The document discusses federated access management in college libraries, highlighting the necessity for reliable user authentication systems to comply with licensing agreements and protect copyright. It emphasizes the benefits of federated access models, which rely on trust among various colleges and suppliers, reducing costs related to managing numerous individual relationships and enabling a streamlined access process. The text also outlines the transition from proprietary systems to open standards, primarily through the promotion of the SAML standard, with Jisc's support for UK educational institutions adopting federated access solutions.

1. Federated Access Management The Basics 13 February 2008 Mike Moran RSCni

2. LR Forum Mike Moran RSCni Access Management in College Libraries – Some Basics Suppliers (licence providers) require: A sound system for identifying users of the service so that they can: Ensure that the fees charged are correct; That the users are legitimate members of the college; and So that the management of colleges can be held accountable for breaches of licence conditions – including infringement of copyright. Colleges require: An effective connection system between the individual user and the supplier.

3. LR Forum Mike Moran RSCni Solutions Tried So Far: Authentication of users by checking the IP address of their computer Authentication by using directories of users specific to the library of the college Authentication using the overall directory structures of the college network – of which the library users are a defined community Limitations for users and suppliers: If more than one person normally uses a computer (or server), the supplier cannot accurately count the number of users and cannot be sure that each user is legitimate The users have to sign on separately to use the online services of the library – multiple usernames and passwords per person Though you can move to Single Sign On, the directory structure requires careful construction and updating to make sure library users remain up to date – not every college member is necessarily a legitimate user of the licensed services

4. LR Forum So – along comes Federated Access Management Its features: Based upon the principle of trust between suppliers and users Trust could operate on a 1:1 basis between a college and a supplier But – this would mean large costs for the supplier to maintain a large number of individual relationships with colleges – costs that would be passed on to the users So – if users can form groups ( Federations ) and the group as a whole can be trusted by the suppliers, then the individual admin costs are reduced and the potential for savings to both parties are made real The working relationship is then dependent upon three components: The licensed service on offer from the supplier(s); The constructed identities of the client college; and A piece of software that provides to the supplier those identities that are legitimately connected to the college before releasing the service to the user each time. Mike Moran RSCni

5. The Gateways ATHENS INSTITUTION UK ACCESS MANAGEMENT FEDERATION FEDERATED INSTITUTION ATHENS CENTRAL ATHENS PROTECTED RESOURCE FEDERATED RESOURCE IdP Gateway SP Gateway LR Forum Note: Athens is referred to here simply for comparison with many existing situations

6. LR Forum Mike Moran RSCni IdP Gateway SP Gateway Identity Provider Gateway Outputs the data that confirms that the user requesting service is a registered student or staff member of the college concerned. This can be done with the minimum amount of personal information transferring directly to the supplier. Service Provider Gateway Confirms that the IdP data sent by the college matches the rights to access that the college has paid for (even if this is a FREE service) and causes the release of the item.

7. LR Forum Mike Moran RSCni See handout for explanation Shibboleth Flow Diagram User Service Provider (SP) Identity Provider (IdP) = College or Its Agent Where Are You From (WAYF) 1 2 3 4 5 6 7 8 Amount of information provided here can be managed by College

8. LR Forum Shibboleth Flow Diagram The previous diagram shows the flows which can occur during a typical Shibboleth-enabled transaction, with the browser user arriving at the Service Provider site without an existing session and without any information about the user's home institution being known by the Service Provider. There are many variations on this flow, most of them a lot simpler. In addition, later versions of Shibboleth will be able to operate in other ways; and the terminology used to refer to components is subject to change. However, this is offered as a starting point. The User attempts to access a Shibboleth-protected resource on the Service Provider site. The User is redirected to the federation WAYF. The User select his or her home institution ( *Identity Provider ) from the list presented by the WAYF. The Identity Provider, by whatever means it deems appropriate, ensures that the User is authenticated. After successful authentication, a one-time Handle (session identifier) is generated for this User session and is sent to the Service Provider – think of it like a ticket at the deli counter . The Service Provider uses the Handle to request attribute information from the Identity Provider for this user. The Identity Provider, on the basis of its Attribute Release Policy, allows or denies attribute information to be made available to this Service Provider. Based on the attribute information available to it, the Service Provider allows or refuses the User access to the resource. * Although the User's home institution is taken in the above summary to be equivalent to the Identity Provider, in fact an institution may choose to outsource the Identity Provider function to another organisation. However, this does not affect the principle of operation. Mike Moran RSCni

9. LR Forum Mike Moran RSCni Why did we go down this Shibboleth route at all? Posted by nicole [ Harris ] on January 23rd, 2008 “ There has obviously been a lot of debate in the last two days surrounding the regrettable announcement that JISC will no longer be funding the Federation Gateway Services [ through a contract with Eduserv (Athens) ]. This has led to people asking questions such as ‘why did we go down this Shibboleth route at all?’. I thought it might be useful to go back to the beginning. Below is the vision statement (we are very MSP here) for the Access Management Transition Programme. I think it sums things up quite nicely. The JISC Access Management Transition Programme aims to change the access management landscape within UK Further and Higher Education from a system predominantly based on proprietary systems to one with open standards at its core. The primary enabler of this change will be the introduction of federation access management and a strong recommendation to all institutions and organisations involved in education to implement access management solutions based on the SAML (Security Assertion Mark-Up Language) standard.

10. LR Forum Mike Moran RSCni “ In supporting an open standards approach, rather than any particular technology, JISC hopes to: Improve the business decisions made by institutions in relation to identity, access and resource management Increase the commercial choice to institutions in relation to identity and access management technologies. Reduce the impact and cost of vendor lock-in within the JISC community. Embed knowledge within the community, rather than within any one organisation. Place the principles of the JISC Information Environment at the core of the implementation of access management within its community. Move towards a single sign-on environment for UK Further and Higher Education institutions across internal, external, and collaborative resources. The JISC Access Management Transition Programme runs from July 2006 – December 2008 , and is funded and supported by the JISC Integrated Information Environment Committee (JIIE). Funding of £2.2 million has been allocated to this programme. “

11. JISC ‘Institutional Preparedness’ Study [Mar 2007](170 institutions): Directory Services: 66% HE / 69% FE use Active Directory 31% HE / 13% FE use Novell eDirectory 27% HE / 31 % FE use OpenLDAP * Outsourcing / Delegation of Identity Management: 2% of HE / 0% FE outsource directory / identity management 25% HE allow departmental control of identity management Current use of Athens: Classic Athens: 57% HE / 78% FE AthensDA: 35% HE / 7% FE * LDAP = Lightweight Directory Access Protocol – a standard for user directories 07/08/09 | slide LR Forum

12. LR Forum Mike Moran RSCni Benefits of joining the UK Access Management Federation Benefits for Identity Providers (IdP) – typically Schools / FE Institutions / HE Institutes / Research Institutes Easier to comply with regulatory requirements (Data Protection Act 1998, etc. Better service offered to users (more control) Can integrate with existing access management systems Can use the same access control for all resources – both internal and external This means that it can be used for managing access to internal college repositories as well as external services Fewer support problems (can all be controlled centrally) Benefits for End Users Much less need to disclose your identity Personal data kept between you and your home organisation Publishers can tailor services better (preferences, special groups of users etc) (At least) one less password to remember

13. LR Forum Mike Moran RSCni Benefits of joining the UK Access Management Federation Benefits for Educational Sectors Provides consistency across the whole of education for federated (distributed) authentication and authorisation Improves the user experience Pools experience and expertise Provides economies of scale for all sectors Facilitates sharing of content and collaboration across sectors

14. LR Forum Mike Moran RSCni In March 2006, JISC formally announced its intention to support federated access management as the preferred access management solution for UK Further and Higher Education Institutions will have to Join the UK Federation to access JISC funded resources The Federation is a combined venture between JISC and BECTA (and therefore will extend to schools as well as colleges) JISC will continue funding the Athens service until 31 July 2008 Athens will be available via a subscription model post July 2008 Recent announcement by JISC means that Athens is no longer the partner organisation for Federation IdP functions – other options can be considered by colleges A full support service will be made available to the JISC community to support the transition to the new service The JISC Position on the UK Federation

15. LR Forum Mike Moran RSCni

16. Institutional Options BECOME A FULL MEMBER OF THE FEDERATION USING COMMUNITY SUPPORTED TOOLS COSTS: Institutional effort to implement software, join federation and enhance institutional directories BENEFITS: Full institutional control, skilled staff and access management solution for internal, external and collaborative resources BECOME A FULL MEMBER OF THE FEDERATION USING TOOLS WITH PAID-FOR SUPPORT COSTS: Cost of support from supplier and institutional effort in liaison with supplier and Federation BENEFITS: Full support in implementation and access management solution for internal, external and collaborative resources SUBSCRIBE TO AN ‘OUTSOURCED IDENTITY PROVIDER’ TO WORK THROUGH THE FEDERATION ON YOUR BEHALF COSTS: Subscription costs to external supplier (from July 2008) and internal administration role BENEFITS: Minimum institutional effort to achieve access to external resources only 07/08/09 | slide LR Forum

17. LR Forum Mike Moran RSCni 11. How can I join the UK federation as an Identity Provider? A potential Identity Provider (ie College) will need to carry out the following activities: Review the information structure within its institutional directory and ensure that it meets the required standards for exchanging information. Adopt a Single Sign-On or Common ID Solution for authentication. Implement Identity Provider software. Join the Federation (see the Federation website ). Roll-out the service within the institution. Help will be available for colleges – see below JISC Answers to some FAQs

18. LR Forum Mike Moran RSCni 18. What is the last point at which my institution can make a decision about joining the UK federation? If you are currently using Athens, you can join the UK Access Management Federation at any time from November 2006 onwards. There is no end date for the Athens service – but see below (Q19). 19. What will happen to Athens? Athens will continue as a fee-charging service. JISC is providing extensive support mechanisms for institutions wishing to adopt federated access management solutions. JISC will not be funding the Athens service beyond July 2008. JISC Answers to some FAQs

19. LR Forum Mike Moran RSCni So – what are the next steps for a college? Joining the UK federation as an Identity Provider? A potential Identity Provider (ie College) will need to carry out the following activities: Review the information structure within its institutional directory and ensure that it meets the required standards for exchanging information. Adopt a Single Sign-On or Common ID Solution for authentication. Implement Identity Provider software. Join the Federation [ NO COST ] (see the Federation website ). Roll-out the service within the institution. Apply for the support funding (if you haven’t already) Talk to managers and colleagues and ensure that your college sends someone to the Netskills workshop

20. LR Forum Mike Moran RSCni Does all of this have anything to do with re-structuring or selecting a Library Management System? Not directly – but there would be an advantage to sorting everything out at one time. Otherwise ,the directory structures created for the UK Federation may have to be re-visited when any new or re-configured LMS is installed.