Official OCLC Stanza (updated 2025-02-17)

Required Your EZproxy server must have an SSL certificate configured to proxy HTTPS resources.

Hosted EZproxy Include File

Hosted EZproxy customers (Americas) receive automatic stanza updates. Add this to config.txt:

View on OCLC Support ↗

Required Ad Fontes Media uses HTTPS exclusively. Your EZproxy server must be configured with a valid SSL certificate to proxy these resources.

Without SSL, users will receive certificate errors or be unable to access proxied content. See OCLC SSL configuration guide ↗

OpenAthens provides a managed proxy service as a stopgap for resources that don't yet support SAML/OIDC login. It handles the complex rewriting needed to deliver content to remote users.

The proxy authenticates users and forwards their traffic so the content provider sees requests coming from an IP address they associate with your institution.

Link syntax: https://proxy.openathens.net/login?qurl={target_url}

OpenAthens managed proxy documentation ↗

The OpenAthens managed proxy operates from these domains:

Note If Ad Fontes Media uses Cloudflare, these domains and the institution's unique proxy IP may need to be added to Cloudflare's allowed list to prevent false bot-blocking.

Institutions using Alma can configure OpenAthens as a proxy redirection service via an Integration Profile:

• Go to Alma Configuration → General → External Systems → Integration Profiles
• Add a new profile, select Resolver Proxy as the integration type
• Set Proxy server type to OpenAthens Redirector (not "OpenAthens")
• Enter your Proxy URL and Proxy IP from your OpenAthens account
• Set Use Proxy to Selective
• Required roles General Systems Administrator + Electronic Inventory Operator (for testing)

Full CARLI configuration guide ↗

The OpenAthens managed proxy cannot:

• Perform any authentication other than IP-based authentication
• Pass user-level attributes — only organisation-level authentication via IP
• Proxy other authentication or authorisation methods
• Support persistent connections such as WebSockets or Server-Sent Events (SSE)
• Guarantee a proxied resource won't break when publishers update their sites

Best practice SAML/OIDC integration is the preferred long-term solution and removes dependency on proxy access entirely.