...

1.	Access EZ proxy demo instance at  https://ezproxy.fi.infn.it/
2.	Login to EZproxy portal with your federated ID: choose your IdP (if not listed, ask to idem-help@garr.it to add your IdP to IDEM test federation for the purpose of this test) A single direct IdP has been set up on Ezproxy  for the purpose of the pilot login with the home organisation credentials (username: test1 and same password)
3.	Choose the Federated Resource Dogs 101 (redirection to SSO)  (note the URL http://ezproxy.fi.infn.it/login?url=https://sp24-test.garr.it/dogs-101.html ) after click, note the URL on the address bar of the browser https://sp24-test.garr.it/dogs-101.html . Your SAML SSO session is active and the page isn't proxied.
4.	Choose the Not Federated Resource Cats 101 (via proxy)  (note the URL http://ezproxy.fi.infn.it/login?url=https://sp24-test.garr.it/cats-101.html ) after click, note the URL on the address bar of the browser https://sp24-test-garr-it.ezproxy.fi.infn.it/cats-101.html . You are permitted to access thanks to the rewriting rule of the proxy.

For non-federated users

Components

1.	Access EZ proxy demo instance at  https://ezproxy.fi.infn.it/
2.	Login to EZproxy portal as a library walk-in guest: A single IdP has been set up on Ezproxy  for the purpose of this scenario login from an IP address already registered on the idp (please write your IP CIDR to monticini@garr.it) you won't be asked for username / password and your ESPA attribute value is library-walk-in@garr.it
3.	Choose the Federated Resource Dogs 101 (redirection to SSO)  (note the URL http://ezproxy.fi.infn.it/login?url=https://sp24-test.garr.it/dogs-101.html ) after click, note the URL on the address bar of the browser https://sp24-test.garr.it/dogs-101.html . Your SAML SSO session is active and the page isn't proxied.
4.	Choose the Not Federated Resource Cats 101 (via proxy)  (note the URL http://ezproxy.fi.infn.it/login?url=https://sp24-test.garr.it/cats-101.html ) after click, note the URL on the address bar of the browser https://sp24-test-garr-it.ezproxy.fi.infn.it/cats-101.html . You are permitted to access thanks to the rewriting rule of the proxy.	5.

...

Components

Benefits 

Demo Video

https://drive.google.com/open?id=0B6nLU4k7ZZvfaUM4OTJtTmlFN28

Transcript https://drive.google.com/open?id=0B6nLU4k7ZZvfcGNybTFXZ0VaRlk

=================================================================================================================

Scenario A FEDERATED USER

a USER, provided with FEDERATED ID,

firstly logs in the institution EZproxy and, if succesfully authenticated,  gets 1. a SSO session and 2. a shielded access masked with the IP addreess of the proxy.

When she accesses

-> A.1] a FEDERATED RESOURCE, by means of SAML SSO session, she gets access to the resource with SAML authentication;

-> A.2] a NOT FEDERATED RESOURCE restricted to authorised IPs, by means of REWRITING properties of the proxy she gets access to the resource because she's authorized having the IP address of the proxy.

The USER: you with your federated credential

The EZproxy portal is: https://ezproxy.fi.infn.it/

The federated resource is: DOGS https://sp24-test.garr.it/dogs-101.html (Access protected by SAML SSO authentication)

The not federated resource is: CATS https://sp24-test.garr.it/cats-101.html (Access forbidden, access permitted only through authorised  IPs)

...

1. after click, note the URL on the address bar of the browser https://sp24-test-garr-it.ezproxy.fi.infn.it/cats-101.html . You are permitted to access thanks to the rewriting rule of the proxy.

Scenario B] NON-FEDERATED USER

in this case the user is not provided with Federated access and is permitted via her IP address.

The USER: you connecting from an authorized IP address (for the simulation please send a email to Barbara Monticini with your IP address)

The EZproxy portal is: https://ezproxy.fi.infn.it/, access through "Institutional login"

The federated resource is: https://sp24-test.garr.it/dogs-101.html

The not federated resource is https://sp24-test.garr.it/cats-101.html  (access permitted only through the IP of the proxy)

...

1. note the URL on the address bar of the browser:
   1. if you see ezproxy.fi.infn.it, then your page is rewrited by the proxy
   2. if you dont see ezproxy.fi.infn.it, this means that you got a SAML SSO session

...

Benefts

1. A user use only one unified method of authentication to access both federated and not federated resources
2. For each resource the Library logs the access in a unified way. If a Resource is federated, only federated access will be allowed, and  IP based auth wont be permitted anymore. If a Resource is not federated, the user gets the access via IP address auth, and the proxy will log the access o that resource in this way.

...