Patrons are reporting problems logging into EZproxy with CUNY Login credentials. How can they get remote access to e-resources?
The error the patron sees dictates what steps need to be taken to resolve the problem.
Note
While the term "CUNY Login" refers to a single set of credentials, there are actually two different identity management systems in use: Oracle Identity Management (OIM) and Shibboleth. The former is used for Blackboard and CUNYfirst. The latter is used for EZproxy, Microsoft Office, Zoom, etc.
Authentication Error
Error (in CUNY Login): The username or password you entered was incorrect.
Solution: If a user says they are able to log into CUNYfirst or Blackboard but they get error messages at the CUNY Login authentication page, they need to reset their CUNY Login password at https://managelogin.cuny.edu
Why this works: Information between OIM and Shibboleth is supposed to be kept in sync. However, that process is not foolproof and resetting the CUNY Login password triggers the synchronization process.
Authorization Error
Error (in EZproxy): Unauthorized - Access to [campus] library resources is limited to active [campus] students and active & retired [campus] employees.
Solution: The patron's attributes in Shibboleth indicate that they have an inactive status at that campus. OLS is not able to resolve this matter and the user must open a ticket with the local help desk to ensure their status is accurately represented in CUNYfirst.
- If they are listed as “not active” (applied, dismissed, canceled, terminated, etc.) at the college, they either rightfully do not have access to the campus library’s resources (EZproxy only allows active users access to licensed resources) or they need to have that status adjusted by the campus to gain/restore access to the library's resources.
- However, if they are listed as “active” at the campus in CUNYfirst but they still get an unauthorized error in EZproxy, the campus help desk needs to trigger an XML sync message:
Instructions
How to trigger an XML message so that the ISM records sync up and a user has access:
- Changing an employee’s Business Email with Personal Info => Modify a Person successfully sends an XML
- Changing an employee’s Gender with Personal Info => Modify a Person successfully sends an XML
- Changing a student’s Campus Email in Campus Community successfully sends an XML => Ask student to update campus email
- Changing a student’s Gender with Personal Info => Modify a Person successfully sends an XML
Source: Email from CIS's Anna Finn, Manager of Client Support Services, to campus help desk managers (April 2021).
If the help desk has triggered an XML sync message but the patron continues to have problems accessing the library's resources, the campus help desk must open a CRM case with the Central Office help desk. The case will be assigned to the Identity & Access Management team, who will provide additional support.
Why this works: EZproxy determines who has access to the local resources based on the patron's attributes in CUNYfirst. (They must be an active student or employee, or have one of a handful of other statuses, at the college.) Information between CUNYfirst/OIM and Shibboleth is supposed to be kept in sync. However, that process is not foolproof and only operators on a campus are able to look up and modify users' attributes.
Please do not open a ticket with the central Office of Library Services. This only delays the process and puts the patron into the middle of a communication exchange that they do not need to be a part of.