IP Filtering is Obsolete Where do we go from here? Rich Wenger, E-Resource Systems Manager MIT Library

TOC In the beginning… The march of technology Playing games Two broad goals A way forward

In the beginning.. Early days of the internet No portable devices Static IP addresses Unspoken assumptions

The march of technology Portable PCs, laptops, tablets, smart phones DHCP – non-static IP addresses Off-campus users

Playing games Virtualization at multiple levels Pretending that nothing had changed VPN and proxy servers

Bottom line The assumption that an IP address = a physical location = an authenticated, authorized user is false. IP filtering is about where a user is (which is completely obscured by proxy servers and VPNs), not who the user is.

Bottom line IP filtering Conflates IP address with location and identity. Creates proprietary portals, the opposite of modern Discovery practices. Is a maintenance nightmare. Is unsecure and easily exploitable. “Without IP filtering, Scihub could not exist”* * Atypon presentation on Piracy at SSP conference in Boston, June 2017

Two areas of concern We need to: Improve the user experience. Respond to the security problems.

Improving the user experience The point of referral for authentication must be located at the providers’ sites, not in our portals. Affiliation defaults must be preserved across browser sessions. All devices must be robustly supported.

Security We need to: Focus on who the patron is, not where they are. Use institutional credentials. Arrest the proliferation of resource-specific userids and passwords. Support SSO across all devices.

A way forward Federated Identity Management, robustly implemented by providers and subscribers. SAML-based systems Ex. Shibboleth, OpenAthens, etc. Federated metadata. Authentication referral at the point of need. Use of institutional credentials. Support for affiliation at multiple institutions.

FIM FIM has been available for many years, but its uptake has been halting and sporadic. Providers and subscribers were/are each waiting for the other to take the initiative. SAML-based systems are becoming ubiquitous, but the quality of implementations varies widely.

RA21 Initiative RA21, a convergence of efforts by STM Scientific, Technical, and Medical publishers PDR Pharma Documentation Ring URA Universal Resource Access

RA21 Initiative RA21 SAML-based Federated ID Management. Authentication at the point of need. Collaboration on a set of recommended best practices for providers and subscribers. Open process.

RA21 Addresses issues important to academic libraries Privacy Walk-ins Protection of personally-identifying history and usage data Uneven quality of some providers’ SAML implementations

RA21 Improved user experience Authentication at the point of need Single Sign On (SSO) Comprehensive device support Support for multiple institutional affiliations

RA21 Simplified technical environment More granular control Federated metadata No need to maintain IP ranges with providers Reduced dependence on proxy servers

RA21 Challenges Gaining library management’s attention to this issue Getting buy-in and support from campus IT Resisting fragmentation of effort

RA21 Participants Steering Committee Participants

Case study Improve the user experience of students and researchers https://scholarlykitchen.sspnet.org/2015/11/13/dismantl ing-the-stumbling-blocks-that-impede-researcher-access- to-e-resources/

A way forward A goal to work toward, NOT an abrupt change Dual stack support for the foreseeable future Libraries need to get involved If we do this carefully and well, it should be minimally disruptive to users.

Finis Rich Wenger rwenger@mit.edu Phone 617-253-0035