Shibboleth at LSE

LSE Library

Status of Shibboleth / Athens Gateway accessed e-resources at the LSE Library
(as of July 2006)

Green means successfully tested & 'live' in LSE's Electronic Library; Blue means there are known problems.

* Gateway Compliant? Values:

• "(yes)" = listed as Gateway Compliant, but not fully tested at LSE Library.
• "Yes" = listed as Gateway Compliant and passed LSE Library tests - row should have green background.
• "yes?" = listed as Gateway Compliant, but LSE Library tests found problems - row should have blue background.
• "No" = listed as compliant, but Eduserv acknowledge there are problems - row should have blue background.
• "NGC" = listed as not Gateway Compliant.
• not known = not on either Gateway Compliant or Not Gateway Compliant lists.

** Directly Shibbolised? Values:

• "(yes)" = listed as Shibbolised at SDSS, but not fully tested at LSE Library.
• "Yes" = listed as Shibbolised and passed LSE Library tests - row should have red background.
• "yes?" = listed as Shibbolised, but LSE Library tests found problems - row should have blue background.
• "No" = listed, but service provider or federation acknowledge there are problems - row should have blue background.

*** Personalisation issues - values:

• n/a = there are no obvious personalisation features in the resource.
• n/t = not yet tested (not covered in Round 1 tests)
• No (works) = the personalisation feature apparently works without requiring additional usernames and / or passwords.
• Privacy = the personalisation feature(s) at some point appear to reveal the names of users other than the user logged in via Shibboleth / Gateway.
• +UN&PW = a further user name and password are required in order to use the personalisation features, negating the Single Sign-On ideal of the Shibboleth access.
• Yes = there is a problem with one or more of the personalisation features or they cannot be accessed.

Footnotes

1. Adept4Education: "[says that is compliant but doesn't seem to work, 24/8/05 - MG] [In theory this service allows athens users fast track access to special offers and educational discounts. However as you can also register without an athens pw, and also as we have an institutional licence for endnote software, I don't think this is something we need to bother about. - Rowena]".

2. Blackwell-Synergy: Error: Service athensAuthenticate&errmsg=Unable+to+connect+to+the+Athens+accounts+server+at+this+time.
%3Cp%3EYou+may+also+%3CA+HREF%3D%22http%3A%2F%2Fauth.athensams.net%2F%3Fath_returl%
3D%2522http%3A%2F%2Fwww.blackwell-synergy.com%2F%2522%26ath_dspid%3
DBLACKWELL_PUBLISHING%26ath_action%3Dlogout%22%3Elog+out+of+Athens
%3C%2FA%3E+to+try+again+with+a+different+username. is not found. Eduserv recommended getting in touch with Blackwell directly to seek advice, which was done (January 06?) but no response has been received as yet (7 March 06).

3. LexisNexis Professional and Executive: Round 1: Reached URL within http://w3.lexis.com/lne/activate.asp?MOD_ID=_pzathensbw&... "What Happened: We are temporarily unable to process your request. Please try again later. What Should I Do: 1. Please inform your Web administrator to check the following: - All required information has been provided and is correct. - All entries are free of typographical errors.

4. ProQuest (26 Apr 06): "Authentication Error 1012 - What happened? ProQuest cannot log you in because of an internal problem with our system. Why? This error occurs when something has malfunctioned in the system ProQuest uses to login users. You did nothing to cause this, and ProQuest apologizes for the inconvenience. What should you do? Students & library patrons: This error is usually temporary. We recommend that you try to access ProQuest again using the same method you used before. If you were accessing ProQuest directly, please go to http://proquest.umi.com/login ^. If you were following a link, please click on that link again. If you were accessing ProQuest through your library web site, please go to that web site again and follow its instructions for accessing ProQuest. If you have received this error multiple times, there may be a larger problem occurring. Please contact your library for assistance. Library administrators: Contact ProQuest Customer Support for assistance. ProQuest can only assist library administrators with authentication problems."

^Tried using 'classic' Athens un/pw but got "Authentication Error 1005. 1005: #You have entered an invalid user name" - PNS.

5. ProQuest - continued Gateway access problems

(a) Jan-Feb 06 tests: "Error 1001: Your Athens site is not set up properly to use ProQuest. Please have your Athens administrator contact ProQuest Customer Service for assistance." [not sure what they mean here. we subscribe to Digital National Security Archive from ProQuest - SR].

(b) Still not working on 21 July 2006: "Authentication Error 1014 - What happened? ProQuest was unable to give you access because ProQuest did not recognize your Athens login information. Why? The web address you entered or link you clicked on requires ProQuest to use a specific form of authentication called Athens authentication. This process checks to make sure you have a valid Athens username and password, and that your library has supplied the Athens information to ProQuest. This error means we were unable to connect you to ProQuest using your Athens information."

6. ScienceDirect:

(a) The supposedly WAYFless Gateway TRL only delivers to http://www.sciencedirect.com/ where either Athens login or else selection from A WAYF is required, eventually taking user to the similar looking but fully functional page http://www.sciencedirect.com/science. Further problems were found after Eduserv sent a revised URL for Science Direct - see footnotes in Round 2 Resource Table.

(b) "But this isn't quite ready for end-users yet! When I try to register for personalised services on SD, I get: "Feature Inaccessible - We are sorry. You are unable to access personalized features on ScienceDirect because your current institution's login credentials do not allow us to identify you. To access this feature, your institution must modify the information they send us when you login. Please contact your institution's librarian or information specialist." -- 'I think this is because we're not sending them an eduPersonTargettedID. This may be fixed if we can switch to the production IdP (which, I think, does send ePTID, because Athens required it).' - JP.

(c) When use My Profile - Generate New Reports, the user ID of s.mehrer@lse.ac.uk is offered on default. This might just be an inept default or exemplar, or symptom of a privacy problem.

(d) On 8 June, LSE's directly Shibbolised access to ScienceDirect encountered an 'Inter-institutional Access System Failure'. This was tracked to a bug in Shibboleth 1.2 (about to be upgraded) at the service provider which was put right immediately.

7. (a) SilverPlatter Arc2 (Jan-Feb 2006): Shibboleth access seemed to default to classic Athens: "Error: Please type your (Athens) User Name and Password then click OK or press Enter". (b) Not working 27 April 2006 - reaches the SilverPlatter WebSPIRS 5 interface but warns "No databases available for selection." Vendor contacted and put it right.

8. SwetsWise:

(a) Jan-Feb 2006: Listed as compliant, but problems: "Error: An error has occurred. Please try again. RemoteException occurred in server thread; nested exception is: java.rmi.RemoteException: ; nested exception is: nl.swets.wise.common.exception.SystemException: Athens : Cannot connect to the accounts server." 27 April 2006: In one session, after the search worked, the records would not display and verbose error messages were manifested.

(b) 'My Profile' leads to a profile set up for r.s.bossong@lse.ac.uk which was offered to edit (though it froze - except to Cancel) and a list of numerous other lse.ac.uk and, worryingly, other organisations' e-addresses, which had 'Edit Delete' opposite. New e-addresses can be added. Feature doesn't seem to work well, regardless of possible privacy issues.

9. JSTOR UK Mirror: Announced to be Gateway compliant on 28 March 2006 but on 26 April 2006 tried TRL and got error message: "Unfortunately, the information you entered has not been accepted because: Cannot see user. If you continue to experience problems, please contact your campus library or the JSTOR Helpdesk." Reported to Eduserv and MIMAS. "On 24th May 2006, JSTOR access switched from using the MIMAS Athens resource "UK JSTOR Mirror Service" to the Ithaka Athens resource "JSTOR", which included minor code changes. (Ithaka is the organisation providing JSTOR's IT infrastructure). The JSTOR service for UK institutions is still hosted at MIMAS, but Ithaka are now responsible for the Athens authentication. We understand that there will be further minor code changes to the Ithaka Athens resource "JSTOR" on 16th August to reach full compliance with Eduserv standards." - MIMAS, 7 July 2006.

10. Westlaw UK: "We cannot immediately complete your request because of technical difficulties. If you know your Westlaw password, you can sign on to Westlaw and your request will be completed under that password. You can also try your request later. If this problem persists, please call West Customer & Technical Services at 1-800-Westlaw (1-800-937-8529) or email west.support@thomson.com for assistance. We apologize for any inconvenience. Description: Error getting sponsor based on prefix for: _pzdstejjkkc3c44ccaj - No Athens prefix found in DB."

11. JISC PDS (Jan-Feb 06): "API error. Error Code: 999. Description: Your ATHENS login is not recognised by TurnitinUK as an authorised user. In order to access TurnitinUK from your ATHENS page, you will need to join a TurnitinUK account or class. Please contact the TurnitinUK Support Officer at iz.detection@northumbria.ac.uk for further information." Same error messages on 27/4/06 - PNS.

12. Oxford Scholarship Online: There were initial glitches in late 2005: "Works but users must click on 'Athens users link' to be connected, OUP are aware but haven't resolved the issue yet." Working via Gateway Jan-Feb 2006, but in March 2006 found further problems with WAYFless TRL used for Round 1 tests, so a new TRL from Eduserv will be tested in Round 2, and this seems to work. 'Subscriber Services' customises only at institutional (i.e. LSE) level, and so was not considered a personalisation feature.

13. LexisNexis Butterworths: Personalisation feature appeared to work very well without requiring Shibboleth-defeating extra username and password, until attempt to cancel or edit alerts via the URL offered to do this in the alert e-mails, prompting this error message.

14. Ovid: Possibly a glitch, but Gateway access failed on one occasion with 'Login failure - Encrypted URL timeout'. These things happen, but the way out for a Shibboleth system is surely not to invite input of username and password - something for Eduserv and/or Ovid to ponder an improvement.

15. Dialog DataStar - from e-mail of 10 July 2006:

(a) Direct Shibboleth access: "Not currently, but we are committed to [directly Shibbolising] as we can see many benefits. A full implementation is not timetabled yet, but we are aware of the dates listed regarding the end of official JISC funding for the existing Athens service."

(b) Joining SDSS: "Not currently. We are in regular contact with both JISC and Athens. As our development plans progress, this may change later."

16. Oxford University Press (OUP) e-mail of 30 June 2006: " We are certainly aware of Shibboleth, but do not yet have a detailed plan for implementation at our end. However, I think that your email prompts some more concrete action, so I have forwarded your email to colleagues in other departments who manage the customer services and back-office systems for our online products and we need to discuss what you've raised and clarify how OUP plans to proceed. "

17. Wiley InterScience: from e-mail of 5 July 2006:

(a) " Wiley does not currently offer direct Shibboleth access. ... Wiley is currently evaluating the business and technical aspects of offering Shibboleth and will make a decision shortly. ... We don't currently have a target date."

(b) Are your services available through Eduserv's Shibboleth to Athens Gateway? "No. ... It is one of the areas we are investigating. ... No target date yet."

18. Mergent Online - e-mail of 20 July 2006: "We appeciate you bringing [Shibbolisation] to our attention ... [and] will ... look into this for you as we have many UK institutions who subscribe to Mergent Online who may have the same issues."

19. Thomson Learning - e-mail of 29 June 2006: "As of now we have not been asked by any customers to join sdss.ac.uk. We will join federations as needed by our customers globally."

20. Taylor & Francis - e-mail 21 July 2006: "We will be looking at offering Shibboleth directly as an option (prob investigating late this year/early next year [2007]) once the new site is launched."

21. SDSS Edina: On 21 July 2006 the WAYFless URLs which passed the Round 1 tests failed completely with the displayed error message:

"Shibboleth Handle Service Failure
The inter-institutional access system experienced a technical failure.
Please email root@localhost and include the following error message:
Handle Service failure at (/shibboleth/HS)
edu.internet2.middleware.shibboleth.hs.HandleServlet$InvalidClientDataException: Invalid assertion consumer service URL."

The PERSEUS Chief Technology Officer traced the error to slight changes made by SDSS Edina to the URL, and supplied new URLs which worked properly again.

22. SDSS Edina: On 28 July 2006 the repaired WAYFless URLs supplied when the Round 1 URLs ceased working around 21st July (see footnote 21 above) failed again, but this time with the error message:

"Forbidden

You don't have permission to access /eig/Shibboleth.sso/SAML/POST on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

Apache/2.0.58 (Unix) mod_ssl/2.0.58 OpenSSL/0.9.7i Server at target.sdss.ac.uk Port 443"

23. ProQuest (Chadwyck-Healey) - When Periodicals Archive Online is accessed off-campus via the Athens Gateway the user is taken to this screen and had to click on ‘Login via Athens Service' to enter resource after ‘Athens Authentication Point'. Confusingly, the screen also requests ‘Password Login' above the ‘Login via Athens Service' but this does not accept a valid Athens UN&PW. The screen shown is from the Opera browser, but this behaviour is reproduced in IE 6.

Back to top