Assigning Athens permissions sets

WARNING: This page is retained as a historical record but is out-of-date and is not being maintained.

This was a working document belonging to the Computing Service's Shibboleth Development Project. This project is complete (Raven now supports Shibboleth) and this document only remains for historical and reference purposes. Be aware that it is not being maintained and may be misleading if read out of context.

To use the Shib->Athens gateway (which we will have to use if we are going to use Shib as an access route to many electronic resources from October) we have to identify the subset of Raven account holders who can be allowed access by this route. One way to do this is to automatically identify all such people from data already in our possession - the alternative is to manually approve all Athens users but that's somewhat resource intensive.

In an email from February 2006 our Athens Coordinator set out the criteria currently used to issue Athens accounts. The following attempts to evaluate the possibility of performing the same selection automatically based on information already held by the Computing Service. Rows with a green background represent groups that we have a reasonable chance of identifying from data already in our possession.

The conclusion seems to be that we can probably automatically identify Students and University (but not College) staff, but no other groups. We can also recognise clinical students, but not clinical staff. That's useful, in that it probably represents a majority, but begs the question about what we are going to do about everyone else...

The following are given ATHENS authentication

Group	Have Raven?	Selection criteria	Notes
1. University of Cambridge academic staff including short contract research staff 2. University of Cambridge academic related and assistant staff. This includes Cambridge Assessment and CUP.	Mainly Yes, via feed from SECQUS/CHRIS	Jackdaw staff flag - in effect everyone in the staff database	Omits most CA/CUP staff (about 140 CA included, all with titles like 'Manager', 'Group manager' or 'Senior Manager'; much the same for about 100 CUP staff). Omits contract research staff not paid through the University Includes, e.g., some students on bursaries Includes some College Fellows (probably those on the role of the Regent House)
3. Cambridge College research fellows, and college staff with no link to a University department or faculty. Includes library staff and computer officers.	Many, via manual application	Not identifiable	Some College Fellows (probably members of the Regent House) are included in group 1/2 above
4. University of Cambridge registered postgraduate students. Taught and research. Including those placed in "non-university" bodies such as MRC units.	Yes, via feed from CamSIS	Jackdaw student flag based on CamSIS feed
5. University of Cambridge registered undergraduates. 6. University of Cambridge students registered for Master of Studies or equivalent qualification from the Institute of Continuing Education.	Yes, via feed from CamSIS	Jackdaw student flag via feed from CamSIS	May omits some visiting students (Erasmus, Socrates - now apparently replaced by Lifelong Learning Programme 2007-2013)

The following are given ATHENS authentication subject to additional conditions being met

Group	Have Raven?	Selection criteria	Notes
7. Visiting Scholars are given restricted authentication as their account cannot be used outside the cam domain. Requires letter from Department.	Some by manual application	Not identifiable
8. Staff from certain non-University bodies will be given ATHENS authentication if they have affiliated status - NHS consultants should have affiliated lecturer status within Clinical School, Cambridge Theological Foundation institutions staff may have affiliated lecturer status within School of Divinity (but again they may not).	A few who have been granted CS resources for other reasons	Not identifiable	Status of Cambridge Theological Foundation unclear since they now teach no University courses
9. Retired staff are specifically excluded unless they can demonstrate their continued work within the faculty/department with certification from Head of Department.	Many	Not identifiable

The following are not provided University ATHENS authentication

Group	Have Raven?	Criteria	Mismatch
10. Staff from non-University bodies (including those listed in Statutes and Ordinances as "recognised institutions" which are given borrowing rights at the University Library) unless they can demonstrate affiliated staff status as above.	?	?	Unable to identify any potential members of this group
11. NHS staff	No, unless additionally a member of some other category	N/A
12. MRC staff	Yes for a variety of reasons	Not identifiable	Hugely complicated - requires further work
13. Homerton College School of Health Sciences staff and students	No	N/A	This group no-longer exists - the course is now taught, and HSHS Ltd is now owned, by Anglia Ruskin University Group.
14. Cambridge Theological Federation Colleges staff and students.	Yes for staff, no for students	N/A	Situation could change if the agreement between the University and CTF changes
15. Embedded commercial units - Hitachi unit at Cavendish, Unilever at Chemistry.	No, unless additionally a member of some other category	N/A
16. Retired staff. Honorary staff or Fellows.	Many	Not identifiable
17. Cambridge Programme for Industry course participants.	No	N/A

Permission Sets

Group	Criteria	Mismatch
18. The present ATHENS authentication regime has two separate "permission sets" one is the default for all resources, the second includes only clinical staff and students and includes all default services plus clinical only material.	Clinical students (Clin Med, Clin Vet Med on their Clinical (postgrad) course) can (probably, need confirmation) be identified from their CamSIS record. Pre-clinical Vets can also be recognised. Most pre clinical Meds can be recognised	Unable to identify relevant staff Some undergrads will eventually do Clin Med who are not recognisable as doing pre clinical med