1. IP Filtering is Obsolete Where do we go from here?
Rich Wenger, E-Resource Systems Manager
MIT Library

2. TOC In the beginning… The march of technology Playing games
Two broad goals
A way forward

3. In the beginning.. Early days of the internet No portable devices
Static IP addresses
Unspoken assumptions

4. The march of technology
Portable PCs, laptops, tablets, smart phones
DHCP – non-static IP addresses
Off-campus users

5. Playing games Virtualization at multiple levels
Pretending that nothing had changed
VPN and proxy servers

6. Bottom line
The assumption that an IP address = a physical location = an authenticated, authorized user is false.
IP filtering is about where a user is (which is completely obscured by proxy servers and VPNs), not who the user is.

7. Bottom line IP filtering
Conflates IP address with location and identity.
Creates proprietary portals, the opposite of modern Discovery practices.
Is a maintenance nightmare.
Is unsecure and easily exploitable.
“Without IP filtering, Scihub could not exist”*
* Atypon presentation on Piracy at SSP conference in Boston, June 2017

8. Two areas of concern We need to: Improve the user experience.
Respond to the security problems.

9. Improving the user experience
The point of referral for authentication must be located at the providers’ sites, not in our portals.
Affiliation defaults must be preserved across browser sessions.
All devices must be robustly supported.

10. Security We need to: Focus on who the patron is, not where they are.
Use institutional credentials.
Arrest the proliferation of resource-specific userids and passwords.
Support SSO across all devices.

11. A way forward
Federated Identity Management, robustly implemented by providers and subscribers.
SAML-based systems
Ex. Shibboleth, OpenAthens, etc.
Federated metadata.
Authentication referral at the point of need.
Use of institutional credentials.
Support for affiliation at multiple institutions.

12. FIM
FIM has been available for many years, but its uptake has been halting and sporadic.
Providers and subscribers were/are each waiting for the other to take the initiative.
SAML-based systems are becoming ubiquitous, but the quality of implementations varies widely.

13. RA21 Initiative RA21, a convergence of efforts by
STM Scientific, Technical, and Medical publishers
PDR Pharma Documentation Ring
URA Universal Resource Access

14. RA21 Initiative RA21 SAML-based Federated ID Management.
Authentication at the point of need.
Collaboration on a set of recommended best practices for providers and subscribers.
Open process.

15. RA21 Addresses issues important to academic libraries Privacy Walk-ins
Protection of personally-identifying history and usage data
Uneven quality of some providers’ SAML implementations

16. RA21 Improved user experience Authentication at the point of need
Single Sign On (SSO)
Comprehensive device support
Support for multiple institutional affiliations

17. RA21 Simplified technical environment More granular control
Federated metadata
No need to maintain IP ranges with providers
Reduced dependence on proxy servers

18. RA21 Challenges Gaining library management’s attention to this issue
Getting buy-in and support from campus IT
Resisting fragmentation of effort

19. RA21 Participants
Steering Committee
Participants

20. Case study
Improve the user experience of students and researchers ing-the-stumbling-blocks-that-impede-researcher-access- to-e-resources/

21. A way forward A goal to work toward, NOT an abrupt change
Dual stack support for the foreseeable future
Libraries need to get involved
If we do this carefully and well, it should be minimally disruptive to users.

22. Finis
Rich Wenger
Phone