ill forms summary

[Helen Laurence]

I received a request to summarize responses for the list, so here
goes:

My question was how others are handling the issue of userid
validation for electronic ILL requests.  The discussion strayed from
that specific question to the larger issue of whether ILL depts. do
in fact or should in fact validate userids on electronic ILL requests.

From: wroldfie at library.uwaterloo.ca (William Oldfield)

The security offered by the .htaccess file stops the world from using our
ILL service.

If a person comes into the Library and uses our Electronic form (which we
prefer) or fills out a paper ILL request, they must be valid users or our
ILL departemnt does not fill the order.  I am sure that any ILL department
checks to see if a borrower is a valid user before working on the order and
the electronic submission method is no different.

I believe our ILL Department checks the email address, does a finger on the
student or checks our patron database to verify the borrower information.

>On Tue, 13 Feb 1996, William Oldfield wrote:
>
>> Helen...
>>
>> At UW we simply restrict access to the form and the cgi script to computers
>> in the UW domain.  Using the .htaccess file for this purpose means that
>> only users within your institution can submit ILL requests.
>>
>> It sure beats setting up individual user authentication.
>
>If I'm interpreting this right this means that non-affiliated
>users from the community need only come into the library to order ILL
>materials - as long as they are using a machine with the UW domain.  Is
>this correct?  Do you feel that this is not much of a "problem" and that
>it's cheaper or more efficient in the long run than is setting up user
>authentication?
>
>Jerilyn Veldof
>University of Arizona Library
>

>On Tue, 13 Feb 1996, William Oldfield wrote:
>
>> If a person comes into the Library and uses our Electronic form (which we
>> prefer) or fills out a paper ILL request, they must be valid users or our
>> ILL departemnt does not fill the order.  I am sure that any ILL department
>> checks to see if a borrower is a valid user before working on the order and
>> the electronic submission method is no different.
>
>I wouldn't be so sure - I've worked in (unnamed) libraries where the ILL
>department didn't check every request for patron eligibility, because the
>technology made it so much of a hassle.


also, there are some libraries where the sheer volume of ILL is so much
that a solution requiring the manual checking of each form would be
impossible.  One where I've worked at used student ID numbers to automate
this procedure.  The ILL department existed primarily to work on the
validity of the bibliographic verification--not the patron.

I can see where the .h* restriction might work for a small place lookign
for a low-cost entry-level solution... but another point: it also means ILL
can't be done from remote sites (e.g. home)--right?  If I log in from
interactive.net (or... yay!  soon enough!  bluehighways.com), the machine
won't recognize me.

Karen, carefully not responding to the "let's not have a thread" thread,
believing threads die a natural death if you LET them...

------------------------------------------------------------------
Karen G. Schneider * kgs at intac.com * kgs at interactive.net *
http://www.intac.com/~kgs/
Cybrarian * Columnist, American Libraries, Internet Law Researcher
Author, The Internet Access Cookbook (e-mail Neal-Schuman at icm.com)
Abortion is legal and can be obtained throughout the U.S. via surgical
procedures, and where accessible, by use of the drug RU482. See your doctor
or local Planned Parenthood clinic. Please copy this information to your
sig file or WWW page.



 
Who has time to do this?  We recieve at least 100 requests a day and do 
not check to see if they're all "valid" users. We are too backlogged 
(with the addition of our online indexes and cancellations of journals 
and no increase in ILL budget for staff).  Of course, if 
they request a book loan they won't be able to check the item out of the 
Library - but as of now all a person has to do is check the "student" box 
and the request goes through.  This is somewhat acceptable in an offline 
environment when a patron has to come into the library and ask about ILL. 
We can then tell them about our policy and tell non-affiliated people to
go to the public library.
But in an electronic environment when they only need to sit down at the 
computer and find "Interlibrary Loan" as an option on our OPAC a patron can 
order away.  Because of this a requester must first enter their name and 
then their ID barcode number which is checked against the system.  

Jerilyn Veldof 
University of Arizona


From: Bill King <billking at mh1.lbl.gov>
We just crank out a simple text file from the database. Then the
Perl script looks for the employee ID. The file is just some 
basic fields from the employee database, name, ID, phone number, 
Mail Stop, etc.

The script just runs through the file line by line. Even with 5K+
lines, it's pretty fast. If the ID number isn't found then the
user can enter another number or find out why they aren't in the
database.

I made mine "interactive" so that I could check for valid data
in a number of fields.

Bill King                                  billking at mh1.lbl.gov
Energy & Environment/Building Technologies Program
Lawrence Berkeley National Laboratory
1 Cyclotron Road, Berkeley, CA 94720             (510) 486-4686
http://eande.lbl.gov/BTP/BTP.html                  MS - 90/3111
---------------------------------------------------------------

Hello Helen,

One partial solution is placing your ILL form in a directory accessable 
only to clients on your campus.  This would not take care of all the ID 
checking but would limit request to folks on your campus.  Ours is open 
to the world & ILL hasn't had many if any non-LSU requests.

David

P.S.  Also, this means clients using Internet providers to access the 
form would be excluded (must be on campus to access the form).
______________________________________________________________________

David P. Atkins
Electronic Reference Services Librarian   
Middleton Library                    email:  notdpa at unix1.sncc.lsu.edu
Louisiana State University                     voice:   (504) 388-6823 
Baton Rouge, LA 70803-3300                      fax:    (504) 388-6825 
______________________________________________________________________



> We have just linked our ILL request forms to our library home page.
> The only real issue for us was how to limit the service
> to patrons affiliated with the University.  Linking to the 
> circulation database of valid library card numbers was thought to be
> too problematic.  We finally decided to "require" that a valid ID
> number be submitted on the form and check it manually the same way
> ILL requests on paper are done.  This seems a rather "low-tech"
> solution considering the context. How are others dealing with this?


If you mean problematic technically, it shouldn't have to be.  A Unix command
'look' performs a binary search on a sorted file.  We use it to provide
access to restricted citation databases, using an extraction of the patron 
file in HOLLIS.  The extraction is likely the most difficult part of the 
process.  We just extract on the mainframe and FTP the data to our UNIX box-
a real-time lookup is *definately* problematic, and overkill, in my opinion.

Good luck, Joachim

-------------------------
Joachim Martin                  jmartin at harvard.edu
Systems Librarian               http://sirin.harvard.edu/~jmartin
Office for Information Systems	Harvard University Library
--------------------------

    


    

----- End forwarded message