We currently have an `openathens` boolean flag on both institutions and resources. For OAproxy (the EZproxy workaround), we need an `oa_proxy` boolean flag on both institutions and resources. When a user logs in to GALILEO either via password or via IP, if `oa_proxy` is true for their institution, we will log the user in to that institution's OAproxy organization account at OpenAthens. Subsequently, when that user clicks an express link for a resource that has `oa_proxy` true: - if the user is remote, GALILEO will route the user to the resource via the OpenAthens URL (that is indexed with the allocation). - otherwise (user is on campus) GALILEO will route the user to the resource via the IP access URL. Note that when a new user clicks an athenized link in the wild, it is OpenAthens that will direct the user to the resource. Special Notes: - We should not have to log the user in to their institution's OAproxy org if they are on campus - No institution that has `openathens` true should have `oa_proxy` true - A resource can positively have both `openathens` true and `oa_proxy` true - When we index the allocation, we can fill in the OpenAthens URL for `oa_proxy`. This will not conflict with the existing use of the OpenAthens URL, because no institution will have both `openathens` true and `oa_proxy` true. See also: https://gitlab.galileo.usg.edu/galileo/galileo_search/-/wikis/OpenAthens-Authentication-API-Interoperability