Authentication Scripts, Tricks and Traps

[spober at manhattan.edu]

> From: "Karen G. Schneider" <kgs at bluehighways.com>
> Subject: Authentication Scripts, Tricks and Traps
> Hi, for my next column in American Libraries, I am doing an overview of
> current authentication technologies.  Part of me wishes I had a Real Audio
> of the LITA IG on this topic held at ALA Annual I could turn over to my
> editor with the comment, "they post for me" (with additional voice-over by
> Tim Kambitsch), but failing that...
>
> 1) I would like to hear from libraries that have developed (and by
> inference also rejected) solutions for allowing patrons to log in to
> subscription databases and other "premium" or limited-access resources, or
> for authenticating patrons per se for using Internet workstations

Our library has been working with beta versions of Ezproxy from Useful
Utilities (http://www.usefulutilities.com) for the last few months. 
Most of our early testing was done using pages not accessible to the
public, just to be sure everything worked well before we went public
with it. We now have the off-campus access integrated into our catalog
and database page: http://www.manhattan.edu/library/palsgate.html

I am extremely pleased.  EZproxy was easy to set up and use, and the
developer has been very helpful and responsive to suggestions.  One
feature we particularly like is that we don't need to have separate
links to the restricted databases for on-campus and off-campus users. 
All users can get to the databases from the same page and links.  And
the users don't need to do any proxy server setup in their browsers.

> 2) I'd like to hear some of the constraints libraries considered when they
> developed this access--e.g. were they concerned about lower-end browsers,
> visually-challenged users, etc., and how did this affect their decisions

Ease of use was very important.  Some of our patrons have had problems
with installing the Adobe Acrobat reader needed for image delivery from
ProQuest, so I was happy to find a solution that didn't require users to
fiddle with the proxy server settings in their browsers.  Aside from the
initial login screen that off-campus users encounter the first time they
try to access a restricted database during a session, the server is
transparent to users.  

I've tested the proxy server from version 3 and 4 browsers without
problems. I try to make all of our pages fairly low on graphics (and use
ALT tags for images) with the idea that this will make things easier for
users who either have graphics turned off or are using screen-reading
software.  I have to admit I haven't actually tried to use our pages
with a screen-reader, though.  We have a page that gives information on
how to turn on Javascript  and cookies in Netscape, and we are
recommending that users with older browsers upgrade to a more current
version.

> 3)  I'd like to hear from libraries using canned commercial solutions such
> as Obvia, and also from libraries that have authentication routines tied in
> to the IOLS patron database

Our current authentication uses patron barcodes for authentication.  We
were considering using barcode plus patron last name, but I'm not sure
the extra element provides any substantial advantage. 

> 5) Painful war stories, lessons-learned, and heart-warming anecdotes are
> always welcome

Thankfully, we have no painful war stories yet!  The user feedback has
been uniformly positive so far.  EZproxy uses cookies, and the only
problem so far was a user who was using the AOL browser, which as far as
I could tell, did not permit users to change the cookie preferences.  We
also have told users on our pages that they need to have Javascript
turned on, but this is a requirement for ProQuest rather than for the
proxy server.

///\\\///\\\///\\\///\\\///\\\///\\\///\\\///\\\///\\\///\\\///\\\///\\\
Stacy Pober, Information Alchemist      spober at manhattan.edu
Manhattan College Libraries             http://www.manhattan.edu/library