Authentication
OpenAthens Overview
OpenAthens authentication will need to be enabled for each collection in order to authenticate remote users into the resource. This page will go over OpenAthens authentication for collections active in Alma and your Databases AZ list.
OpenAthens authenticates users into resources with the following two methods: Federated and Proxied. For the most part, this doesn’t impact the user’s experience authenticating into a resource. It does impact what information is provided the service provider when setting up OpenAthens and when troubleshooting issues.
Federated vendors will require your Entity ID and OA Organization ID, which will look something like: https://idp.abac.edu/openathens and 71455473.
Proxied vendors will need the IP address for the proxy. This is basically the same as EZproxy, but the service is through OpenAthens, rather than OCLC’s EZproxy. Vendors will need the OA proxy IP for your institution.
Redirector URL
Regardless of whether the resource is authenticating via federated authentication or being proxied, the vendor URL will need to be percent encoded and prepended with the OpenAthens Redirector URL. This can be accomplished by running the vendor URL through the OpenAthens Redirector Tool.
Example: http://fod.infobase.com/PortalPlaylists.aspx?wID=100902&xtid=38220
This Infobase URL will need to be percent encoded with the OpenAthens Redirector prepended: https://go.openathens.net/redirector/highlands.edu?url=http%3A%2F%2Ffod.infobase.com%2FPortalPlaylists.aspx%3FwID%3D100902%26xtid%3D38220
Vendor Requirements
As stated above, vendor URLs will need to be prepended with the OpenAthens Redirector, but some vendors require an account ID to be present in the URL as well. These vendors are EBSCO, Ebook Central, Gale, Infobase and ProQuest, for the most part. These URLs can be prepended with the OpenAthens Redirector URL, but they don’t require it. Here are some examples:
Activating OpenAthens for Newly Acquired Electronic Resources
If you have acquired a new resource from a vendor that has been previously set up with OpenAthens authentication, and is on the same platform, then no further action is needed, since authentication has already been set up.
If you find the new resource has not been set up. You will want to Contact GALILEO to get this set up.
One way to check to see if the resource has been allocated in your OA admin is to run the URL through the OpenAthens Redirector Link Generator in your institution's OpenAthens admin.
Plug in your URL and click Generate Link. You will get one of the two responses.
The following response indicates that the resource isn’t set up AND needs to be added by OpenAthens to the OA catalog. This is the same scenario as the “we cannot complete your request” error. Contact GALILEO to get this set up.
The following response shows that the resource is available for allocation. In this example click on the hyperlinked service provider’s name (Elsevier) to see if the resource has been allocated.
If it’s in green, then it hasn’t been allocated and will result in the “Forbidden” error when users try to authenticate. Blue indicates that it has been allocated.
OpenAthens in Alma
Authentication can be enabled in three different places within an electronic collection in Alma:
Authentication set up at the Collection Level will only authenticate users into the searchable interface of the collection, if the collection bib record is set to un-suppressed in Alma. The default setting is "suppressed." Setting authentication at the Collection Level will not have any impact on title or article level linking.
Authentication set up at the Service Level will authenticate users into the Full Text Service, i.e. the individual journal titles for the collection (portfolio) and any link resolver activity (article level). This is where authentication will be set 99% of the time.
Authentication can be set in the individual portfolio to override what has been set at the service level, but you typically will want to only have authentication enabled at the Service Level, because it's easier to manage.
OpenAthens Redirector (proxy setting) and Linking Parameters are typically mutually exclusive. A general rule is, if the Linking Parameters are asking for an account ID (for the vendor), then the OpenAthens Redirector typically doesn't need to be enabled and authentication will solely rely on Linking Parameters.
For activating resources/configuring authentication, see the Activating E-Resources Guide.
Adding Resolver Proxy Integration Profile in Alma Configuration
Troubleshooting
OpenAthens maintains all configuration, so no local work is needed. When a new resource has been acquired and hasn't already been set up, please Contact GALILEO to get this set up.
Once OpenAthens has been set up for a resource and configured in Alma, you can use the following troubleshooting guide for any issues you might encounter.
GALILEO OpenAthens Troubleshooting Guide
https://docs.google.com/document/d/15FZ0raQPsH4SPPPBRmFuFzTJ-8Sj7-wi7IL20VDmqCQ/edit