Information Scotland

The Journal of the Chartered Institute of Library and Information Professionals in Scotland

February 2008 Volume 6(1)

Digital environment

Managing access

Further Education institutions are soon going to have to make important decisions with regards to the authentication systems they are using. Tony Donnelly and Paul Gorman explain why.

In July 2008 the JISC subsidy for the Athens authentication system currently in use in much of the UK education sector comes to an end. Athens is an Eduserv product that provides secure access to e-resources to those with an entitlement to use them by right of attendance on a course or membership of staff at a particular educational institution. E-resources that the institution subscribes to (usually library electronic subscriptions) are placed behind the Athens authentication system and users can access these resources either remotely or on campus by use of a single logon. There are two types of Athens systems commonly used:
1 Classic Athens. The user sets up their own account through self-registration upon receipt of an access username and password from staff (usually library staff).
2 Athens DA (Devolved Authentication). The organisation creates Athens accounts centrally and integrates with a local application such as a VLE or an organisation’s authentication system such as an LDAP.

In light of the forthcoming cessation of the JISC subsidy, institutions are going to have to make important decisions with regards to the authentication systems they are using. The JISC is promoting Shibboleth technology. Shibboleth is an architecture that enables organisations to build single sign-on environments that allow users to access web-based resources using a single login. The JISC summarises the main benefits as:

Users will have a single sign-on using an institutional ID and password for a range of resources, as well as the assurance that their personal data will not be disclosed to third parties.
Librarians will be free of the burden of user name and password administration, and will have new tools for managing licenses and service subscriptions.
IT managers will have more control of the access management process through enhancements to enterprise directories, although this will require additional institutional effort in the short term.
Institutions will have a single service to meet the requirements of e-learning, e-research and library-managed resources. Simplification of the authentication process has also proven to lead to increased use of subscribed services.

Organisations that use Shibboleth to access resources must join or create a federation: a group of institutions and organisations that sign up to an agreed set of policies for exchanging information about users and resources to enable access of resources and services. The federation combined with identity management software within institutions is referred to as federated access management (FAM). In the UK it is called the UK Access Management for Education and Research.

It is imperative that institutions decide soon how to respond to these developments. As librarians tend to be responsible for the institutional management of Athens, we are well placed to ensure that key decision makers within our respective institutions are appraised of the situation. The crucial point here is that this is not a library-specific issue. The move towards Shibboleth affects the institution as a whole. It manages access to all institutional resources such as networks, virtual learning environments, email, and e-resources. As such, network managers, IT managers, e-learning technologists and librarians are all clearly affected. It may not be obvious to key decision makers and stakeholders within institutions. Indeed, there is a possibility that as soon as key decision makers hear that the Athens subsidy is ending, they may imagine that they are dealing with a library-specific issue as librarians manage Athens. Therefore, it is vital that librarians ensure that these decision makers are fully aware of the impact these developments will have.

What are the options, then, for institutions once the JISC subsidy for Athens ends? Options (not exhaustive) include:

Retaining Athens post-2008. A fee would be payable as the JISC subsidy will no longer be in operation. Authenticated access to resources is by username and password. Accounts are created through self-registration. This allows access to Athens authenticated resources.

Gateway options. A gateway will allow access to federated materials by organisations who have not yet adopted FAM technology. This gateway is a interim measure to ensure that there is no loss of service during the adoption of FAM. Crucially, the JISC and Eduserv have not managed to come to an agreement for an extension beyond July 2008 to the Federation Gateway Services contract which would be required in order for Athens to work using the UK Access Management Federation’s open standards. Therefore, JISC can no longer guarantee the compliance of Athens products within the UK Access Management Federation. JISC is still in discussions with service providers in a bid to provide a gateway service.

Adopt Shibboleth. Those adopting Shibboleth must become direct members of the UK Access Management Federation and comply with Federation policy. Membership requires participating institutions to implement a range of technical activities, utilisation of an appropriate directory infrastructure and centrally created individual network accounts for all users to satisfy the authentication process. Clearly, there is a requirement for development and commitment by Network teams.

Each institution must determine its own response, we but must also recognise the importance of raising awareness of this issue. It is of the utmost importance that librarians, network managers and senior management work together in addressing the issue of FAM.

Tony Donnelly e: tony.donnelly @glasgowmet.ac.uk is Chief Librarian and Paul Gorman e: paul.gorman@glasgowmet.ac.uk is Librarian at Glasgow Metropolitan College.

Information

JISC Access Management

Information Scotland Vol. 6(1) February 2008

Information Scotland is delivered online by the SAPIENS electronic publishing service based at the Centre for Digital Library Research. SLAINTE (Scottish libraries across the Internet) offers further information about librarianship and information management in Scotland.

Last updated: 16-Jul-2008