EZproxy

EZproxy
Name	EZproxy
Developer	OCLC
Initial release	1999
Latest release	2024
Operating system	Unix-like, Windows
License	Proprietary

EZproxy EZproxy is a commercial proxy server product designed to provide remote access to web-based licensed resources for libraries and consortiums. It enables institutions to authenticate remote users and grant access to subscription databases, e-journals, and digital collections, bridging campus networks and vendor platforms. The software is widely used by academic, public, and special libraries to integrate authentication systems with vendor holdings from major publishers and aggregators.

Overview

EZproxy functions as an HTTP proxy that rewrites URLs and manages session state between end users and content providers such as Elsevier, Wiley-Blackwell, ProQuest, EBSCO Information Services, and JSTOR. By pairing with institutional identity providers like Shibboleth, LDAP, CAS (Central Authentication Service), and commercial single sign-on systems such as Okta and Microsoft Azure Active Directory, it maps authenticated users to IP ranges recognized by content vendors. Libraries implement EZproxy to support consortial licensing models used by organizations including the Council of Australian University Librarians, the Association of Research Libraries, and national library networks.

History and Development

EZproxy was created in the late 1990s to address remote access challenges faced by academic libraries when vendors relied on IP authentication tied to campus networks. Early adopters included institutions participating in projects led by the Internet2 community and regional service providers like California Digital Library. The product evolved alongside federated identity initiatives such as InCommon and the Shibboleth Consortium, and it has been acquired and maintained by vendors handling library services, culminating in stewardship by OCLC in the 2010s. Over successive releases the software incorporated support for HTTPS, SAML integrations, and compatibility with virtualization platforms from VMware and cloud services from Amazon Web Services and Microsoft Azure.

Architecture and Features

EZproxy's architecture centers on a lightweight request-rewriting engine and a configurable host database that contains resource-specific rules for providers including Springer Nature, Taylor & Francis, and SAGE Publications. The core components include a license file, a conf file, and a set of stanza definitions that control URL normalization, cookie handling, and header manipulation. Features added across versions include support for multi-factor authentication integrations with providers like Duo Security, logging and analytics compatible with Splunk and ELK Stack, and load-balancing setups compatible with HAProxy and NGINX. It also supports proxy chaining and reverse proxy configurations commonly deployed alongside Content Delivery Network services run by Cloudflare and Akamai.

Deployment and Configuration

Deployments range from on-premises servers on distributions like Red Hat Enterprise Linux and Ubuntu to containerized instances managed by orchestration tools such as Kubernetes and Docker. Administrators edit configuration stanzas to handle idiosyncratic URL patterns from vendors including SAGE Journals, Oxford University Press, and Cambridge University Press. Typical workflows involve collaboration with consortium technical staff from groups such as EDUCAUSE and national research and education networks like JANET and HEAnet to establish proxy hostnames, TLS certificates from certificate authorities like Let's Encrypt or DigiCert, and monitoring via Nagios or Zabbix.

Authentication and Access Control

EZproxy interfaces with identity infrastructure standards such as SAML 2.0, OpenID Connect, and legacy protocols implemented by campus directories like Active Directory and Novell eDirectory. Libraries commonly configure rules to honor authorization attributes (e.g., group memberships) provisioned by identity providers, enabling differentiated access for faculty, students, alumni, and consortial patrons. Integration patterns often reference federation operators such as eduGAIN and access management platforms like Shibboleth and commercial vendors including Ping Identity.

Security and Privacy Considerations

Administrators must consider TLS configuration, certificate lifecycle management, and secure header handling to mitigate risks highlighted in advisories from vendors and security communities such as CERT Coordination Center and US-CERT. Privacy considerations involve logging retention, IP address handling, and compliance with data protection regimes such as the General Data Protection Regulation and national privacy laws. Operational security best practices include regular patching aligned with advisories from National Institute of Standards and Technology publications, intrusion detection using tools like Snort, and periodic audits consistent with frameworks like ISO/IEC 27001.

Usage and Reception

EZproxy is widely adopted by academic consortia, national libraries, and public library systems, with case studies from institutions such as University of California, University of Oxford, University of Melbourne, and state library systems demonstrating simplified remote access management. Reviews and conference presentations at venues like the American Library Association meetings and the Charleston Conference discuss trade-offs versus federated access approaches and cloud-based proxy alternatives. While praised for its pragmatic handling of legacy vendor behaviors, it has also drawn commentary about the administrative burden of maintaining stanzas for evolving publisher URL schemes and the shift toward native Open Access and federated architectures.

Category:Library software Category:Proxy servers Category:OCLC products