Location, Location, Location…

I’ve been asked several times if it is possible to restrict access to users by geographical location using federated access. This is normally from a Service Provider who wants to restrict access to a resource to people physically present somewhere in the UK. My begrudging answer is, yes, there are ways of doing this. eduPerson has a locality field that could be populated, or you could ask for postcodes to query against. Of course this doesn’t ensure that the person is physically within the UK, only that the IdP believes that the person in question is normally resident in the UK.

To ensure that people are physically within a specific location, IP checking is normally relied upon. This in itself is not a particularly reliable process – machines in the UK often have IP addresses that would be flagged as belonging to another country and proxy servers and VPN access will get around all of these issues.

My main reaction however would have to be WHY, oh WHY would you want to try and do this? As you can see from the above, it is a fairly difficult thing to achieve, so you are immediately placing an expectation on your customer that they are likely to fail to meet. I also don’t understand why restricting access just to the UK would be perceived as more secure. Downloaded information could easily be passed beyond the boundaries of the UK in a instant because of that interweb thingamy I can almost I guess understand why BBC iPlayer would only be available in the UK because of license payer issues, but as a license player I think I should be able to access iPlayer when I’m in other countries, especially so I don’t miss the final episode of The Apprentice! The right is not a geographical one – it is actual a personal one based on my license fee payment.

In a world of ubiquitous electronic access, I think it is foolish to try and restrict access by location (and yes, I’m afraid that for me this includes ‘on site only’ access). Location is often inaccurately identified as the restricting element for access – but when properly analysed, you can nearly always find a better way of managing such a process. Does a publisher, for example, actual mean that they would be uncomfortable with students permanently resident overseas using a resource, rather than it can only be used in the UK?

I think it is such a shame that we are still dealing with these issues, and that it automatically cuts the publisher off from developing their resources for use on iPhones and netbooks and in other truly mobile locations due to what I see as an inaccurate interpretation of security. Lets hope we can move on!