[WEB4LIB] Help needed: username/password authentication

[gagnew at rci.rutgers.edu]

Kerry,

Internet2 is a sponsor of Shibboleth, an authorization and authentication
open standards protocol with attendant implementations to address issues
such as this, not just for individual institutions but across institutions
for consortial and collaborative activities needing standardized
authentication and access.  Currently, Shibboleth requires LDAP
(lightweight directory access protocol), although there are plans to extend
it to other database architectures.  The National Science Digital Library
is using Shibboleth for authentication and authorization to resources
available via the NSDL portal that are restricted to certain audiences. 
The Library of Congress and Association of Moving Image Archives-sponsored
moving image portal (MIC), an NSDL project will also be using Shibboleth to
authenticate and authorize participants to make changes to their data and
settings.

All this to say, it's a new standard but the implementations are
increasingly robust.  I believe Internet2 is currently working with some
libraries to implement Shibboleth for access to commercial databases and
journals.  

Ken Klingenstein at the University of Colorado is one of the chief
architects of Shibboleth and I believe is working on the commercial
database/journal implementation.  You might contact him for further
information.  My understanding is that it is still new enough that it takes
a month or two of cursing and sweating to implement, but mature enough that
its no longer  six months of hair tearing and heavy drinking. :-)

Ken's email:  Ken.Klingenstein at Colorado.EDU 

Grace Agnew

Original Message:
-----------------
From: K. W. kw61820 at yahoo.com
Date: Fri, 31 Jan 2003 12:03:38 -0800 (PST)
To: web4lib at webjunction.org
Subject: [WEB4LIB] Help needed: username/password authentication


Dear Colleagues,

Those of you who subscribe to both listservs please
forgive the cross-posting! I need your help for a
problem I am having as follows:

Our library subscribes to a wide range of databases
and ejournals that are made available via our proxy
server. However, there are certain databases and
ejournals that can not be put into the proxy server,
either due to vendor restrictions, or because it's
provided by the business school and is available to
only a few (Master or PHD) students. All these
resources have one thing in common: they all have
their own username and password. As the number grows,
it becomes very difficult to manage all these
usernames and passwords. Someone suggested that we
design an unified interface where people can just log
in and get authenticated once, and then can use these
exclusive sources without logging in each one with
various username and password. Somehow I figure it
would mean integrating the authentication on the
vendor's side and on our side. They also mentioned
something like LDAP. 

I have no idea how to begin this and I don't know of
any kind of precedence in our library system. Could
you give me some suggestions as to how to approach
this, and what tools are available? If you have done
this before, would you mind sharing your experience?

Thank you very much in advance!

Kerry Wu
Digital and Data Services Librarian
Commerce Library (http://door.library.uiuc.edu/crx) 
University of Illinois at Urbana-Champaign
Tel: 217-333-0169
Email: qiwu at uiuc.edu

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com



--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web.com/ .