Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »


DEMO for the Super Walk-In Users Portal - LIbrary Pilot # 1 - Scenario 3



==== DRAFT / WIP ==== 


Two major obstacles preventing University libraries from moving to all-federated access are both IP addresses.

Some service providers only support IP addresses for "authentication". This can be resolved using EZProxy to bridge between modern federated authentication and legacy eresources using IP-address authentication.

Libraries currently use IP-address based authentication for providing access to "walk-in" library users. Walk-in users are people who do not have institutional IT accounts (and so cannot use normal IdPs) but who can access eresources by visiting a library and using terminals. Eresources will normally grant access to these terminals by relying on IP address authentication.  


Problems with the IP address Kiosk approach


Requires all eresources (potentially a large number) to be configured with the IP addresses of all kiosks. Adding a new kiosk will be awkward and time-consuming.

Deprovisioning the IP addresses of networks or individual kiosks can be easily overlooked, creating potential access problems

Continuing to rely on IP addresses to access eresources will hold back progress


Using IP address authentication at the institutional IdP

The Shibboleth IdP can be configured to automatically authentication users logging in from defined ip addresses or ranges of ip addresses. This can be used to provide modern, federated access to eresources for walk-in users at library kiosks.

However, this approach has a few disadvantages:

The configuration is via XML files, and the IdP needs to be restarted to load them. Library staff cannot easily make changes or see the current status

Not all libraries are have available SAML IdPs


Pilot Solution: A shared, easily configured IdP service for Walk-In users

A standard Shibboleth IdP v3 was used

Authentication was configured to only use IP addresses, and all IP addresses were permitted.

An IdP extension was used to collect the user's IP address. This can also be done using Javascript within the IdP if Shibboleth v3 is used.

Attributes for the user were searched for, using their IP address, in an LDAP directory.

If attributes were found, the user authenticates as normal and attribute data is shared with the destination eresource

An intercept filter was added to the IdP to halt authentication if no record for that IP address was found in the LDAP directory.


LDAP records were configured using a stand-alone administration interface supplied by DAASI. Any utility capable of updating LDAP could be used, but the DAASI application used in the pilot allows administrators from many different institutions to log in and edit records for their own organisation, so that one service can provide IP-address-based authentication for many 




Example User Story












For non-federated users



Demo Video




  • No labels