How To Authenticate With Ezproxy On A University Campus (For A Non Profit)

Transcription

1 EZproxy Hosted Frequently Asked Questions Q: What firewall ports would have to be opened to accommodate hosted EZproxy? A: It mostly depends on how you plan to authenticate. For example if you want to authenticate to something like LDAP, you would need to open access for the server to access it. You access your Hosted Server at port 80 or 443. Q: How will authentication work? Would an EZproxy request ping off of our AD server for authentication, or would we have to supply a file of usernames/passwords? A: EZproxy Hosted can authenticate against Active Directory provided that we can access the Active Directory Server through any firewalls and provided that you can provide us with an encrypted (SSL or HTTPS) connection to the Active Directory server. Q: Is it possible to use a Group set-up to create three groups authenticating against three different existing systems (for instance, Active Directory, or whichever system is authenticated against on each campus), and have a single configuration file in which databases are assigned to one or more Groups? If the entries in the config file are at the individual database level, does this allow EZproxy to vary access between two databases provided by the same vendor? A: Yes, this is usually possible. We will need to know some more details to answer in more detail. It's important to note that the entries in the configuration file (including group authentication control) are granular more to the web site level, not as much to the particular journal/article (i.e., single journal in a web site of many journals) level. There are some ways to partially mitigate this but its useful to think of the granularity this way. Q: Currently our EZproxy is set up to work with our campus system (LDAP protocol, I believe). The goal is for each student to have a single logon for all campus services. Of course, we change our passwords periodically, not all at the same time. So.would this work with EZproxy being hosted? If not, can you paint a picture for me of the hosted situation works? A: If they are using LDAP as an authentication source, then we can interoperate with as long as we can access it through the campus firewall and we can access it via HTTPS. If we can access LDAP in this way, there will be no problem with users changing passwords at any time. Since we access LDAP in real-time in this scenario as soon as a password is changed it is active in the EZproxy hosting environment. Q: Will EZproxy accept IP addresses for authentication purposes from NON-SCO COLLEGES? A: Yes

2 Q: Can we also authenticate from the fixed IP s? A: You can authenticate from fixed IPs in other words, allow access based on IP address. Q: Is there an estimated cost if, after a few years, we decide to move all authentication to referring URL? A: To change to referring URL should not incur an extra cost unless we spend many hours configuring it which I don t believe will be the case. Many hours is defined as more then 10. Q: We are about to have an institutional domain name change. How would your service handle this? A: In most cases, since databases are authenticated by IP address, there should be no change (assuming your IP addresses stay the same). In the few cases where referring URLs are used for authentication, we can make those changes for you. The EZproxy Hosting server is on OCLC s domain: <inst name>.idm.oclc.org. Q: I know the hosted EZproxy supports CAS (Central Authentication Services) system. Do we need to make any change (e.g. open the firewall) at the CAS site if we move to hosted EZproxy? A: Yes, the CAS server would need to be available to the EZproxy Hosting server that is in OCLC s network. Q: How can WorldCat Local Metasearch get authenticated if we change to hosted EZproxy? A: We can authenticate via EZproxy which would use CAS. Q: Would we be assigned a permanent unique IP address we could share with our online vendors? A: Yes Q: How quickly could this remote service be implemented? A: We give you a commitment date after we meet to discuss and you have filled out your questionnaire. Q: What interface would I use to connect to hosted EZproxy to modify the config.txt and user.txt files? A: You do not have any direct access to the configuration. We do that for you. For expert users, we are planning a fast deploy method for admins to submit changes. Currently you request changes via to hostedezp@oclc.org.

3 Q: Would I be allowed to upload via FTP or another program a user.txt file every day? Could this upload be scheduled and automated? A: Yes, this is possible. The first version of this is a web upload (i.e., you login and upload your file). Then we move it into the production configuration. This facility is still in development but we anticipate having it working in a few weeks. It should be a matter of minutes from upload to deployment in the production environment. Q: Lastly, we would be able to set up a test of hosted EZproxy first to confirm that it will work in our environment before committing to purchase it? A: We prefer to do something like a 60 day acceptance period. Where we define success criteria up front. We can discuss this on the phone if you like Q: How long does it take to configure? A: Depends on the size of your database. Our EZproxy database is vast and updated regularly, so most of your databases should be compatible to ours. Just to make sure, we set up a time for a conference call with you to discuss configuration details and startup date. Q: How are configuration files updated by customers (institutions) in the hosted service? A: We currently maintain a set of files using SVN to capture all of the configuration settings, and we use SVN's updating process to keep our application servers current. We weren't sure whether this type of setup would be supported in the hosting service, or whether there were any file-uploading capabilities. We also will be using SVN internally for this purpose. We will not have, to start, any config file uploading facilities for the institutions to use. You can send us entire files and if you desire, we can send you a copy of the entire environment (from a config-perspective) we have to help you know what is running in your configuration. Q: Will there be any way to support automated-script-updated configuration files? A: We currently run a script on a daily basis to generate a configuration file for our e-journal/e-book resources based on our hosted knowledge-base data, and we will need to have a way to continue the automated process with a hosted proxy service. (Our knowledge-base data is coming from Serials Solutions.) We would be fine with running the script locally and uploading the resultant file to the hosted proxy service servers, providing there is away to automate that process. This may be possible. We will need to discuss this in some more detail. We do have the facility to

4 upload periodic user/password files. Q: Will we be able to preserve our current proxy-server hostname? Or does subscribing to the service also involve a new OCLC-based hostname? A: There is a new DNS name for the proxy server. Q: How does this work? Will we still be able to configure the file ourselves? A: No, the model is that OCLC configuration staff maintains the configuration file for you. You will send OCLC requests for modification of the configuration. You can either send us an entire config file or the text to put into it. Q: Is there going to be a web admin? A: You will have, upon request access to the /admin interface of your EZproxy instance. Q: Will we upload config files? A: At the start of the service, no. We will be investigating ways to allow experienced admins more streamlined ways to update their config. Q: I noticed in the terms & conditions that there is not a bandwidth allocation. Can you give me an idea of what would be considered excessive? A: The network bandwidth management is managed across our server environments. We don t anticipate bandwidth problems from normal usage. Excessive is when an institution s consumption effects other institutions. Q: What is the cost of configuration time (per hour) beyond the 10 hours provided at start-up? How is this fee assessed and charged? A: The 10 hours of configuration time is for initial configuration not for ongoing requests. Ongoing requests for changes are done without charge unless they will take an excessive amount of time where excessive amount is more than 10 hours. For example, adding a user to a user.txt file (takes a few minutes) is not charged, but a request to add 100 more resources to the configuration file may be charged. We will not charge you without discussing with you beforehand. One way this can be avoided is if you help us research for complex config problems. For example, if a config is not on our supported list but you know what is you can send it to us and we can use it.

5 Q: How do we have new e-resources added to our configuration? What else would local administrators still have to do? A: You request us to do that. Local administrators do not have modified access to the hosted EZproxy system. You can, upon access, have admin access which allows you to view logs. Q: How does problem reporting work - would patrons be able to report problems directly to OCLC, or would they report those to local administrators and then we'd troubleshoot and/or forward them to OCLC? A: We prefer patrons continue to contact local contacts and then the local contacts (administrators) report to OCLC. If you can initially troubleshoot that can be very helpful since sometimes there are local institution nuances to these types of problems. Q: Please provide a list of contracted or testing sites we could contact for references. A: Upon request, we can provide you with some contacts. Q: If that won't work, what are our most efficient/easily supported local installation options given our consortium set-up? i.e., If we can't run one instance using Group configurations, can we run three instances on one server at one campus, or would we have to continue maintaining three instances (one on each campus)? A: I believe you will be able to get 1 server for the three institutions to work. However, for some reason you can't you run 3 copies on one server or three separate instances. It's probably best to run using virtual machines, in other words, run 3 virtual servers on one physical server. Q: Let's say we start with the hosted service, and then we decide to host it locally. Would we be able to get a discount on the software, and how much reconfiguration would we have to do for "linking." Would we have to rewrite all of our links? A: If you were to decide to move from hosting to local deployment, we would give you all the configuration files from the hosting server necessary to configure and run your server. The DNS name of your locally deployed proxy server will be different then the hosted one so you would have to make a pass through your links and substitute the new local name for the previously used, hosted name. Q: Currently our EZproxy is set up to work with our campus system (LDAP protocol, I believe). The goal is for each student to have a single logon for all campus services. Of course, we change our passwords periodically, not all at the same time. So.would this work with EZproxy being hosted? If not, can you paint a picture for me of the hosted situation works?

6 A: If they are using LDAP as an authentication source, then we can interoperate with as long as we can access it through the campus firewall and we can access it via HTTPS. If we can access LDAP in this way, there will be no problem with users changing passwords at any time. Since we access LDAP in real-time in this scenario as soon as a password is changed it is active in the EZproxy hosting environment. Q: Will EZproxy hosted run on server 2008 R2? A: Yes, EZproxy will run on Windows 2008 R2. Q: What is excessive bandwidth? Is there a number? Also, are there breakpoints on the number of users? And is the number of users based on individuals or number of simultaneous users? A: Regarding excessive we don t have a number. We monitor in order to protect delivery of services across all of our network services and users. We will take reasonable measures to protect our services and users against service outages which can be caused by a large variety and constantly changing set of events. Q: Will EZproxy accept IP addresses for authentication purposes from NON-SCO COLLEGES? A: Yes. Q: Can you RESTRICT the access of users coming from these external IP addresses to Millennium only (so that they do not have access to other databases available exclusively to SCO patrons, such as, etc.)? A: Yes. Q: We are about to have an institutional domain name change. How would your service handle this? A: In most cases, since databases are authenticated by IP address, there should be no change (assuming your IP addresses stay the same). In the few cases where referring URLs are used for authentication, we can make those changes for you. The EZproxy Hosting server is on OCLC s domain: <inst name>.idm.oclc.org. Q: Would it cost extra to reconfigure the resources to the new domain name? A: No. Q: When we add or remove databases, is the process of configuration done on your end?

7 A: Yes Q: What is the time frame for changes we might require? A: Our goal is 24-hour turnaround. It does depend on the quantity and complexity of the changes. Q: We have a complex system in place (WAM proxy) with many database records. We need to know if the two systems can be run simultaneously as we change our records to the new proxy URL. We would want to experience as little downtime to our database searching as possible. A: Regarding WAM, you can run them in parallel as you set up the new server. You would register an additional IP address for the new EZproxy Hosting server with your vendors and then cutover when the configuration is done and you are ready. There may be some vendors that require referring URLs that can t be run in parallel. Q: With regard to the SSL certificate that you provide with this service. I assume that the certificate you supply does not reside on our server but on one at OCLC, is that correct? Our server requires an SSL certificate, so I am assuming we still need to provide our own as well correct? A: We supply the SSL certificate for the EZproxy Hosting server. Any other certificates will be supplied by you. Q: As you know, we are using WMS, WorldCat Local, and Worldcat Link Manager. Our patrons will use single login to access their library account and library resources. Will EZproxy patron records come from WMS? Currently WMS has our Pepperdine user names. But it doesn t have our passwords. Will we use CAS or WMS system to authenticate us? Do you know the timeline for the single login? A: EZproxy supports authenticating straight to CAS EZproxy only needs to authenticate it doesn t need any patron information. We can test the configuration but once WMS authenticates to CAS also, there should be single sign-on. Q: Can DNS names be changed at any time? A: Yes. Q: Can we receive usage logs for their institution? And what tools exist to process them? A: Yes, if you want us to supply your logs we can do that. We currently provide reporting or digesting of the logs into a reporting format. There are some s about such programs on the EZproxy Listserv if you are interested in investigating.