Re: FW: Dawsonera and EZProxy - please check setup

That is going to take the NameID field from the SAML message and assign it
to the login:user variable inside of EZproxy.

Depending on what format your IdP uses for NameID, this has the potential
to leak personally identifiable information to the vendor's platform, as it
is extremely common for IdP's to be configured to send emailAddress as the
NameID value.

We have been recommending that IdP's be configured to send persistent
opaque identifiers as the NameID field to avoid this; the mechanism for
doing so varies by the IdP in use, but your authentication administrator
for your IdP should be able to help you there.

Andrew

On Mon, Nov 25, 2019 at 10:22 PM Petrina Collingwood <
[email protected]> wrote:

> Hi all,
>
> I received this email from Dawson ERA today. They are saying that we have
> to make changes to the shibuser.txt file by December 15 or it will cause
> problems for users.
>
> We are moving EZproxy to ADFS this week, and are creating a shibuser.txt
> file for the first time for that. I am very reluctant to make a change like
> Dawson ERA are suggesting, especially close to Christmas.
>
>
>
> Does anyone foresee issues with this change? It’s not a normal stanza
> change, so I’m worried it might have consequences that we won’t anticipate.
>
>
>
> Thanks,
>
> Petrina
>
>
>
> *From:* Dawson ERA Enquiries <[email protected]>
> *Sent:* Tuesday, 26 November 2019 1:15 AM
> *Subject:* FW: Dawsonera and EZProxy - please check setup
>
>
>
> Dear Customer,
>
>
>
> As a result of a recent security review, we have become aware that the way
> in which EZProxy has been implemented at your library may be allowing
> multiple users to access dawsonera using the same user_id. For users to get
> the best experience of dawsonera, they need to be accessing using a unique
> user_id to ensure that any personally identifiable information such as
> bookmarks and notes is not visible to other users, and that notification
> emails from dawsonera are sent to the correct user.
>
>
>
> We have reached out to OCLC and asked for their advice, and they have
> advised that changes need to be made to the dawsonera stanza in
> shibuser.txt so that each user is individually authenticated.
>
>
>
> If OCLC host EzProxy for your institution, they will make the required
> changes for you. Please raise a support ticket with OCLC (
> https://www.oclc.org/en/contacts/support.html) asking them to do this.
>
>
>
> If you self host EzProxy you should make the following changes to your
> shibuser.txt file. If you have any questions, please contact OCLC
> https://www.oclc.org/en/contacts/support.html
>
>
>
>
>
>
>
> On *Sunday 15th December* *2019*, we will also be implementing additional
> security features to dawsonera, to bring it into line with industry
> standard best practice such as Apple Music. The changes will also ensure
> that our customer’s assets are protected from potential abuse, and that end
> users and their personal data are protected if, for example, they forget to
> fully logout of a shared device.
>
>
>
> If you have not completed the changes to your EZProxy set-up by *Sunday
> 15th December* it could cause disruption to your users when the oldest
> instance of a shared login will automatically be logged out when the user
> id is used again.
>
>
>
> For clarification this change does not prevent dawsonera users from
> opening multiple tabs and windows in the same browser to read many books at
> the same time. This change also does not prevent users from being able to
> download and read content on multiple devices using the Adobe ACS DRM
> system.
>
>
> Thank you in advance for your help in resolving this issue. Please contact
>  [email protected] if you have any questions.
>
>
>
>
>
> *Dawsonera*
>
> *Dawson Books*
>
> 1 Broadland Business Park, Norwich, NR7 0WF
> dawsonbooks.co.uk
>
> *[image: Description: dawson-books]*
>
>
>
> The information contained within this e-mail (and any attachments) is
> private and confidential and may be privileged. It is intended for the
> named addressee(s) only. If you have received this e-mail in error, please
> inform the sender and delete it from your system. The contents of this
> e-mail and any attachments) must not be disclosed to, or used by, anyone
> else or copied without the sender's consent. Any views and/or opinions
> expressed in this e-mail are those of the author and do not necessarily
> reflect those of Dawson Books. Dawson Books does not take any
> responsibility for the views of the author. For the avoidance of doubt,
> employees of Dawson Books are not authorised to conclude contracts on
> behalf of Dawson Books by means of e-mail communications. Accordingly, any
> liability of the sender and Dawson Books (in negligence or otherwise)
> arising from any third party acting, or refraining from acting, on any
> information contained in this e-mail is excluded. E-mail transmission
> cannot be guaranteed to be secure, or error free as information could be
> intercepted, corrupted, lost, destroyed, late in arriving or incomplete as
> a result of the transmission process. Accordingly, neither Dawson Books nor
> the sender accepts any liability for any damage you sustain as a result of
> malicious content, malware and software viruses contained in this e-mail or
> any of its attachments. It is your responsibility to scan the e-mail and
> attachments (if any) in this regard. Please note that Dawson Books reserves
> the right to monitor, intercept and record incoming and outgoing e-mails
> for the purpose of protecting its business and to ensure regulatory
> compliance. Please refer to our Privacy Notice (
> https://www.bertrams.com/img/bert2.0/help/Bertrams2018_PrivacyPolicy.pdf)
> for further details about how we treat your personal information. Dawson
> Books Limited - Registered Number: 6882367 England. Registered Office - 1
> Broadland Business Park, Norwich, Norfolk, England, NR7 0WF.
>
> ------------------------------
>
> To unsubscribe from the EZPROXY-L list, click the following link:
> http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1
>


-- 

Andrew Anderson
President & CEO
[email protected]
t: +1 (727) 536-0214 x100
f: +1 (727) 530-3126
w: www.lirn.net
Library & Information Resources Network
25400 US Hwy 19 North, Ste. #220
Clearwater, FL 33763
LinkedIn
<http://www.linkedin.com/company/library-and-information-resources-network-inc->
 | Facebook <http://www.facebook.com/LIRNnotes> | Twitter
<http://www.twitter.com/LIRNNotes> | YouTube
<http://www.youtube.com/user/LIRNnotes>


********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].