...
EZproxy has the ability to rewrite URLs and redirect browsers appropriately. This ability allows EZproxy to be configured to generate WAYFless URLs for a target resource, if it is only given the target resource URL. What this enables for libraries is that they continue to send all of their links from other applications (link resolvers, metasearch engines, database of databases, learning management systems, etc) through EZproxy. And then EZproxy (when configured to do so) will turn those links into WAYFless URLs. This enables the institution to move to Shibboleth on a resource by resource basis, which is an absolute necessity both in terms of logistics and in terms of readiness of vendors to support Shibboleth. The ability to seamlessly handle (for the user) certain resources that have been fully "Shibbolized" along side certain resources that still rely on IP-based authentication is why this has been termed a "hybrid" model. And the ability of EZproxy to play traffic cop and decide if a particular connection between user and resource needs to be either (1) proxied (since it is IP-based) or (2) handed off for a direct connection (since it is Shibboleth capable) can be thought of as an "Institutional Access Mode Switch" functionality.
Again, this best practice builds on the one before; in order to support it, a vendor must already support best practices #2 and #3.
...