Setting Up JSTOR Access

Our most common and secure method of access is IP authentication. When a user is authenticated by IP address, he is automatically recognized as an authorized user from your institution, making for a seamless experience.

IP Updates

To set up IP authentication for your institution, you will need to provide JSTOR Support with a list of the IP addresses that your institution uses to access electronic resources.

Please note that addresses of the type 10.*.*.* and 192.168.*.* are reserved for use in internal networks, such as computers that are behind a firewall or a proxy server. In order for our servers to recognize users at such addresses, we would need to add your external IP addresses to our records, which we will be happy to do, provided that these are static addresses and not shared with any other organizations.

Whenever your institution makes any changes to the IP addresses it uses to access JSTOR, you can submit these updates to JSTOR Support via email or phone call.

All participating institutions have the option of setting up remote access to JSTOR for their users along with onsite access. The remote access methods we can support are described below. Please contact JSTOR Support for assistance selecting and setting up the remote access method best fit for your institution.

Proxies

You are welcome to allow users to access JSTOR via a proxy server, so long as access to the proxy server is restricted to authorized users at your institution. Read more information about proxy servers, and our policies regarding them.

On our end, the only configuration necessary would be to ensure that the IP address for your proxy is enabled to access JSTOR. In order to enable a proxy server for your institution, please submit this IP address to JSTOR Support.

EZProxy

In order to enable your JSTOR access via EZProxy, all we typically need from you is the IP address of your EZProxy server. Feel free to send it to JSTOR Support and we will make the necessary changes.

OCLC's support team should be able to help you with your EZProxy set-up, however the configuration we typically recommend for JSTOR access is as follows:

1. The JSTOR database definition should be:

Option DomainCookieOnly

Title JSTOR

URL http://www.jstor.org/

Domain jstor.org

Option Cookie

2. In addition, EZProxy must be explicitly configured to handle https. If https handling is not already set up, users will lose proxying when they arrive at the JSTOR login page, and the connection will be lost. If this is the case, SSL configuration must be performed using the information available on the following page.

If you have any questions about this, please contact JSTOR Support for assistance.

Athens

Athens is a federated login service used by many institutions developed by Eduserv, which you may read more about on the Eduserv website. JSTOR partners with Athens-enabled institutions to allow users to access JSTOR by signing in through their institution from the JSTOR website. In order for an institution or organization to access JSTOR through Athens, the JSTOR resource must be allocated to the institution. To enable Athens access, please contact JSTOR Support requesting Athens as your access method.

JSTOR Support will then request that Athens allocate the JSTOR resource to your institution. Once Athens has done so, it will notify your Athens site representative, who must then grant access to the JSTOR resource for your users.

Shibboleth

Shibboleth is open source software that provides institutions with Single SignOn, a system of authentication procedures, protocols, and technologies that enable end users to access multiple online resources with one set of credentials. The Shibboleth system allows organizations to exchange information about users securely and privately. More detailed information may be found on the Shibboleth website.

JSTOR partners with Shibboleth-enabled institutions to allow users to access JSTOR by signing in through their institution from the JSTOR website. However, in order for an institution or organization to access JSTOR through Shibboleth, JSTOR and the organization must be a member of the same federation. A list of federations may be found on the Shibboleth Federations website.

If you would like to enable access to JSTOR through your institutional log in, please send a message to JSTOR Support that includes the following information:

Which federation (or federations) your institution is a member of
Your institution's Shibboleth Identity Provider ID
The list of campuses (if more than one) the Identity Provider serves

Once this information is in our records, your Attribute Authority can authorize users into JSTOR by asserting the eduperson entitlement attribute with a value of urn:mace:dir:entitlement:common-lib-terms.

Shared Activation Links

A shared activation link is ideal for small institutions and those with limited technical infrastructure or IT resources. Shared activation links will enable individual users to access JSTOR and register for a MyJSTOR account. Once a user has followed the activation link and registered for a MyJSTOR account, she will be able to use the username and password of his choice to access JSTOR in the future. You would be free to disseminate the provided link to authorized users at your institution with the understanding that it would be for their exclusive use. If you maintain a password protected site, this would be an acceptable location to publicize the JSTOR Shared Access Token information. However, please note that the token URL must not be posted on public web pages, where it might become available to unauthorized users.

Read more about shared activation links. Any questions you have about this process or requests to implement it for your institution may be directed to JSTOR Support.

Other Methods

Sometimes none of these remote access solutions will work for your institution, and we do offer several other access options when necessary. If this is the case, we encourage you to contact JSTOR Support with the details of your situation. JSTOR Support will be able to select one of these alternative options for you and walk you through the process of setting up access.

JSTOR’s Institution Finder assists unauthenticated users at your institution to access full-text content on JSTOR. Here's how it works:

A user arrives on a JSTOR article page from a Google search or other referring page
An on-campus user will get automatic access to the full-text, but users outside of the institution’s IP range will be denied access
When denied access to the full-text, the user is presented with options for accessing JSTOR, including a link to the JSTOR login page and the Institution Finder
From there she can search for their institution and follow a link to your proxy login page
After logging in, she is authenticated to JSTOR and will be automatically redirected to the original full-text article

If you are interested in this functionality for your library, we need only to confirm your EZProxy prefix, which should look something like this:

http://server.university.edu/login?url=

You can send this information to JSTOR Support.

The section covers the system requirements and backstage technical aspects of JSTOR use. If you have any questions, please contact JSTOR Support.

Printing from JSTOR

JSTOR uses high-resolution images to store, display, and print faithful replications of the pages that make up the complete published record of the journals in its archive. Although there are many advantages to using images, one of the effects is that it is not possible to print out articles simply by using the "Print" button in an internet browser. JSTOR provides a PDF version of articles for printing and downloading. This requires the use of software such as Adobe Acrobat Reader, which may be freely downloaded from the Adobe website. After selecting the PDF option within the JSTOR interface, an article will be displayed within the PDF reader. Acrobat menu commands then should be used to print and download the article

Shibboleth Authentication and JSTOR

Shibboleth is open source software that provides institutions with Single SignOn, a system of authentication procedures, protocols, and technologies that enable end users to access multiple online resources with one set of credentials. The Shibboleth system allows organizations to exchange information about users in a secure and privacy-preserving manner. More detailed information can be found on the Shibboleth website.

JSTOR partners with Shibboleth-enabled institutions to allow users to access JSTOR by signing in through their institution from the JSTOR website. However, in order for an institution or organization to access JSTOR through Shibboleth, JSTOR and the organization must be a member of the same federation. A list of federations can be found on the Shibboleth Federations website.

If you would like to enable access to JSTOR through your institutional log in, please send a message to JSTOR Support including the following information:

Which federation (or federations) your institution is a member of
Your institution's Shibboleth Identity Provider ID
The list of campuses (if more than one) the Identity Provider serves

Remote Access Authentication and JSTOR

The JSTOR remote logon script can be used by participating institutions to enable access to JSTOR for off-campus and remote users. This scheme requires that a campus be able to authenticate users for access to a CGI script running on a web server. The script will obtain a JSTOR "ticket," which permits an authorized user's browser to use JSTOR for up to 4 hours.

We have two versions of the script available. We developed the first version of the script as a convenience for those already using the OCLC WebScript application for FirstSearch logon. The second version of the script is written in perl. Requirements and installation instructions for each version are included below. The actual script will be sent upon request.

Important: You will be responsible for determining that a user is authorized to use JSTOR before allowing them to run either of these scripts. The method that you use to do this is up to you, although we request that you share with us a description of the approach you have taken.

As stated in the JSTOR Library License Agreement, Authorized Users means persons who are authorized to use Licensee's library facilities who are affiliated with Licensee as students, faculty or staff. Before you implement the logon script, please be aware that you are responsible for providing an authentication method that will ensure that only Authorized Users will be allowed access to JSTOR.

We realize that in addition to Authorized Users, colleges and universities often seek to serve a broader audience, including alumni, friends, spouses, and associated enterprises. The Library Agreement specifically does not grant remote access to this extended community, and the authorization scheme that you use in conjunction with the logon script must not permit access to anyone other than authorized users.

If you would like to know more about the JSTOR remote logon script, please email techsupport@jstor.org.

The WebScript Logon Script

Requirements:

The WebScript logon script has the following requirements:

1. The script must be run as a "CGI" application on a web server for which access can be limited to authorized users. This necessitates a local UNIX HTTP or Windows IIS server that complies with Common Gateway Interface (CGI) 1.1

2. You will need OCLC's WebScript program. For more general information, see http://www.oclc.org/firstsearch/documentation/auto_logon.htm. The webscript program is available at http://www.oclc.org/firstsearch/documentation/auto_logon.htm#pkg. You will need to download and install the appropriate binary for your platform. Notice that for IIS servers, the Cygnus.DLL is also necessary. For servers running IIS, these files should be installed in \inetpub\scripts.

Please also note that the OCLC WebScript program is owned and has been developed by OCLC. Although it is available as "freeware," it is subject to the terms set forth at http://www5.oclc.org/downloads/software/webscript/webscript-2.0/LICENSE. JSTOR is not responsible for the OCLC WebScript program.

3. You must send JSTOR the IP address of the machine on which you will be running the script. The script will not be able to gain access to JSTOR until the IP address has been added to an authorization file on our servers.

Installation Instructions:

1. Edit the first line of the script to use your installed WebScript binary. For UNIX servers, change the line

#! /usr/local/Webscript

to reflect which directory the Webscript program is in on the server. For IIS servers, it should read something like this:

#!c:\inetpub\scripts\webscript.exe

You may also wish to modify the error messages in the script (for example, to include an e-mail link to a local support address).

2. Place the script in a protected directory. This might be your /cgi-bin directory. For IIS servers, the script should be placed in \inetpub\scripts. Please note: "Protected" in this context means that the user must authenticate himself or herself to your server before he or she can obtain access to the script. Simply "hiding" the URL on a protected HTML page is not sufficient — access to the script itself must be protected.

3. To test the installation, use a host that is not normally authorized for access to JSTOR. Set the preferences for the browser to warn you about "cookies" so that you will know when a cookie is being sent to your machine. After you authenticate yourself to your local system, link to the script. You should shortly be prompted to accept a cookie from JSTOR. After you do so, you will be directed to the JSTOR "home" page, and should be able to use JSTOR normally.

The Perl Logon Script for Libraries

Requirements:

2. You will need Perl version 5 with the LWP (libwww-perl) and CGI (CGI.pm) packages installed.

The script is known to work with LWP version 5.65. (It has also been tested with some, but not all, previous versions.) LWP is available from the CPAN archive in the directory: http://www.cpan.org/modules/by-module/LWP/. Look for files named libwww-perl-#.##.tar.gz. LWP requires several other modules; these will be listed in the corresponding libwww-perl-#.##.readme file.

The script is also known to work with CGI.pm version 2.81. (It has also been tested with some, but not all, previous versions.)This package is often included as part of the perl distribution. It can also be found at http://www.cpan.org/modules/by-module/CGI/. Look for files named CGI.pm-#.##.tar.gz.

Please see http://www.cpan.org/modules/INSTALL.html for detailed instructions on how to install these packages.

A prebuilt perl for several platforms, including Windows NT and 2000 is available from http://www.activestate.com/Products/ActivePerl/. This installation incorporates the LWP package, so it is not necessary to download it separately.

3. You must send to us the IP address of the machine on which you will be running the script. The script will not be able to gain access to JSTOR until the IP address has been added to an authorization file on our servers.

Installation instructions:

1. On Unix, edit the first line of the script to use your installed perl binary. For Windows, see http://aspn.activestate.com/ASPN/docs/ActivePerl-5.6/faq/Windows/ActivePerl-Winfaq6.html to configure IIS to use perl.

2. We require that you provide to us a distinct identifier for each individual user. This identifier need not be permanently associated with the user, but should be sufficient to identify which of your users was using JSTOR during a particular session. This enables us to provide better service to your users, and also to help identify users who fail to comply with the JSTOR terms and conditions of use. Possible values for this identifier include the following:

The IP address of the user's computer, as seen by your server. To use this identifier, make sure $userFromIP = 1;

The ID by which the user is known to your system. This ID should be provided to our script as the value of the "user" query parameter. In this case, the URL to invoke our script would look something like this: /cgi-bin/protected/jstor-logon?user=AUSERID where AUSERID would be the user's ID. The parameter name ("user") may be changed by modifying the line $userParm = "user"; replacing "user" with the parameter name that you wish to use. For example, if your URLs already include the user ID in the "id" parameter, then you could change this line to read $userParm = "id";

Any other value that is unique to the user at the time a session is established can be used as the value of the "user" parameter, as above. This value should be composed only of ASCII alphanumeric characters (A-Z, a-z, 0-9) plus hyphen.

3. Place the script in a protected "cgi-bin" directory with the name you wish to give it. "Protected" in this context means that the user must authenticate himself or herself to your server before he or she can obtain access to the script. Simply "hiding" the URL on a protected HTML page is not sufficient, access to the script itself must be protected.

4. To test the installation (after we've received your IP), use a host that is not normally authorized for access to JSTOR. Set the preferences for the browser to warn you about "cookies" so that you will know that the script is working. After you authenticate yourself to your local system, link to the script. You should shortly be prompted to accept a cookie from JSTOR. After you do so, you will be directed to the JSTOR "start" page, and should be able to use JSTOR normally.

JSTOR's Use of Cookies

JSTOR employs "cookie" technology. A cookie is a small piece of text, which is stored on your computer and which acts as a tool for controlling certain system variables in the WWW environment. JSTOR uses cookies for various functions including the maintenance of information that will improve the performance of the system or benefit users in some way.

Different cookies serve different purposes. While some cookies are used to control basic functions of the site, some cookies store basic user information in certain ways. For instance, the “Remember Me” function on the site that allows a user to choose to have login information saved requires the use of a cookie. You can reject this cookie by refraining from checking the box next to the “Remember Me” prompt on the login page. If you do consent to this cookie, it expires automatically after thirty days. In connection with improving the search function on our site, JSTOR uses a cookie that contains information regarding the institution that the user has authenticated through (if the user is affiliated with and accessing JSTOR through an institution) but the cookie does not identify the individual user. JSTOR also uses certain cookies to collect information about how users interact with the site. This information is used to compile reports to help JSTOR improve the site. The information collected by cookies for these types of analytic purposes is in an anonymous form. This information collected includes the number of visitors to the site, where the visitors have come from and what pages the users visit on the site but does not include users’ personal information.

Some cookies that are essential to your use of the site have already been set. You may delete and block all cookies from the site, but parts of the site will not work without cookies. Any personal information, other than what is voluntarily submitted, is not extracted through the use of cookies.

System Requirements

The following hardware and software is required or recommended in order to access the Archive. These requirements and recommendations are subject to change by JSTOR as computer hardware and software technology evolves.

Minimum Requirements:

•    Internet connectivity
•    Graphical web browser
•    Macintosh, PC or UNIX workstations with TCP/IP installed
•    Direct parallel or LAN-attached printer

Recommendations for Optimal Performance:

•    Internet connectivity with at least 1.5 Mbit/s data transfer capacity
•    Monitor with resolution of at least 800x600
•    The platform has been tested on the following browsers:
            IE 6, IE 7, IE 8, Firefox 3, Firefox 3.6, Safari 4, and Chrome.
•    PostScript Level 2 printers offer highest speed printing when this option is selected.
•    At least 12 MB of free temporary disk space for downloading and printing articles
•    Printer memory: 4 MB of memory is recommended for 600 dpi laser printers; memory requirements for other printer configurations may vary