IP access and subscription-only website for scientific journals...ideas sought

[recordap]

I am coming back to Joomla and I really need the help of the community to determine if Joomla is the platform for digital publishing, and what extensions will help me achieve the goal. I am trying to see if the project can easily and quickly be done in Joomla without extensive programming.

I manage several subscription-only, scientific journals that publish a wide range of materials (articles, reviews, interviews, audio, video, curated exhibition, gallery, etc). I want to create a website that is responsive, user and mobile friendly. The website will feature all our publications on the website. The idea is that anyone can register as a user, subscribe (pay for subscription), pay to view or download an article, and finally read/view/listen to the subscription content on the website. While we will have some sample content that will be free forever, the majority of the content will be available by subscription. As such, only paid users should be able to see it, and search engines can see snippet of the content if using Intro Text.

The second thing is we need to accept submissions. We need a way for people to submit their papers to us via the website (membership is NOT required to submit a paper). Sometimes, a submission will include additional files or images. We would like to store all the submission somewhere where it can easily be accessed by the editors. We also want to scan all user-submitted files for virus, as well as check it for plagiarism.

Third, we want the website to be available to educational institutions for paid subscription. Institutional access is usually by IP access or recognition. Institutions require IP access because for them it is not possible to create an account for each student and faculty on the journal website given their large size. So, when institutions subscribe, they provide me with their IP address, which should be entered on the website (not sure how this will work in Joomla as there is no IP access extension in JED, but in general, the idea is that the journal website should be configured in a way that students and faculty that are on the institution's network can access subscription content on the journal website without a login and a user account.

And finally, we need a way to secure the content, which includes articles, video, audio, and so on. Can a subscription extension do this? Or do you require a dedicated extension to restrict access to content?

Summary of what I am looking to do (will be updating):

• - Set up a membership website for scientific journals (responsive, user and mobile friendly).
  - Allow users to register on the website, and get a paid subscription (need PayPal and Stripe)
  - Allow users to submit their paper for consideration (paper will be automatically scanned for virus and plagiarism)
  - Allow only paid users access to subscription content (premium content is just for members)
  - Offer free content on the website (will always be free)
  - Secure content on the website
  - A place on the website for audios and videos, for extended commentary on published items as well as for preview of items that will be published (this will be from the editor and the users)

What Joomla extensions will work best? What extensions do you recommend?

I eagerly await!

[andypooz]

- Set up a membership website for scientific journals (responsive, user and mobile friendly).

Responsive sites are simply sites with a responsive template (and arranged in a manner with some thought/testing of mobile access. Joomla is well-eqipped to do this for you, and most new templates are responsive.

- Allow users to register on the website, and get a paid subscription (need PayPal and Stripe)

There are several good subscription components. I use membership Pro. It's highly configurable and has plugins for paypal and stripe.

- Allow users to submit their paper for consideration (paper will be automatically scanned for virus and plagiarism)

There are plenty of upload components, but integrated virus-scanning you'll need to look further into. Plagiarism is another interesting one- I doubt you'll find such an extension, but the solution I'm sure sure could be quite inventive.

- Allow only paid users access to subscription content (premium content is just for members)

This can be easily achieved through Joomla default UAC measures- no plugins required, just configure access control as required

- Offer free content on the website (will always be free)

Yeah, this is what Joomla does

- Secure content on the website

I think you mean that media and article content cannot be obtained subversively bypassing the site. This is where you'll need to lock down .htaccess for folders where these goodies are stored. You can use database symlinks instead of direct directory links too.

- A place on the website for audios and videos, for extended commentary on published items as well as for preview of items that will be published (this will be from the editor and the users)

Yeah, it sounds like the kind of thing that could be achieved through normal articles and categories in the front end, with permissions applied accordingly.

Joomla is as good a fit for this project as any other web solution. There are extensions which will help, but as I'm sure you've guessed, there's going to be a lot of configuring things to fit your goals and inevitably, a bit of custom coding to get things working together. The problem with having a site using 100 different extensions to achieve different functions is that if you're not careful, it starts to look like 100 different sites all mashed into one.

Sounds like an interesting project, so good luck!

[recordap]

Hi Andy,

Thanks for your feedback.

I am unaware of websites that use Joomla for scientific journals, but that is not to say it cannot be done. The goal is not to be bogged down with extensions. The only thing I have not seen is how to implement an IP access in Joomla for institutions. I do not see any extensions that does that. The IP access thing is really needed for institutions. In addition, institution also want to know their usage statistics, that is how many people come from the journal website to their university website.

I am looking for an extension that can handle IP access and restrict access based on IP address. I have not see any plugin that does this in Joomla yet.

Does the default Joomla UAC (user account control) restrict access to content?

Can the default Joomla UAC allow access based on IP address?

I mean that if an article, video, pictures, and audio is available by subscription, only paid members should be able to access it. In other words, people that are not subscribers should not be able to access premium content. Search engine and everyone in general should be able to see an intro text.

Is there a page that explains Joomla current permission system and it?

Will you be able to act as a technical resource?

I would be so happy.

[sozzled]

To be totally honest with you, I would suggest that you dismiss the idea of an IP addressed-based access scheme for several reasons. The main reason is that people's IP addresses continually change (and therefore, such a scheme would be quite unreliable). Another reason to dismiss that approach is that it's not easy to implement such a mechanism on any website (in fact, I've never seen it done anywhere before).

The best approach is to have your users validate their account by logging in. Joomla uses a very good login mechanism and, combined with ACL protection, you can limit access to your site contents—in your case, scientific journals. There are a number of subcription extensions located in the JED and I suggest that you browse among those for something that suits your need.

I hope this helps.

[andypooz]

The only thing I have not seen is how to implement an IP access in Joomla for institutions. I do not see any extensions that does that. The IP access thing is really needed for institutions. In addition, institution also want to know their usage statistics, that is how many people come from the journal website to their university website.I am looking for an extension that can handle IP access and restrict access based on IP address. I have not see any plugin that does this in Joomla yet.

I think what you use is groups, with a joomla user group being created for every institution. There are probably some usage statistics extensions out there, but this part i think will require some custom coding to fit the niche. I think IP-based access could only be used in conjunction with the Joomla login system. As sozzled says, IP isn't a reliable way to determine proper access- only a username and password can do this. Most institutions would have a static IP (or two or more) which could be used for additional locking down, but that would mean that staff wouldn't be able to access resources from home, etc.

Does the default Joomla UAC (user account control) restrict access to content?

Yes, this is part of the core- no additional plugins required, just careful configuration

Can the default Joomla UAC allow access based on IP address?

No, this isn't something that Joomla does out of the box. It's easy enough to get a user's IP (or that of the proxt they're using) and implement this into a user plugin though. But as I've said, this isn't reliable as a sole means of authentication.

I mean that if an article, video, pictures, and audio is available by subscription, only paid members should be able to access it. In other words, people that are not subscribers should not be able to access premium content. Search engine and everyone in general should be able to see an intro text.

Yes, this is all possible with the core joomla UAC

Is there a page that explains Joomla current permission system and it?

Try this: https://docs.joomla.org/J3.x:Access_Con ... t_Tutorial

Will you be able to act as a technical resource?

I'm a Joomla developer. I'm happy to point people in the right direction here in the forum, but for anything more involved we'd have to reach an agreement. It sounds like a very interesting project.

[DorsetJoomla]

This takes me back to the mid 90's when I was working for a large IT company and we were talking to all of the big publishers of STEM journals (Elsevier, Blackwells, Academic Press, Wiley, etc etc) about just this issue and to be honest I thought it was all done and dusted by now. The big issues were about connecting to things like the UK JANET network (and similar in the USA)institutional subscriptions (and even how much to charge), access etc. That was 20 years ago, are you sure that this hasn't all been done by now?

[andypooz]

What is all done and dusted? Specifics please.
Are you referring to the rort that is the academic journal subscription industry? In this open source, freedom-of-information society we supposedly live in, we do still live in a world where access to the latest papers is largely a walled garden.
Not all done and dusted. Not even close.

[DorsetJoomla]

I don't want to get into a long debate on this I was just saying that I was working on this 20 years ago and I am certainly not up to date on the subject but even then there was a debate about peer review (and who pays for it) versus open access. People were setting up free journals with little quality control in competition with the big publishers and titles. Perhaps nothing has changed after all! I am just surprised that an open platform for journal publishing hasn't been created by the academic community by now.

I seem to recall that the basic problem then was that academics paid to have their papers published and then had to pay to read them.

[andypooz]

I think the same situation still exists. I do recall reading an article about it recently, and the squillions these organisations make to license access to academic institutions and business- a situation that seems inescapable (as they have things stitched up so tightly in contracts and non-competes, etc). There was a man who was battling these behemoths to change the situation, but that was effectively like asking them to give up their monopoly on knowledge, and the fortunes that accompany it- so I suspect he had a battle on his hands. I agree that there should be much more open access to this material, and the status quo is disgusting and inexcusable. Apologies, this isn't really helpful to the OP, but it's a fascinating (and controversial) topic nonetheless.

[leolam]

You cannot these days authorize based on IP's: Mobiles, coffee-shop, traveling, 4/5G providers, non-static ip's FORGET IT!

Anything for subscriptions will work it is just your preferences... Payplans is good but so are others. Check out JED but forfeit any idea about IP...That is prehistoric thinking (no offense just to rattle a couple of brains)

Leo

[recordap]

Hi Sozzled,

Thanks for your feedback. My concern is about institutional users, such as universities and colleges that require access for all students and faculty at their campus. With an institution, you have an administrator with a user account on the publisher's website. Usually, the user account of the administrator is mapped to their institutional IP (network) address. Once it is mapped, the website will grant access to students and faculty coming from that IP address (I guess by looking at the tables in the database). With institutions, an IP address is usually static, and does not change often.

I would love to hear an alternative of how to give institutions access to a publisher resource. If the suggestion is to disregard IP access, how will institutions have access to the resource? It is not possible to create a user account for each user at an institution.

Your scenario below works well for individual users, which Joomla can easily handle. I am stumped at institutional access. Or maybe there is a different way?

I would love to hear a way to overcome this.

Thanks

To be totally honest with you, I would suggest that you dismiss the idea of an IP addressed-based access scheme for several reasons. The main reason is that people's IP addresses continually change (and therefore, such a scheme would be quite unreliable). Another reason to dismiss that approach is that it's not easy to implement such a mechanism on any website (in fact, I've never seen it done anywhere before).

The best approach is to have your users validate their account by logging in. Joomla uses a very good login mechanism and, combined with ACL protection, you can limit access to your site contents—in your case, scientific journals. There are a number of subcription extensions located in the JED and I suggest that you browse among those for something that suits your need.

I hope this helps.

[recordap]

Hi Andy,

Yes,IP address is usually mapped to a single user from an institution, such as a university. I am not sure if IP address are static or dynamic. Some institutions also use proxy server. For the most part, the IP address does not change frequently. But, access for staff does happen on campus and off campus (home).

I think that IP access is the gold standard. I am very open to other options of access for institutions.

Thanks for the feedback.

[recordap]

Hi Leo,

Thanks for your feedback. I am open to suggestions for new methods.

I am talking about subscription for institutions not individuals. IP access is the method used for access for institutions and seems to be industry wide for academic journals.

Do you have an suggestions on how to create institutional access?

Thanks

You cannot these days authorize based on IP's: Mobiles, coffee-shop, traveling, 4/5G providers, non-static ip's FORGET IT!

Anything for subscriptions will work it is just your preferences... Payplans is good but so are others. Check out JED but forfeit any idea about IP...That is prehistoric thinking (no offense just to rattle a couple of brains)

Leo

[recordap]

Hi DorsetJoomla,

I do not quite follow your post. What issue were you talking to all the big publishers of STEM journals? All those big publishers use IP access, and I am sure they have the dedicated IT team to go with it.

But if you are speaking about subscription cost, then that is a whole different topic.

This takes me back to the mid 90's when I was working for a large IT company and we were talking to all of the big publishers of STEM journals (Elsevier, Blackwells, Academic Press, Wiley, etc etc) about just this issue and to be honest I thought it was all done and dusted by now. The big issues were about connecting to things like the UK JANET network (and similar in the USA)institutional subscriptions (and even how much to charge), access etc. That was 20 years ago, are you sure that this hasn't all been done by now?

[leolam]

ACT Library does not uses IP. We used here for their extranet library bar code access. http://tch.anu.edu.au/remote-access-login

Again in institutions work people and these people access databases with info not from a single location. You limit accessibility with IP and would be ill advised.

I also disagree with the statement re. IP as standard. Just Google for Extranet and visit sites like delta.com (using partner number/pass), Government Alberta (email/pass) and NSW Education (username/pass) as examples. http://www.journals.elsevier.com uses email/pass btw

Leo

[recordap]

Hi Leo,

This is interesting. Is the website done in Joomla? Can you please talk about what you did? I would like to know. How did it validate the library barcode? Is the barcode required when students are on campus?

I am not sure if ACT Library not using IP access is the same as publishers, who have to fulfill orders from universities and colleges that require IP access setup. In general, publishers do not have access to the library bar code for the institutions.

I guess another way of looking at it. You are a publisher with several journals. You have universities that want to make your journals available on their campus for their faculty and staff to use for teaching and research.

What solutions do you see working in this setup?

Thanks

ACT Library does not uses IP. We used here for their extranet library bar code access. http://tch.anu.edu.au/remote-access-login

Again in institutions work people and these people access databases with info not from a single location. You limit accessibility with IP and would be ill advised

Leo

[leolam]

Joomla 3.6.2 per date.

As you will understand I cannot discuss the technical solution since it comprises a secure (as per Joomla MVC method) dedicated Joomla component (we developed) that deals with the Joomla login, utilizing the EZ-proxy as security and authentication buffer and made sure that Joomla and EZproxy are able to handshake/talk to each other utilizing the EZproxy methodology.

EZproxy works by dynamically altering the URLs within the webpages provided by your database vendor. The URLs of these webpages are changed to reflect your EZproxy server instead, causing your users to return to the EZproxy server as they access links on these webpages. The result is a seamless access environment for your users without the need for proxy configuration on the user's client.

We could use here library, username, student number you just make a choice but not with IP since that would not work in this solution and limit accessibility

You can connect with me via Skype (see my contact details under my profile image) if you want our advise/help in detail but that will always be a commercial activity. Have a look at EZproxy....that solves a lot of your issues and is widely used

Leo

[recordap]

But EzProxy is for libraries. We are not a library.

[sozzled]

This discussion seems to be going around in circles. The original question that was asked was about using some form of IP-address "verification" method. My early reply was that this is not a good idea (and I've read nothing, since then, to change my opinion). If, however, you're insistent that this [probably] unworkable "solution" is the right one for you then I wish you all the luck in the world.

It doesn't matter whether the discussion is about "scientific" articles, or educational articles, or cheesecake recipes or even other matter that's prized, privileged and appreciated by a select few. What matters is how you limit the availability of those resources to people who share a common interest.

My suggestion—evidently long-forgotten in the heat of the debate about whether or not the site in question is a library, a money-making enterprise or whatever it might be—is to use Joomla's standard ACLs to protect the material and have people join the site, create an account, and login with the appropriate credentials in order to access that information.

IP-based security? I think that's an unrealistic proposal. That's my two-cents' worth (and you're getting value for the money).

[recordap]

Thanks everyone for your response!

My main concern is how to provide access to institutions (universities and colleges) to an online journal. While some of you do not recommend IP access because it is antiquated and not very secure, I have yet to hear an alternative solution that will enable me to create access for institutional use. If Joomla can be used, how does one go about doing that?

The recommendation of using Joomla and letting people sign up sounds great, but our subscription includes universities and colleges who expect access by IP. So, when a university subscribes, it is through the library website that students and faculty access the journal. So, the students and faculty are already authenticated by the library before they get to our website. Telling the library that access is not by IP, or that students have to register on the website to access content, well, they are likely to freak out.

I am open to any alternative ways that access can be provided to institutions with a program like Joomla. Is the suggestion to create a special user group in Joomla and assign the libraries to that group? If so, how will their patrons have access? Or is the recommendation to just have people register and subscribe to content? That sounds like a regular membership website, but then, how do we accommodate and support institutions?

[sozzled]

There's a really easy way to address this (if you give up your interest in IP-based access).

Let's say an institution likes your website and wants to subscribe. Let's say the rate of subscription is $10 per week.

Give that institution an account name and password (and disallow the ability to change the password); let the institution tell its members to use the account name (and password) that you specified. In that way, all the members of that institution can enjoy the service for the term of the subscription (one week). After the subscription period ends, you change the password (or you change it whenever you feel like it).

This keeps the service honest, it doesn't require any "special" coding, and it fulfils your business objectives. Does that make sense? That's just one suggestion.

Of course, you could keep waiting for "better" ideas but, it's your business and it's your time-frame as to how long you're going to wait before you get your show on the road. I hope that's of some help.

In conclusion, I don't know (or wish to care about) IP address-based connectivity (unless you're prepared to invest a few thousand dollars on the hardware to manage it). IP addressed-based connectivity is achievable if you invest in constructing a VPN and issue token generators to allow people to tunnel-in. I've worked with VPNs; you probably won't get too much loose change from $10K but, like I've said before, it's your business and you can manage it any way you can choose (or afford) to do. Good luck.

[andypooz]

I think we can find a better solution than sozzled's idea- that's not very elegent or extensible at all. If you're saying that no one has come up with a viable alternative to IP then you're just ignoring leolam's contribution. Every institution consists of many students and staff who all have login credentials for the institution's online resources. If you use EZproxy or something similar you can rely on the user being authenticated by the details held by the institutions (such as their library number and login password). This would involve some setup between yourself and the IT team at the institution for each new institutional subscription, but it wouldn't be onerous and it is expected in order to get the integrity to the system (ie. Ony people who should have access getting access).
But for me, the big advantage here is that not every user from School A logs in with the same details and is regarded as one user. You can gather data on each subscribed user who uses the system, which is valuable to you and the institution. AND you needn't have any personally identifiable details- so you don't know the students name, you just know what someone with student number ST234567 was authorised by School A's database to access your journals and spent 45 minutes in the early hours of a Sunday morning researching 'hydroponics home grow tips'.
If you were really taking this seriously- and you'll have to if you want to have large academic institutions as clients- then you need to do something that is fit for purpose, not a fudge. If you're looking to slap together a few open source extensions in a haphazrd way and expect to have an enterprise subscription service then you're very much deluding yourself. There needs to be at least one member of your team who really grasps this stuff and can make it happen- you're not going to get all the answers you want on this forum, because those of us who appreciate the complexity and time required for such a thing will soon lose their patience with you. It seems I'm the first one to go.
To be fair to sozzled, his solution would technically work, its just far from ideal, but if you wanted to get started on a shoestring then you might try this. I suspect when you're trying to get the massive subscription payments from institutions and they find out that it will rely on a system of all staff and students being issued with the same username and password (basically as good as having no authentication at all!) then anyone with a critical eye will laugh you out of the room.
But seriously dude, forget about IP- institutions don't really want that, do they? If they do then they don't know what they're talking about

[sozzled]

For what it's worth, I see there's an "IP Login" extension that may be relevant to this topic:

https://extensions.joomla.org/extension ... s/ip-login