Docutek and EZProxy

1
Docutek and EZProxy

• Sonja McAbee and Don Walter
• Houston Cole Library
• Jacksonville State University
• Jacksonville, Alabama

2
Authenticating Docutek with EZProxy

• Centralized Authentication
• Using EZProxy for database authentication already
• Reduced administrative overhead
• Docutek authentication requires much more effort
  to maintain
• EZProxy authentication uses a flat file generated
  nightly from the Voyager patron database with a
  Perl script
• Docutek passwords can be used for documents
  requiring greater access control

3
Functional Requirements

• On-Campus users should be automatically
  authenticated
• Off-Campus users should be directed through the
  EZProxy server for authentication
• Avoid the EZProxy URL prefixes

4
Allow on Campus, Redirect off Campus
5
Authenticate Off Campus thru EZProxy
6
Implementation

• Configure Docuteks IIS web server to deny off
  campus addresses
• Replace the access denied error message with a
  visual basic script (VBScript) that rewrites the
  URL to direct the off campus user through the
  EZProxy server

7
Basic Steps

• Replace the IP address rejected message with a
  VBScript
• Deny all except for open access IP numbers
• EZProxy server MUST be one of the allowed IP
  numbers
• Allow access to the script itself for all
  accesses
• Configure the EZProxy server

8
The Visual Basic Script

• lt _at_Language "VBScript" gt
• lt
• Option Explicit
• Response.Buffer True
• Response.Expires0
• Dim HostURL
• Dim QuerySTRING
• QuerySTRING Request.ServerVariables("QUERY_S
  TRING")

9
The Script Continued
HostURL"" If (Len(QuerySTRING)gt4) Then
HostURLRight(QuerySTRING,Len(QuerySTRING)-4)
End If Response.Redirect(
"http//lib-proxy.jsu.edu80/login?url"
HostURL ) Response.Flush Response.End gt
10
The Script Endgame
ltHTMLgt ltHEADgt ltTITLEgtPage Not
Availablelt/Titlegt lt/HEADgt ltBODYgt You're
attempting to access lt HostURL gt. It is
inaccessible. Please contact us immediately so
we can rectify this problem. lt/BODYgt lt/HTMLgt
11
Installing the Script

• Modify Script for your EZProxy server prefix
• http//lib-proxy.jsu.edu80/login?url"
• Copy script to the root directory of the IIS
  server. Probably C\Docutek\

12
Configuring the IIS Web Server to use the script

• In the Internet Services Manager select the ERes
  Server Properties
• Select Custom Errors
• Select HTTP Error 4036
• Set Message Type URL
• Must be URL for VBScript to be executed
• Enter the VBScript URL /proxy_redirect.asp

13
Redirect IP Addresses to URL for Script
14
Deny off campus IP numbers

• In the Internet Services Manager select
  Directory Security
• Select IP Address and domain name restrictions
• Set Deny all IP addresses except specified
• Select Add group
• Enter Network number and subnet mask for your
  On-Campus IP numbers

15
Deny Access to all Except Listed
16
Accessing redirect script

• In the Internet Services Manager select your ERes
  server in the left pane
• Select proxy_redirect.asp in the right pane
• Right click on proxy_redirect.asp and select
  properties
• Select File Security
• Select IP Address and domain name restrictions
• Click All computers Granted Access

17
All IPs Granted Access to Script
18
IIS Server Configuration Complete

• At this point your IIS server should be serving
  documents for On Campus addresses and redirecting
  Off Campus addresses to EZProxy
• Next we configure the EZProxy server to allow
  access to the Docutek server

19
Configuring EZProxy

• E - ExcludeIP redirects the specified IP numbers
  to not use EZProxy and go directly to the site.
• I - IncludeIP allows specified IP numbers
  specified in a previous Exclude to use EZProxy.
  Usually for testing purposes.

20
EZProxy Address Ranges

• Exclude your On Campus addresses
• E 10.0.16.0-10.0.31.255
• E 172.16.11.0-172.16.11.255
• Include any test machines
• I 172.16.11.14
• I 172.16.11.43

21
EZProxy site configuration stanza

• Stanza always begins with the T (Title) command
• Contains the U (url)
• And necessary H (Host) and D (Domain) entries

22
Example ERes Stanza

• T JSU Electronic Reserves
• U http//ereserves.jsu.edu/
• H ereserves.jsu.edu
• D ereserves.jsu.edu

23
EZProxy Configuration Complete

• Once the allowed IP ranges are configured and the
  ERes stanza is set up the EZProxy server should
  be authenticating and proxying for off campus
  users

24
Problems Encountered

• Browser session cookies must be enabled
• Some security products and browser security
  settings block cookies
• Browser referer must be passed on HTTP request
• Some security products and browsers strip referer

25
More Problems

• PDF file printing problems
• Bugs in Acrobat Mirror Image or Garbled
• Old versions of Acrobat have bugs
• Workaround Print as Image
• Viewers for PDF, Powerpoint, Excel, and Word
• Users must have or install viewers

26
Summary

• EZProxy and Docutek work well together
• Very few problems
• Further detail is available at
  http//library.jsu.edu/walter