Securing Access¶

Here at Altmetric security and privacy are of the utmost importance to us which is why we provide you with various ways to control access to your Explorer for Institutions.

We support the following types of user access/authentication:

IP access: We allow access to your Explorer for Institutions instance only within your office/campus IP ranges. Users can go to altmetric.com/explorer and access the platform as a guest from within these ranges. This guest access is temporary and based on IP recognition alone: it does not, by itself, grant permission to create an account. To unlock additional functionality such as saved searches and email alerts, a user can create a persistent account via the plus sign at the bottom left-hand corner. Account creation is checked separately from IP-based guest access and requires an eligible email address for that instance (typically a whitelisted domain). Being on a recognized guest IP range does not exempt a user from this check. IP access can also be delivered through a proxy server so that your users can reach Explorer from off-campus. See Proxy access below, as this needs a different configuration.
Unique invite link: We generate a unique link you can share with your users to create their own account.
Email address: We allow your users to sign up with their institutional email address, so as an example anyone with an @altmetric.com email would be able to create their own profile in the Explorer for Institutions.
Single sign-on: Altmetric supports SAML2 based authentication (OpenAthens, AD-FS, Azure, Shibboleth etc), and we're a member of the UK Federation and Surfconext. If your institution uses SAML2 based authentication we can work with your team to implement federated access to the Explorer. When SSO is enabled, users are redirected to your IdP (Identity Provider) for authentication. This means your members can use their institutional credentials to login to Explorer for Institutions and you control who has access to your instance.

Note

There is an additional fee for enabling SSO. If this isn't already part of your contract or if you are interested adding SSO please contact your Account Manager to discuss.

Proxy access¶

Rather than allowlisting your office/campus IP ranges directly, IP access can be provided through a proxy server such as EZproxy or OpenAthens. Your users authenticate with the proxy, the proxy forwards their traffic to Explorer for Institutions, and they get the same guest access they would have on campus, but from anywhere.

This is configured differently to direct IP access, and it needs input from both sides:

On our side, we allowlist the public IP address(es) your proxy sends traffic from. These are usually not the same as your campus ranges.
On your side, your proxy needs a configuration entry for Explorer for Institutions.

To get started, please send the following to your onboarding contact or to support@altmetric.com:

Which proxy software you use (EZproxy, OpenAthens, or another product).
The public outbound IP address(es), or CIDR range, of your proxy servers.
Whether the proxy is hosted by you or by a third party.

Note

Proxy access is a form of IP access, so it grants guest access in the same way a campus IP range does. It is not a substitute for SSO. If you need your users to be identified by your own IdP, see Single Sign-On below.

EZproxy¶

Add the following database definition to your EZproxy config.txt:

T Altmetric Explorer for Institutions
HTTPHeader -process -request Origin
HTTPHeader -process -request X-CSRF-Token
U https://www.altmetric.com/explorer
HJ www.altmetric.com
HJ www.altmetricexplorer.com
HJ https://www.altmetric.com
HJ https://www.altmetricexplorer.com
DJ altmetric.com
DJ altmetricexplorer.com

Your starting point URL should then look something like https://ezproxy.myinstitution.edu/login?url=https://www.altmetric.com/explorer.

OpenAthens¶

OpenAthens can be used as a proxy as well as an SSO identity provider, and the two are set up separately. If you are using the OpenAthens proxy, your users' traffic reaches us from OpenAthens' shared regional proxy servers (proxy.openathens.net, eu1.proxy.openathens.net, us1.proxy.openathens.net, ap1.proxy.openathens.net, ap2.proxy.openathens.net) rather than from an address of your own.

Tell us if you are using a proxy

Traffic arriving from a shared proxy address can be challenged or blocked by the bot protection that sits in front of altmetric.com, because many institutions' requests appear to come from the same small set of IPs. When this happens, users see a Cloudflare security verification page, a CAPTCHA, or an "unable to connect" error instead of Explorer.

This is not something you can fix on the proxy side. We need to add your proxy's IP addresses to an allowlist. Please flag your proxy setup to support@altmetric.com when access is being configured, ideally before your users start using it, so we can raise the request internally and get it in place up front. This applies to EZproxy and other proxies too, but it comes up most often with OpenAthens.

Single Sign-On¶

In order to set up SSO you'll need to provide Altmetric with a technical contact who will be able to answer questions about the university's IdP (Identity Provider).

UK and Rest of World (excl. Netherlands)¶

Metadata

Our production metadata can be found within the UK Access Federation or alternatively available here: https://www.altmetric.com/explorer/shibboleth/metadata.xml.

If your organization is not a member or you would prefer to provide us with a direct link to your metadata instead, this is also supported.

Attributes

In order for users to be able to login successfully, your IdP needs to release at least one attribute we can identify them by. We currently accept any of the names below, so you do not need to change how your IdP is configured if it already releases one of them.

Attribute	Names we accept
`eduPersonPrincipalName`	`urn:oid:1.3.6.1.4.1.5923.1.1.1.6` (SAML 2) `urn:mace:dir:attribute-def:eduPersonPrincipalName` (SAML 1)
Email address	`urn:oid:0.9.2342.19200300.100.1.3` (SAML 2) `urn:mace:dir:attribute-def:mail` (SAML 1) `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` (AD FS and Azure) `emailAddress` (legacy Athens/Eduserv name, still used by some OpenAthens IdPs)

We match on the attribute name as it is sent in the assertion, not on its friendly name, so an attribute released under a name that is not in this list will not be seen even though your IdP reports it as released.

If your assertion includes more than one of these, we read them in the order above, eduPersonPrincipalName first and the email names after it, and the first value we find becomes the identifier the user's account is keyed on. If you would rather we key accounts on a specific attribute, please tell your onboarding contact before your users start signing in: changing it later means existing users are treated as new accounts and lose their saved searches, reports and permissions.

Note

Accounts require a valid email address so that they can receive opt-in digest/notification emails from the system. If the eduPersonPrincipalName is not a valid email address and can't be used to receive email (i.e. is purely a scoped identifier) then you will need to either:

Additionally release one of the email attributes above, or
Switch to using just an email attribute

Where an email attribute is released alongside the eduPersonPrincipalName the eduPersonPrincipalName can be used as the account identifier but the user will receive their digest emails via the value associated with the email attribute.

Surfconext¶

Adding SSO provided by Surfconext is really simple, all you'll need to do is have your technical contact reach out to [email protected] and let them know that you'd like to add the Altmetric Explorer service and we'll do the rest.