Grove adds local administrators to Aspen, increasing security options for all libraries using Aspen Discovery and Aspen LiDA.

Traditionally, Aspen users have all authenticated against accounts in the connected ILS, in much the same way that many folks today use their Google credentials to access non-Google apps and websites. This makes sense for patrons and even staff members with limited Aspen permissions; however, this authentication method is also used by librarians administering higher-level permissions for Aspen. With the Aspen 25.02 release, Grove has added the option for libraries to add Aspen Administrators that are local to Aspen only.

Librarians typically have permission to update the password for any user in the ILS.  Because Aspen administrators were ILS accounts, any staff member could change the password for an Aspen administrator in the ILS and gain access to administrator-only actions in Aspen. To our knowledge, this has not been an issue for any libraries using Aspen, but it’s always best to be proactive with security when it comes to software. 

This new feature also provides a safeguard for getting into Aspen when the ILS is down. In the past, when the ILS was down, Aspen admin accounts that validated off of the ILS would lose access to Aspen. There traditionally has been one non-ILS admin user; however, that user is typically managed by a library’s support vendor, which means that a library needed to contact their support vendor to put up a system message in Aspen notifying users when they cannot access their account in Aspen due to the ILS being down. Aspen libraries are now encouraged to make local admin users for all of their highest-permission accounts in Aspen, both for increased security and better management when the ILS is down.