If you landed here trying to log in to a specific journal, database, or library resource, this page will not do that for you — OpenAthens sign-in is issued per institution, so the login link you need lives on your own library’s website or your publisher’s “institutional login” option. What follows instead is a plain explanation of what OpenAthens actually is, how it differs from two technologies it is routinely confused with — Shibboleth and EZproxy — and how off-campus access works once you understand the distinction.
What OpenAthens Is
OpenAthens is a hosted, commercial identity and access management (IAM) service, currently supplied by Jisc, the UK’s not-for-profit digital and network services body for higher education and research. It grew out of the Athens access-management service, an initiative that traces back to a University of Bath project in the 1990s and was subsequently run by the not-for-profit Eduserv before consolidating under Jisc. Today OpenAthens is used well beyond the UK — by universities, hospitals and health systems (including many NHS organisations), and corporate research libraries worldwide — as a managed alternative to running federated single sign-on infrastructure in-house.
Functionally, OpenAthens does two things that are easy to conflate: it acts as a SAML-based identity provider (the same federated-authentication approach Shibboleth uses), and it can also front resources with proxy-style URL handling similar to EZproxy. That dual capability is precisely why it gets compared to both.
OpenAthens Account vs. Institutional Single Sign-On
Most OpenAthens users never create a separate password at all: their institution has connected its existing directory (Active Directory, LDAP, or a campus SSO system) to OpenAthens as the source of truth, so signing in “via OpenAthens” or “via your institution” just means using the same credentials as email or the library catalogue. The authentication happens at the institution; OpenAthens brokers the resulting assertion out to the publisher.
A standalone OpenAthens account — a username and password created directly with OpenAthens rather than inherited from an institutional directory — exists for cases where that federation isn’t practical: NHS staff without a conventional university-style directory, distance and continuing-education learners, alumni retaining limited access, or smaller organisations that haven’t stood up their own identity provider. Functionally it plays the same role, it’s just that OpenAthens itself, rather than the institution, is the party that verified the credential.
How a Researcher Uses OpenAthens Off-Campus
The everyday experience is the same regardless of which underlying account type is in play: from a publisher’s website, choose “Institutional login,” “Shibboleth login,” or “OpenAthens login” (labelling varies by platform), search for or select your institution, and you’re redirected to sign in with your normal credentials. On success, a signed assertion is passed back confirming your affiliation and entitlements, and the publisher grants access — no VPN, no campus network, no separate remote-access client. This works identically whether the researcher is at home, travelling, or at a conference, which is the entire point of federated access over older IP-recognition methods.
Proxy vs. Federated Identity: The Distinction That Actually Matters
OpenAthens, Shibboleth, and EZproxy solve overlapping-sounding problems — “let a legitimate user reach a licensed resource from off-campus” — through two fundamentally different mechanisms, and mixing them up is the single most common point of confusion for librarians and researchers alike.
- EZproxy (an OCLC product) is a URL-rewriting reverse proxy, not an identity system. The library maintains a configuration list of licensed resource URLs; when an off-campus user authenticates (typically against the same campus directory, or a library barcode/PIN), EZproxy rewrites every outbound link on the page to route back through the proxy server. The publisher never receives any information about who the specific person is — it simply sees a request arriving from an IP address the proxy makes look like it belongs to the campus network, and grants access on that basis, exactly as it would for someone physically on-site.
- Shibboleth is the open-source, self-hosted reference implementation of SAML-based federated authentication, developed and maintained by the Shibboleth Consortium (originally an Internet2 project). An institution runs its own Identity Provider (IdP) software; when a user tries to reach a publisher’s Service Provider (SP), the SP redirects them to their home IdP to authenticate, and the IdP returns a cryptographically signed SAML assertion — not an IP address, an actual statement about who this person is and what they’re entitled to. Because it’s not free hosted infrastructure, it requires an institution’s own IT staff to install, configure, and maintain.
- OpenAthens plays the identity-provider role Shibboleth plays, but as a paid, hosted service rather than self-run software — the institution subscribes rather than deploys its own SAML infrastructure — and it can also apply proxy-style access to resources that haven’t been set up for SAML federation, functioning as a bridge between the older proxy model and full federated identity.
The practical difference a researcher should take away: a proxy (EZproxy, or OpenAthens acting in proxy mode) recognises you by disguising your network location; federated identity (Shibboleth, or OpenAthens acting as a SAML IdP) recognises you by an assertion from your own institution, regardless of network location. The latter is what makes true off-campus, VPN-free access reliable at scale, and it’s the same underlying SAML federation that CASRAI’s guide to SeamlessAccess covers from the discovery-service side — SeamlessAccess doesn’t replace OpenAthens or Shibboleth, it sits on top of federated IdPs like them to make the “which institution are you from” step faster and more consistent across publisher sites.
OpenAthens vs. Shibboleth vs. EZproxy at a Glance
| Dimension | OpenAthens | Shibboleth | EZproxy |
|---|---|---|---|
| Core mechanism | SAML federation, plus optional proxy-style access | SAML federation only | URL-rewriting reverse proxy only |
| Hosting model | Hosted/managed SaaS (Jisc) | Self-hosted, institution-run | Self-hosted, institution-run (OCLC-licensed software) |
| Cost model | Commercial subscription | Free/open-source (staff time and infrastructure to run it) | Commercial license (OCLC) |
| What the publisher sees | A SAML assertion about the user’s affiliation/entitlements | A SAML assertion about the user’s affiliation/entitlements | An IP address that appears to be the institution’s |
| Works reliably off-campus | Yes | Yes | Yes (that’s its specific purpose) |
| Governing/operating body | Jisc | Shibboleth Consortium (originated as an Internet2 project) | OCLC |
Why Publishers Offer OpenAthens Alongside Other Access Routes
Publishers rarely support just one access method, because institutions themselves are split across every option above, often running more than one at once during a migration. A platform that only recognised Shibboleth would lock out every EZproxy-only campus; one that only recognised IP ranges would fail the moment a researcher steps off-network without a VPN. Offering IP recognition, EZproxy compatibility, and SAML federation through OpenAthens or an institution’s own Shibboleth IdP in parallel maximises the odds that any given user’s setup is recognised. Entitlement-checking services like GetFTR and discovery layers like SeamlessAccess sit alongside these authentication routes rather than replacing them — they help a reader find and confirm access faster once one of these underlying methods has established who they are.
The same layered-access problem shows up at national scale, not just per-publisher: consortium-run digital libraries have to reconcile the same mix of proxy and federated methods across every subscribing institution at once. CASRAI’s guide to the HEC Digital Library in Pakistan walks through how that plays out when a national commission, rather than a single university, is the one negotiating and provisioning access.
Frequently Asked Questions
Is OpenAthens the same thing as Shibboleth?
No. Both can perform SAML-based federated authentication, but Shibboleth is free, open-source software an institution runs itself, while OpenAthens is a commercial hosted service from Jisc that also offers proxy-style access as an additional option. An institution can use either, or in some cases both for different resources.
Do I need to create an OpenAthens account?
Only if your organisation doesn’t federate OpenAthens with its own directory. Most university researchers simply use their normal institutional username and password; a standalone OpenAthens account is more common for NHS staff, distance learners, and similar cases without a conventional federated identity provider behind them.
Why does a publisher ask me to log in via OpenAthens instead of through my library’s website?
Both routes usually lead to the same place. Starting from the publisher and choosing “Institutional login” triggers the same SAML redirect to your institution as starting from your library’s proxied link would — it’s a difference in entry point, not in the underlying access mechanism.
Can I access resources through OpenAthens without a VPN?
Yes — that’s the point of federated identity over IP-based recognition. Because access is granted on the basis of a signed assertion from your institution rather than your network location, it works the same way on a home connection, mobile data, or while travelling.
Is OpenAthens free for institutions to use?
No, it’s a paid subscription service, which is the main practical trade-off against Shibboleth: an institution pays Jisc to host and manage the identity-provider infrastructure rather than running open-source Shibboleth software with its own IT staff.
