Electronic Resource URLs - Authentication
Hi all, Running Koha 3.20.02 on Ubuntu 14.04 LTS with Apache 2.4.7. I had a question about the authentication of electronic resource links in Koha. I'd like to explore a method of managing access to links to e-resources (856 fields) that would (1) prevent an anonymous user from navigating to the full-text of an e-resource via the 856 link; and (2) to show an 856 link to the full-text of an e-resource to authenticated users. I am thinking here of how universities and colleges manage their e-resources (i.e., allow registered students access to e-content but denying unauthorized access from unofficial users). The problem is that I've never talked with anyone who could explain how this is done generally. I'm sure it varies across institutions. So, can Koha (presumably with server-side software) do this, and how can it be done? Is this what CAS or SIP2 is for? Hope this is clear. Happy to provide more info. This is not my area, but I'd like to explore further. Feel free to point me to info resources on this too. Many thanks! Craig Butosi, MA, MLIS, B Mus (Hons.) LIBRARY SERVICES MANAGER the royal conservatory TELUS Centre for Performance and Learning 273 Bloor Street West Toronto, ON M5S 1W2 416.408.2824 x338 www.rcmusic.ca<http://www.rcmusic.ca/> Note: This email message and any attachments are intended only for the use of the individual to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the recipient of this email is not the intended recipient (or the employee or agent responsible for delivering the email to the intended recipient), you are hereby notified that any review, dissemination, distribution or copying or other use of this message is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return email and delete this message and attachments from your system, thank you.
We've been considering various options. For us it's a matter of some material kept on an in house server that should be local access only. We're looking at controlling access via the user's IP address, or requiring a login. So we are quite interested in how others have approached this. On Tue, Aug 18, 2015 at 5:05 PM, Craig Butosi <craig.butosi@rcmusic.ca> wrote:
Hi all,
Running Koha 3.20.02 on Ubuntu 14.04 LTS with Apache 2.4.7.
I had a question about the authentication of electronic resource links in Koha. I'd like to explore a method of managing access to links to e-resources (856 fields) that would (1) prevent an anonymous user from navigating to the full-text of an e-resource via the 856 link; and (2) to show an 856 link to the full-text of an e-resource to authenticated users. I am thinking here of how universities and colleges manage their e-resources (i.e., allow registered students access to e-content but denying unauthorized access from unofficial users). The problem is that I've never talked with anyone who could explain how this is done generally. I'm sure it varies across institutions.
So, can Koha (presumably with server-side software) do this, and how can it be done? Is this what CAS or SIP2 is for?
Hope this is clear. Happy to provide more info. This is not my area, but I'd like to explore further. Feel free to point me to info resources on this too.
Many thanks!
Craig Butosi, MA, MLIS, B Mus (Hons.) LIBRARY SERVICES MANAGER the royal conservatory TELUS Centre for Performance and Learning 273 Bloor Street West Toronto, ON M5S 1W2 416.408.2824 x338 www.rcmusic.ca<http://www.rcmusic.ca/>
Note: This email message and any attachments are intended only for the use of the individual to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the recipient of this email is not the intended recipient (or the employee or agent responsible for delivering the email to the intended recipient), you are hereby notified that any review, dissemination, distribution or copying or other use of this message is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return email and delete this message and attachments from your system, thank you. _______________________________________________ Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz https://lists.katipo.co.nz/mailman/listinfo/koha
-- Elaine Bradtke Data Wrangler VWML English Folk Dance and Song Society | http://www.efdss.org Cecil Sharp House, 2 Regent's Park Road, London NW1 7AY Tel +44 (0) 20 7485 2206 (This number is for the English Folk Dance and Song Society in London, England. If you wish to phone me personally, send an e-mail first. I work off site) -------------------------------------------------------------------------- Registered Company No. 297142 Charity Registered in England and Wales No. 305999 --------------------------------------------------------------------------- "Writing about music is like dancing about architecture" --Elvis Costello (Musician magazine No. 60 (October 1983), p. 52)
Hi, On Tue, Aug 18, 2015 at 11:28 PM, Elaine Bradtke <eb@efdss.org> wrote:
We've been considering various options. For us it's a matter of some material kept on an in house server that should be local access only. We're looking at controlling access via the user's IP address, or requiring a login. So we are quite interested in how others have approached this.
Recently I setup something similar for a client. It required me to write an external squid authentication helper that read the user creds and perms (patron category, expiry, debarment etc) off the borrowers table. I added a couple of extra fields to support the proxy auth functions, and a separate table to log login/sessions. A custom .kpz plugin helped helped to manage the users and generate reports as required. Served over SSL, it seems to be able to serve their purpose. cheers -indranil
On Tue, Aug 18, 2015 at 5:05 PM, Craig Butosi <craig.butosi@rcmusic.ca> wrote:
Hi all,
Running Koha 3.20.02 on Ubuntu 14.04 LTS with Apache 2.4.7.
I had a question about the authentication of electronic resource links in Koha. I'd like to explore a method of managing access to links to e-resources (856 fields) that would (1) prevent an anonymous user from navigating to the full-text of an e-resource via the 856 link; and (2) to show an 856 link to the full-text of an e-resource to authenticated users. I am thinking here of how universities and colleges manage their e-resources (i.e., allow registered students access to e-content but denying unauthorized access from unofficial users). The problem is that I've never talked with anyone who could explain how this is done generally. I'm sure it varies across institutions.
So, can Koha (presumably with server-side software) do this, and how can it be done? Is this what CAS or SIP2 is for?
Hope this is clear. Happy to provide more info. This is not my area, but I'd like to explore further. Feel free to point me to info resources on this too.
Many thanks!
Craig Butosi, MA, MLIS, B Mus (Hons.) LIBRARY SERVICES MANAGER the royal conservatory TELUS Centre for Performance and Learning 273 Bloor Street West Toronto, ON M5S 1W2 416.408.2824 x338 www.rcmusic.ca<http://www.rcmusic.ca/>
Note: This email message and any attachments are intended only for the use of the individual to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the recipient of this email is not the intended recipient (or the employee or agent responsible for delivering the email to the intended recipient), you are hereby notified that any review, dissemination, distribution or copying or other use of this message is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return email and delete this message and attachments from your system, thank you. _______________________________________________ Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz https://lists.katipo.co.nz/mailman/listinfo/koha
-- Elaine Bradtke Data Wrangler VWML English Folk Dance and Song Society | http://www.efdss.org Cecil Sharp House, 2 Regent's Park Road, London NW1 7AY Tel +44 (0) 20 7485 2206 (This number is for the English Folk Dance and Song Society in London, England. If you wish to phone me personally, send an e-mail first. I work off site) -------------------------------------------------------------------------- Registered Company No. 297142 Charity Registered in England and Wales No. 305999 --------------------------------------------------------------------------- "Writing about music is like dancing about architecture" --Elvis Costello (Musician magazine No. 60 (October 1983), p. 52) _______________________________________________ Koha mailing list http://koha-community.org Koha@lists.katipo.co.nz https://lists.katipo.co.nz/mailman/listinfo/koha
-- Indranil Das Gupta Phone : +91-98300-20971 Blog : http://indradg.randomink.org/blog IRC : indradg on irc://irc.freenode.net Twitter : indradg -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=- Please exchange editable Office documents only in ODF Format. No other format is acceptable. Support Open Standards. For a free editor supporting ODF, please visit LibreOffice - http://www.documentfoundation.org
Craig Butosi schreef op di 18-08-2015 om 16:05 [+0000]:
I'd like to explore a method of managing access to links to e-resources (856 fields) that would (1) prevent an anonymous user from navigating to the full-text of an e-resource via the 856 link; and (2) to show an 856 link to the full-text of an e-resource to authenticated users.
Just be aware that hiding a URL from someone is not a viable method of securing content. URLs are not intended to be secret and treating them like they are is a bad idea. Instead, you'll want a layer of authentication protecting the actual resource behind that URL. -- Robin Sheat Catalyst IT Ltd. ✆ +64 4 803 2204 GPG: 5FA7 4B49 1E4D CAA4 4C38 8505 77F5 B724 F871 3BDF
Hi Robin, Yes, I realize this concern. I've come to understand that a Koha-SIP2-EZProxy arrangement is a possibility for e-resource authentication. Now I just have to figure out how this works. I knew that SIP2 had something to do with what I was looking for. Time for some technical reading! Best to all, Craig Butosi, MA, MLIS, B Mus (Hons.) LIBRARY SERVICES MANAGER THE ROYAL CONSERVATORY TELUS Centre for Performance and Learning 273 Bloor Street West Toronto, ON M5S 1W2 416.408.2824 x338 www.rcmusic.ca -----Original Message----- From: Koha [mailto:koha-bounces@lists.katipo.co.nz] On Behalf Of Robin Sheat Sent: August-18-15 6:51 PM To: koha@lists.katipo.co.nz Subject: Re: [Koha] Electronic Resource URLs - Authentication Craig Butosi schreef op di 18-08-2015 om 16:05 [+0000]:
I'd like to explore a method of managing access to links to e-resources (856 fields) that would (1) prevent an anonymous user from navigating to the full-text of an e-resource via the 856 link; and (2) to show an 856 link to the full-text of an e-resource to authenticated users.
Just be aware that hiding a URL from someone is not a viable method of securing content. URLs are not intended to be secret and treating them like they are is a bad idea. Instead, you'll want a layer of authentication protecting the actual resource behind that URL. -- Robin Sheat Catalyst IT Ltd. ✆ +64 4 803 2204 GPG: 5FA7 4B49 1E4D CAA4 4C38 8505 77F5 B724 F871 3BDF Note: This email message and any attachments are intended only for the use of the individual to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the recipient of this email is not the intended recipient (or the employee or agent responsible for delivering the email to the intended recipient), you are hereby notified that any review, dissemination, distribution or copying or other use of this message is strictly prohibited. If you have received this communication in error, please notify the sender immediately by return email and delete this message and attachments from your system, thank you.
participants (4)
-
Craig Butosi -
Elaine Bradtke -
Indranil Das Gupta -
Robin Sheat