject: Re: [inc-librsvcs] trouble shooting shib-enabled ebsco
>
>Steve --
>
>We've been in a holding pattern with Ebsco for at least 6 months.
>
>The crux of the issue for us has been their requirement that BOTH
>ScopedAffiliation AND eduPersonEntitlement (ePE) be released to their SP.
>
>We can obviously do that, the problem is that we entitle (give the ePE to)
>people for whom we CANNOT give authoritative ScopedAffiliations.  This is
>because our LDAP contains records for two organizations that have separate
>but related ID management systems (unchealthcare.org and northcarolina.edu
>(the 16-campus umbrella University of North Carolina)).
>
>Therefore, we would have a segment of our population that can successfully
>use our proxy server (which only requires the ePE) that would fail on
>authorization going directly to Ebsco via Shib.
>
>And yes, they've essentially stopped responding to me as well.
>
>
>Andy
>
>On 4/14/11 7:42 AM, "Steven Carmody" 
><>
> wrote:
>
>>Brown has begun a project to evaluate the hybrid environment described
>>by this group's work -- adding Shibboleth-enabled access to the existing
>>IP-based authentication to content providers.
>>
>>We've begun testing Shib-enabled access to EBSCO. We've made the changes
>>at the EBSCO admin screens, and our IDP logs indicate that we're
>>releasing the correct attributes. However, EBSCO isn't "authorizing" our
>>browser user. We've been working with EBSCO staff, but no progress. More
>>recently, they've stopped responding.
>>
>>Does anyone on this list have experience working with EBSCO ? Any
>>"tricks" to get this to work ? Any suggestions on how to get EBSCO to
>>work with us ?
>>
>>Thanks!
>