This presentation was provided by Tim LLoyd of LibLynx during the NISO Live Connections event, Digital Libraries: Authentication, Access and Security of Information Resources, held on May 22-23, 2018 in Baltimore, MD.

1. @liblynxconnect Tim Lloyd <tim@liblynx.com>
Web proxy vs Federated SSO:
A practical guide to the pros & cons
Tim Lloyd, CEO LibLynx
22 May 2018
Digital Libraries: Authentication, Access & Security for Information Resources

2. About LibLynx
1
We’re passionate about empowering
access to online resources
2
We want to make access as simple as
possible and as secure as necessary
3
Serve Libraries and other information &
knowledge managers
Serve Publishers and other online product
& service providers
4
Cloud-native solutions engineered for
integration, automation, and customization

3. @liblynxconnect Tim Lloyd <tim@liblynx.com>
Five areas of concern
Patron Privacy
User Experience
Security
Cost / Efficiency
Reporting
Two lenses
Proxy access
Single Sign On (SSO)

4. On patron privacy
“We don’t want publishers to track
patron identities or what they are
reading”

5. Privacy
Proxy
Publisher never receives personal data
(PD)
HOWEVER, patrons forced to register for
personalization risk exposing PD
Shibboleth has good privacy controls to
limit the release of PD
Scalable Consent will provide tools &
policies to empower institutional and
individual choice
Other SAML systems can be configured
for privacy e.g. Active Directory
SSO

6. https://spaces.internet2.edu/display/ScalableConsent

7. On user experience
“My colleague can’t access
https://example.com.proxy.college.edu”
or
“Life, uh, finds a way”

8. User Experience
Proxy
Patrons have to access via institutional
links, supported by significant community
effort
Poor experience outside proxied links
Proxy configs can fail
Patrons can access at point of discovery
Poor experience to select institutional
affiliation (RA21)
SSO

9. On security
“Someone at IP 1.2.3.4 violated the terms
of service 3 days ago between 2 and 4pm
- please block their access”

10. Security
Proxy
Access can be secured by credentials
Human error can be a significant factor
Blocked IPs are blunt tools that impact
good and bad users alike
Tracing unauthorized activity can be time
consuming and usually requires
collaboration between librarian & publisher
Soft target for fraudulent access
Federated trust fabric provides strong set
of security tools & policies
Unauthorized activity quicker to spot and
block by publisher - more like a scalpel
than a hammer
SSO

11. On cost and efficiency
“Does anyone have an up to date stanza
for XYZ Journal?”

12. Cost and efficiency
Proxy
Inherently unstable approach as it has to
respond to changes in website design
Requires regular, ongoing maintenance as
resources change and proxy
configurations need updating
Stable technology
Low ongoing maintenance required
SSO

13. On reporting
“Which group of patrons accesses this
resource the most?”

14. Reporting
Proxy
Access tracked through proxy
Granular user level reporting available to
library if proxy requires login
Publisher can’t distinguish users
Access tracked via SSO architecture
Granular user level reporting available to
library AND publisher depending on
institutional policies
SSO