Re: FW: Dawsonera and EZProxy - please check setup

Thanks Andrew for your advice, very helpful!
Petrina

From: Andrew Anderson <[email protected]>
Sent: Wednesday, 27 November 2019 1:57 AM
To: Petrina Collingwood <[email protected]>
Cc: [email protected]
Subject: Re: [EZPROXY-L] FW: Dawsonera and EZProxy - please check setup

That is going to take the NameID field from the SAML message and assign it to the login:user variable inside of EZproxy.

Depending on what format your IdP uses for NameID, this has the potential to leak personally identifiable information to the vendor's platform, as it is extremely common for IdP's to be configured to send emailAddress as the NameID value.

We have been recommending that IdP's be configured to send persistent opaque identifiers as the NameID field to avoid this; the mechanism for doing so varies by the IdP in use, but your authentication administrator for your IdP should be able to help you there.

Andrew

On Mon, Nov 25, 2019 at 10:22 PM Petrina Collingwood <[email protected]<mailto:[email protected]>> wrote:
Hi all,
I received this email from Dawson ERA today. They are saying that we have to make changes to the shibuser.txt file by December 15 or it will cause problems for users.
We are moving EZproxy to ADFS this week, and are creating a shibuser.txt file for the first time for that. I am very reluctant to make a change like Dawson ERA are suggesting, especially close to Christmas.

Does anyone foresee issues with this change? It’s not a normal stanza change, so I’m worried it might have consequences that we won’t anticipate.

Thanks,
Petrina

From: Dawson ERA Enquiries <[email protected]<mailto:[email protected]>>
Sent: Tuesday, 26 November 2019 1:15 AM
Subject: FW: Dawsonera and EZProxy - please check setup

Dear Customer,

As a result of a recent security review, we have become aware that the way in which EZProxy has been implemented at your library may be allowing multiple users to access dawsonera using the same user_id. For users to get the best experience of dawsonera, they need to be accessing using a unique user_id to ensure that any personally identifiable information such as bookmarks and notes is not visible to other users, and that notification emails from dawsonera are sent to the correct user.

We have reached out to OCLC and asked for their advice, and they have advised that changes need to be made to the dawsonera stanza in shibuser.txt so that each user is individually authenticated.

If OCLC host EzProxy for your institution, they will make the required changes for you. Please raise a support ticket with OCLC (https://www.oclc.org/en/contacts/support.html<https://www.oclc.org/en/contacts/support.html>) asking them to do this.

If you self host EzProxy you should make the following changes to your shibuser.txt file. If you have any questions, please contact OCLC https://www.oclc.org/en/contacts/support.html<https://www.oclc.org/en/contacts/support.html>

[cid:[email protected]]


On Sunday 15th December 2019, we will also be implementing additional security features to dawsonera, to bring it into line with industry standard best practice such as Apple Music. The changes will also ensure that our customer’s assets are protected from potential abuse, and that end users and their personal data are protected if, for example, they forget to fully logout of a shared device.

If you have not completed the changes to your EZProxy set-up by Sunday 15th December it could cause disruption to your users when the oldest instance of a shared login will automatically be logged out when the user id is used again.

For clarification this change does not prevent dawsonera users from opening multiple tabs and windows in the same browser to read many books at the same time. This change also does not prevent users from being able to download and read content on multiple devices using the Adobe ACS DRM system.

Thank you in advance for your help in resolving this issue. Please contact  [email protected]<mailto:[email protected]> if you have any questions.


Dawsonera
Dawson Books
1 Broadland Business Park, Norwich, NR7 0WF
dawsonbooks.co.uk<http://dawsonbooks.co.uk>
[Description: dawson-books]


The information contained within this e-mail (and any attachments) is private and confidential and may be privileged. It is intended for the named addressee(s) only. If you have received this e-mail in error, please inform the sender and delete it from your system. The contents of this e-mail and any attachments) must not be disclosed to, or used by, anyone else or copied without the sender's consent. Any views and/or opinions expressed in this e-mail are those of the author and do not necessarily reflect those of Dawson Books. Dawson Books does not take any responsibility for the views of the author. For the avoidance of doubt, employees of Dawson Books are not authorised to conclude contracts on behalf of Dawson Books by means of e-mail communications. Accordingly, any liability of the sender and Dawson Books (in negligence or otherwise) arising from any third party acting, or refraining from acting, on any information contained in this e-mail is excluded. E-mail transmission cannot be guaranteed to be secure, or error free as information could be intercepted, corrupted, lost, destroyed, late in arriving or incomplete as a result of the transmission process. Accordingly, neither Dawson Books nor the sender accepts any liability for any damage you sustain as a result of malicious content, malware and software viruses contained in this e-mail or any of its attachments. It is your responsibility to scan the e-mail and attachments (if any) in this regard. Please note that Dawson Books reserves the right to monitor, intercept and record incoming and outgoing e-mails for the purpose of protecting its business and to ensure regulatory compliance. Please refer to our Privacy Notice (https://www.bertrams.com/img/bert2.0/help/Bertrams2018_PrivacyPolicy.pdf<https://www.bertrams.com/img/bert2.0/help/Bertrams2018_PrivacyPolicy.pdf>) for further details about how we treat your personal information. Dawson Books Limited - Registered Number: 6882367 England. Registered Office - 1 Broadland Business Park, Norwich, Norfolk, England, NR7 0WF.

________________________________

To unsubscribe from the EZPROXY-L list, click the following link:
http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1<http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1>


--

Andrew Anderson
President & CEO
[email protected]<mailto:[email protected]>
t: +1 (727) 536-0214 x100
f: +1 (727) 530-3126
w: www.lirn.net<https://www.lirn.net/>
Library & Information Resources Network
25400 US Hwy 19 North, Ste. #220
Clearwater, FL 33763
LinkedIn<http://www.linkedin.com/company/library-and-information-resources-network-inc-> | Facebook<http://www.facebook.com/LIRNnotes> | Twitter<http://www.twitter.com/LIRNNotes> | YouTube<http://www.youtube.com/user/LIRNnotes>


********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].