2.5 Q&A Document NRMA00002301162.docx.pdf

Solicitation Q&A: August 4, 2023

B.1 Architecture, System Updates and Upgrades

a) Be completely cloud-based

Is the expectation that the solution is SaaS based or is the expectation that the solution be deployed in a DevSecOps environment?

RESPONSE: The expectation is that the solution to be deployed will be SaaS-based.

f) Support the ability to connect to local directories/IdPs. (obtain user attributes) What local user directories or IdPs you plan on integrating?

RESPONSE: The NOAA IdP. An internal IdP, it must be used to allow patrons to authenticate into Patron VE/Alma

i) Must be able to provide authentication to major publishers such as AAAS, ACS, Elsevier, SpringerNature, Oxford University Press, Taylor & Francis, and Wiley

What Authentication / Authorization standards do each of these publishers use? We want to ensure that it matches with our capabilities.

RESPONSE: See attached vendor list with authentication support listed. Authentication language reflects what was listed on publisher sites/administration portals. The only exception are the smaller publishers where IP as the only method of authentication listed.

Furthermore, the burden of authorization falls on the application we are soliciting not the publishers. The application must serve as a broker for multiple publishers (service providers).

Does any of these publications use Social Logins such as Google, Twitter or Facebook for authentication?

RESPONSE: N/A. NOAA is not interested in using social logins for authentication.

j) Must be able to provide authentication using standard protocols (SAML 2.0 ,LADP) for vendors/publishers

Do you use protocols outside of WS-FED, SAML 2.0, Open-ID connect RESPONSE: No. In total, the protocols would include SAML 2.0, LDAP, WSFED, OIDC.

Do you use on-prem applications / Cloud-based applications that do not use Standards-based authentication?

RESPONSE: IP authentication for a number of publishers.

When you say LADP, we are assuming LDAP - What Vendor product do you use?

RESPONSE: Correct, LDAPv3 compliant service. NOAA uses an LDAP Directory called META for machine to machine communications and advanced queries.

B.2 Data Security and Access Meet Personal identity verification requirements from FAR 4.1302 and FIPS PUB 201

When you state Personal Identity Verification requirement - Are you referring to Authentication process or Identity Proofing processing?

RESPONSE: We are referring to the authentication process.

B.3 Integration and Extensibility The solution shall seamlessly integrate with the following system(s):

NOAA catalog, Alma/Primo VE NOAA IdP

Can you provide more information on the type of integration required - standards/no-standards based, API Call based?

RESPONSE: The response is broken into two parts

1) NOAA catalog, Alma/Primo VE - REST API for pulling patron data into application

2) NOAA IdP for authenticating patrons, enabling to access e-resources whether by directly clicking on a e-resource link in the Discovery Layer (Primo VE) - SAML 2.0, LDAP, OIDC

C.1.2 System Integration

(a) Offer integration between NOAA catalog, Alma/Primo VE, and authentication

Can you please elaborate on your requirements?

RESPONSE: Enable library staff to authenticate via SSO on the library staff end of the catalog, Alma, to authenticate.

D.1 Web Integration and Customization Supply APIs, widgets, and other embedded code ((HTML, JS, etc.) that generates a proxy URL to licensed resources (journals, ebook, databases

Can you please elaborate on these requirements?

RESPONSE: Use case: Utilize code (HTML, JS, iframe) that can be used to place on a webpage which would allow a user to place a link to a resource NOAA subscribes to. In clicking a button, a new URL is generated that provides a proxied URL to the resource.

This proxy URL can be used by the user to authenticate to the resource.

1. Can you please share the number of accounts you are looking for?

RESPONSE: There are potential 12,000 active total users.

Listed below are the total number of patrons for each location. These numbers are derived for the patrons listed in our catalog, with NOAA-wide being a sum total of all NOAA patrons. Not all patrons are active in the catalog listed below, but there is a possibility that due to the fact that the patron number in the catalog exceeds 12,000 there is potential that the active user count could grow. Likewise, active user count can be recalculated to a lower figure if we see that there are not as many active users as we initially anticipated.

NOAA Central Library: 12,500

AOML: ~750

NOAA-wide: 24,800

2. Can you confirm that the not-to-exceed amount is the max spend per year?

RESPONSE: Yes, those not-to-exceed amounts are the anticipated max spend for the potential additional locations if any are added during the option periods.

publisher publisher link location pp ( information) authenication information page Science https://www.aaas.org/ NOAA-wide y ( y), Google CASA, Shibboleth/OpenAthens p g p g mote-access-current-subscribers

Elsevier https://www.elsevier.com/ NOAA-wide Federated authenication through SAML, IP p cedirect/librarian-resource- Wiley https://onlinelibrary.wiley.com/ NOAA-wide

Institutional Username and Password, p y y y info/resources/access-authentication

BioOne https://bioone.org/ NOAA-wide IP, Shibboleth, EZ Proxy https://bioone.org/library-resources JSTOR https://www.jstor.org/ NOAA-wide

, , g , g Microsoft Azure Single Sign-On (SSO), SAML p pp j g us/articles/115004983547-Access-

American Meteorological society https://www.ametsoc.org/index.cfm/ams/ NOAA-wide IP, Shibboleth adminstration portal Inter-Research https://www.int-res.com/home/ NOAA-wide IP Research adminstration portaly https://acousticalsociety.org/ Library IP p pp provide authenication method beyond IP.

American Chemical Society https://www.acs.org/ Library IP (listed under access heading) p g g y account/

SpringerNature https://www.springernature.com/gp Library

Openathens), Google Scholar CASA and p p g gp ans/tools-services/implement/remote- Oxford University Press https://global.oup.com/?cc=us Library

, y, Referring URLs, Shibboleth & OpenAthens p g p s/access/?cc=us&lang=en&

Taylor & Francis https://taylorandfrancis.com/ LIbrary , y , using an individual login *NEW*, SAML, p p g ns/authentication American Society of Civil Engineers https://www.asce.org/ Library IP p pp provide authenication method beyond IP.

Cambridge University Press Library IP, Shibboleth g

Core adminstration portal Canadian Science Publishing https://cdnsciencepub.com/ Library IP, Trusted Proxy server, Shibboleth Science Publishing adminstration portal Chelonian Research Foundation https://chelonian.org/ Library IP p pp provide authenication method beyond IP.

Clarivate Analytics LLC (Web of Science) p p academic-research/research-discovery-and- LIbrary , p y, , , (Shibboleth) p g https://support.clarivate.com/s/article/We IEEE Service Center LIbrary IP, Athens/Shibboleth p p g p p ministrators-and-librarians/getting-started

National Academy of Sciences https://www.pnas.org/ LIbrary IP, Shibboleth https://www.pnas.org/librarians SAGE Publications Inc https://us.sagepub.com/en-us/nam/home LIbrary p g p us/nam/institutional-subscriptions-to-

University of Chicago Press Journals https://www.journals.uchicago.edu/ LIbrary IP, Shibboleth g

Press Journals adminstration portal University of Wisconsin Press https://uwpress.wisc.edu/index.html LIbrary IP p pp provide authenication method beyond IP.

CSIRO Publishing https://www.publish.csiro.au/ NOAA-wide IP Smaller publisher. Does not appear to provide authenication method beyond IP.

Annual Reviews https://www.annualreviews.org/ NOAA-wide, AOML IP, Shibboleth Gathered information from Annual Reviews adminstration portal

Proquest (EconLit w/Full Text & EAAS) https://www.proquest.com/ NOAA-wide IP, Proxy, Shibboleth, username and password.

https://support.proquest.com/s/article/Pro Quest-Administrator-Module-Overview- Authentication-Access?language=en_US