SSO plus External script authentication

Hi,

We're looking into making our ILLiad work with Single Sign On, which I understand can only be done through EZProxy. (We are a hosted EZProxy site and a hosted ILLiad site, if that makes any difference.) In our first glance at whether this is possible, it seems like doing SSO with SAML for ILLiad is no problem – we do SSO/SAML for EZProxy already.

However, we have a number of patrons who do not have credentials in our SSO system but need to have the ability to use ILLiad. I think for them, we can imagine using the "External script authentication" method. (In our case, this would involve authenticating them against our Alma/Primo instance.)

In addition to both of those things, we already have EZProxy configured to recognize on-campus users and not require them to log in when they go to hit most of our subscription resources. We would need to keep that in place for our subscription things, but obviously we don't want any users to autologin to ILLiad as that's a personalized service.

So what we're imagining is 1) to keep the autologin, 2) have users who need to access subscription resources login via SSO/SAML as they do now, and 3) only have users who are expressly looking for ILLiad get sent to a login.htm page on EZProxy that makes them choose which authentication credentials they have, and authenticate them through that channel.

My reading of documentation around all this suggests that it might be should be possible to do all three of those things. Has anyone out there set up a configuration like this? If you have, any suggestions you could offer in terms of configuring the various pieces (ezproxy.cfg, user.txt, shibuser.txt, etc) or any pitfalls that you know of would be greatly appreciated.

Thanks, and take care,
Joe Montibello, MLIS
(he,him)
Library Systems Manager
Dartmouth College
603.646.9394
[email protected]<mailto:[email protected]>


********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].