1. 1 Dec. 2004 The Hong Kong Institute of Education Library Integrating Innopac with HKIEd “Portal” Environment Ivan Chan The Hong Kong Institute of Education Library 1 Dec 2004 HKIUG 5, CityU

2. The Hong Kong Institute of Education Library 2 Agenda Project Outline Quick Snapshots Portal Integration –Single Sign On (SSO) Connector –PatronAPI Enhancements Technical Information Future Plan

3. The Hong Kong Institute of Education Library 3 Project Outline This project aims at: –providing Single Sign On (SSO) for HKIEd “portal” and Innopac’s patron verification –integrating patron loan information with the campus “portal” Phase 1 (July/2004) –Library PINs sync. with campus passwords Phase 2 (Dec/2004) –Patron loan records integrated with the campus “portal”

4. 1 Dec. 2004 The Hong Kong Institute of Education Library 4 Quick Snapshots

5. The Hong Kong Institute of Education Library 5 HKIEd “Portal” Login

6. The Hong Kong Institute of Education Library 6 HKIEd “Portal” Homepage Click “MyLibrary” to view loan record

7. The Hong Kong Institute of Education Library 7 Viewing Library Loan Records Items checked out Items on hold

8. The Hong Kong Institute of Education Library 8 Patron Record Integration Click on “Renew Item” to logon Innopac “View Circulation Record” automatically

9. 1 Dec. 2004 The Hong Kong Institute of Education Library 9 Portal Integration

10. The Hong Kong Institute of Education Library 10 Single Sign-On (SSO) Lack of interoperable standard –Examples of SSO standards Shibboleth-Architecture Draft v05 - drafted in 2002, is a “secure exchange of interoperable authorization information that can be used in access control decision making” [http://shibboleth.internet2.edu/draft-internet2- shibboleth-arch-v05.html] [http://shibboleth.internet2.edu/draft-internet2- shibboleth-arch-v05.html] Central Authentication Service (CAS) of Yale University - “SunGard SCT's Luminis includes in its latest version as an integrated version of the CAS server” [http://www.yale.edu/tp/auth/cas10.html] SunGard SCTLuminisSunGard SCTLuminis Portal such as Luminis CPIP (campus pipeline integration protocol) technology by SCT

11. The Hong Kong Institute of Education Library 11 It is difficult to build the SSO solution across different legacies of WEB applications. In the project, two major tasks have been completed: –SSO Connector for patron verification –PatronAPI Enhancements to work with SSO Connector: Online Reset of PIN View Circulation Records Interface Auto-logon to Patron Circulation Records

12. The Hong Kong Institute of Education Library 12 Single Sign-On Connector SSO-Connector developed by IT department of the Institute It converts cookies information to library logon identity and POST the web-form to Innopac automatically LOGIN and LOGOUT are managed by the connector

13. The Hong Kong Institute of Education Library 13 Client Browser Username / Password Cookie Information Web Application Server LOGIN Web Page Request Cookie Normal Authentication

14. The Hong Kong Institute of Education Library 14 Client Browser Username / Password Cookie Information “Portal” with SSO Feature SSO Connector LOGIN Request for Circulation Record Cookie Login Identity: Name / Barcode / PIN Enhanced PatronAPI SSO-Connector Authentication Target URL Syntax: SSO Object + Target URL Circulation Record Innopac System

15. The Hong Kong Institute of Education Library 15 SSO Connector Syntax https://[SSO_connector]xurl=https://innopacapi/API/circ_record.php SSO Object Target URL EXAMPLE: The SSO syntax comprises 2 components, namely SSO Object and Target URL: SSO Object will validate the logon identity SSO Object will reject the Target URL if the portal is already logged out or timed out

16. 1 Dec. 2004 The Hong Kong Institute of Education Library 16 PatronAPI Enhancements

17. The Hong Kong Institute of Education Library 17 Campus “Portal” Innopac System User Enhanced PatronAPI Library Applications e.g. BI class registration 3. Patron API Enhancements A.Reset PIN online B.View circulation record C.Logon “patron” record 2. SSO Connector 1. User login (indirect access) Data Paths of Portal Integration Direct Access

18. The Hong Kong Institute of Education Library 18 1. Reset PIN online –Interface: use secure HTTP (i.e. https) FORM posting –Processing: two phases, i.e. delete PIN and create new PIN –Campus password is synchronized with Library PIN –Same password can be used to logon Innopac patron record

19. The Hong Kong Institute of Education Library 19 PIN Reset Diagram HTTPS request Delete PIN Create New PIN TELNET (delete PIN) HTTP (assign new PIN) Queue DONE Innopac System OK FAIL

20. The Hong Kong Institute of Education Library 20 # Sample EXPECT script for deleting PIN while {1} { expect timeout { expect timeout { send_user "\nWARNING: Barcode does not exist.\n" send_user "\nWARNING: Barcode does not exist.\n" exit exit } "Choose one (I,R)*" { } "Choose one (I,R)*" { send_user "\nPIN not set.\n" send_user "\nPIN not set.\n" exit exit } "Choose one*" { } "Choose one*" { send "D" send "D" send_user "\n Remove PIN in progress.\n" send_user "\n Remove PIN in progress.\n" } "Are you sure? (y/n)*" { } "Are you sure? (y/n)*" { send "y" send "y" send_user "\n PIN removed.\n" send_user "\n PIN removed.\n" break break } "Press to continue*" { } "Press to continue*" { send_user "\n WARNING: Patron record in use.\n" send_user "\n WARNING: Patron record in use.\n" exit exit } eof { } eof { send_user "\n WARNING: Cannot delete PIN.\n" send_user "\n WARNING: Cannot delete PIN.\n" exit exit }}

21. The Hong Kong Institute of Education Library 21 2. View circulation record Retrieve the checkout and hold records from the following URLs. - Checked out items http:// /patroninfo/ /items http:// /patroninfo/ /items - Item on hold http:// /patroninfo/ /holds http:// /patroninfo/ /holds Re-format the above pages to fit into the campus “portal” display.

22. The Hong Kong Institute of Education Library 22 Patron circulation records http://<innopac>/patroninfo/<patronid>/items http://<innopac>/patroninfo/<patronid>/holds

23. The Hong Kong Institute of Education Library 23 3. Logon patron record Extract logon identifications from the SSO Connector Redirect to Innopac “View Circulation Record”, i.e. http:// /patroninfo/ POST the web-form automatically to Innopac

24. The Hong Kong Institute of Education Library 24 Patron record integration Click on “Renew Item”, https://[SSO_connector]xurl= https://[server]/InnoAPI/circ_recordrec2.php https://[server]/InnoAPI/circ_recordrec2.php https://[server]/InnoAPI/circ_recordrec2.php SSO_Connector

25. 1 Dec. 2004 The Hong Kong Institute of Education Library 25 Technical Information

26. The Hong Kong Institute of Education Library 26 III PatronAPI (URL) (code: 317URL-I) Local programming required such as SSO Connector and PatronAPI Enhancements –Programming include JAVA, PHP, PERL and EXPECT scripts –MYSQL database, which is used to limit the number of concurrent TELNET connections for EXPECT script

27. The Hong Kong Institute of Education Library 27 Depends mainly on the campus IT infrastructure and the portal technology used

28. 1 Dec. 2004 The Hong Kong Institute of Education Library 28 Future Plan

29. The Hong Kong Institute of Education Library 29 Consider using ready-made SSO standards, but depends on the development trend of the campus portal Consider using Innopac’s External Patron Verification (code: 201LDAP) for LDAP authentication Improve security level of using secure HTTP (https) with PatronAPI, pending for Innopacs’ enhancement

30. The Hong Kong Institute of Education Library 30 Future Plans (Con’t) Integrate with other library services such as BI class registration and library materials online recommendation Utilise MyMillenninum options in supporting WAM access e.g. in wwwoptions, set “no_reverify=wam”

31. The Hong Kong Institute of Education Library 31 Reference From IUG 11, in San Jose, about Portal integration: III and campus pipeline, April, 2003