- Koha-devel - lists.koha-community.org

Re: [Koha-devel] Fwd: Koha and Ebsco OpenAthens
by Alex Buckley 24 Mar '20

24 Mar '20

Hi Paul, I've done an integration of Openathens with Koha using the mod_auth_mellon Apache module https://github.com/latchset/mod_auth_mellon (rather than using the EBSCO plugin). The workflow I did is: 1. Checked out the master branch of mod_auth_mellon 2. Navigated into mod_auth_mellon 3. Generated the Koha SP (Service Provider) XML metadata endpoint, cert and key file. ./mellon_create_metadata.sh <full_opac_test_site_url> <full_opac_test_site_url>/saml 4. Moved those files into a new directory /etc/koha/sites/<instance>/saml 5. Sent the metadata XML file I'd made to EBSCO and received their one back and put it in /etc/koha/sites/<instance>/saml 6. Edit Apache conf file ( /etc/apache2/sites-available/<instance>.conf ): <Location /> MellonEnable "auth" MellonUser "NameID" MellonSPPrivateKeyFile /etc/koha/sites/<instance>/saml/<opac_test_site_url>.key MellonSPCertFile /etc/koha/sites/<instance>/saml/<opac_test_site_url>.cert MellonSPMetadataFile /etc/koha/sites/<instance>/saml/<opac_test_site_url>.xml MellonIdPMetadataFile /etc/koha/sites/<instance>/saml/<client_supplied_metadata>.xml MellonEndpointPath /saml # Set environment variables with the values of IdP attributes MellonSetEnv "principalname" "<IdP_UPN_attribute_name>" MellonSetEnv "givenname" "<IdP_firstaname_attribute_name>" MellonSetEnv "surname" "<IdP_surname_attribute_name>" MellonSetEnv "email" "<IdP_email_attribute_name>" # Unset and reset X_REMOTE_UPN Header unset X_REMOTE_UPN RequestHeader unset X_REMOTE_UPN RequestHeader set X_REMOTE_UPN %{MELLON_principalname}e # Unset and reset the X_REMOTE_GIVENNAME Header unset X_REMOTE_GIVENNAME RequestHeader unset X_REMOTE_GIVENNAME RequestHeader set X_REMOTE_GIVENNAME %{MELLON_givenname}e # Unset and reset the X_REMOTE_SURNAME Header unset X_REMOTE_SURNAME RequestHeader unset X_REMOTE_SURNAME RequestHeader set X_REMOTE_SURNAME %{MELLON_surname}e # Unset and reset the X_REMOTE_EMAIL Header unset X_REMOTE_EMAIL RequestHeader unset X_REMOTE_EMAIL RequestHeader set X_REMOTE_EMAIL %{MELLON_email}e </location> Here the /IdP_UPN_attribute_name/ is the attribute (claim) that Openathens is sending to Koha in the SAML POST request, we're assigning it to the Mellon environment variable "principalname" and then putting it in the header as /X_REMOTE_UPN/ 7. Install the following packages: sudo apt-get install libapache2-mod-auth-mellon sudo s2enmod expires sudo systemctl restart apache2 sudo apachectl configtest sudo apachectl restart apt-cache policy libapache2-mod-auth-mellon sudo apt-get install liblasso3 sudo apachectl restart 8. Amend the koha-conf.xml file adding the following tags: <trusted_header_upn>X_REMOTE_UPN</trusted_header_upn> <trusted_header_givenname>X_REMOTE_GIVENNAME</trusted_header_givenname> <trusted_header_surname>X_REMOTE_SURNAME</trusted_header_surname> <trusted_header_email>X_REMOTE_EMAIL</trusted_header_email> 9. Somethings to note is that using mod_auth_mellon is that plack user runs as www-data so you will need to change the AssignUserID in the Apache conf to be: AssignUserID www-data <instance>-koha You'll also need to amend your debian/scripts/koha-plack script to replace: instance_user="${instancename}-koha" With: instance_user="www-data" Also please note when using mod_auth_mellon you'll need to make sure the Koha instance your setting this up for is on a standalone server (i.e. no other Koha instance on the server) because the changing of the user that Plack runs as introduces a security risk on a multi-instance server. 10. Change the ownership of /var/cache/koha/<instance> file, because Plack now running as /www-data/ can not read the file: sudo chown www-data -R /var/cache/koha/<instance> 11. You'll need to introduce a customization in C4/Auth.pm now (though I am shortly going to be upstreaming this customization so you'll see a bug report from me for it soon): 11a. Add a new subroutine get_header() - This retrieves the Openathens values stored in the header in the Apache conf: /sub get_header {/ // / my ($header) = @_;// // my $q = CGI->new();// // # Prepend HTTP_ as that's how they come through/ // / my $h_val = $q->http('HTTP_' . $header);// // return $h_val;// //}/ 11b. Amend C4::Auth->checkauth(): / / /my $trusted_header = C4::Context->config('trusted_header');// //my $trust_head_val = get_header($trusted_header) if $trusted_header; #Store the header values returned from get_header subroutine which are: UPN, givenname, surname and email in $trust_head_val hash. / .... Now above this line (/elsif//( //$emailaddress//) {/ ) add in a new elsif: / / /} elsif ($trust_head_val && $trust_head_val ne '(null)') {// // $userid=$trust_head_val;// // # This uses something like// // # <trusted_header>X_REMOTE_USER</trusted_header>// // # in koha-conf.xml, and checks that header on the incoming request.// // # If it is there and contains a user ID, we believe it and log the// // # user in with that. This is intended for things like plack behind a// // # reverse proxy that does auth, and puts the user ID into a header.// // #// // # Basically, we treat it just like basic auth.// // $cookie = $query->cookie(// // -name => 'CGISESSID',// // -value => '',// // -expires => '',// // -HttpOnly => 1,// // );// // C4::Context->_new_userenv(undef);// // $loggedin = check_user_exists($userid); #Call check_user_exists subroutine and check if there is a borrower.userid matching the UPN// // // // }// / Note: This is assuming the UPN Openathens is sending Koha matches/is stored in the borrower.userid. If Openathens wants to only use email i.e. the email address Openathens sends Koha in POST request matches borrowers.email then you'll need to amend the SQL query in check_user_exists. A couple more things to note: 1. If your Koha server is behind a load balancer then you need to include the https:// directive in the servername e.g. Servername https://demo.koha.com This is because SAML requires the web server to identify as the same server in the SP metadata (e.g. https://<URL>). But when a Koha server is behind a LB it does not identify itself including the https protocol so you need to include it. There is more detail on that here: https://jdennis.fedorapeople.org/doc/mellon-user-guide/mellon_user_guide.ht… I know that is for Fedora (I can't find the documentation link I had discussing it in a Ubuntu context) but it is the same principal. I hope all this helps and if you need any more information please let me know! Thanks, Alex On 25/03/20 5:00 am, Chris Cormack wrote: > > > ------------------------------------------------------------------------ > *From:* Paul Poulain <paul.poulain(a)biblibre.com> > *Sent:* 25 March 2020 4:57:14 AM NZDT > *To:* "koha-devel(a)lists.koha-community.org" > <koha-devel(a)lists.koha-community.org> > *Subject:* [Koha-devel] Koha and Ebsco OpenAthens > > Hello, > > does anyone have experience in setting OpenAthens for Koha. There's an > Ebsco plugin (https://github.com/ebsco/openathens-koha-plugin) but it > seems to be for old versions of Koha. > > any feedback highly appreciated ! > > -- > Paul Poulain, Associé-gérant / co-owner > BibLibre, Services en logiciels libres pour les bibliothèques > BibLibre, Open Source software and services for libraries > ------------------------------------------------------------------------ > Koha-devel mailing list > Koha-devel(a)lists.koha-community.org > https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel > website : http://www.koha-community.org/ > git : http://git.koha-community.org/ > bugs : http://bugs.koha-community.org/ > > -- > Sent from my Android device with K-9 Mail. Please excuse my brevity. -- Alex Buckley Koha Developer Catalyst IT - Expert Open Source Solutions DDI: +64 4 803 2378 | Mob: +64 22 429 6157 | www.catalyst.net.nz CONFIDENTIALITY NOTICE: This email is intended for the named recipients only. It may contain privileged, confidential or copyright information. If you are not the named recipient, any use, reliance upon, disclosure or copying of this email or its attachments is unauthorised. If you have received this email in error, please reply via email or call +64 4 499 2267.

2 1

Koha and Ebsco OpenAthens
by Paul Poulain 24 Mar '20

24 Mar '20

Hello, does anyone have experience in setting OpenAthens for Koha. There's an Ebsco plugin (https://github.com/ebsco/openathens-koha-plugin) but it seems to be for old versions of Koha. any feedback highly appreciated ! -- Paul Poulain, Associé-gérant / co-owner BibLibre, Services en logiciels libres pour les bibliothèques BibLibre, Open Source software and services for libraries

1 0

Plugin with JS datatable
by Fridolin SOMERS 24 Mar '20

24 Mar '20

Hi, I've been working on a small plugin : https://github.com/biblibre/koha-plugin-users-by-permissions/ It shows a table with users and there permissions. JS Datatable is OK with Koha 18.11 but not with master. Whats wrong ? I could use some help ;) Best regards. -- Fridolin SOMERS <fridolin.somers(a)biblibre.com> Software and system maintainer 🦄 BibLibre, France

3 4

remote training on Koha & covid-19
by Paul Poulain 23 Mar '20

23 Mar '20

Hello all, In France, we always move to the library for training. With the covid-19 we may have to do some remote training. Have you experimented remote training ? How does it go ? How do you organise the training ? Any hints ? Thanks for anything shared, that will be helpful for us ! -- Paul Poulain, Associé-gérant / co-owner BibLibre, Services en logiciels libres pour les bibliothèques BibLibre, Open Source software and services for libraries

3 3

Koha:::Logger configuration maintenance
by Tomas Cohen Arazi 20 Mar '20

20 Mar '20

Hi all. I'm not that familiar with our Koha::Logger class usage, but I noticed there's no 'api' target and it would be handy to have it. There's a bug for a 'sip' target and for other things. It looks like the main reason for adopting log4perl was the flexibility it provided, and it makes sense: many appenders, several options, centralized config, etc. The question is: how do we update people's config? We cannot just go edit their configs, right? The current log4perl.conf on each instance is generated using the template and adjusting the instance name. Has anyone thought about this update problem? Ideas? -- Tomás Cohen Arazi Theke Solutions (http://theke.io) ✆ +54 9351 3513384 GPG: B2F3C15F

3 4

Virtual Hackathon
by Renvoize, Martin 18 Mar '20

18 Mar '20

Hi All, As many of you are already aware we had to cancel the annual community Hackfest in Marseille this year due to COVID-19. However, we are intending to run an open to all virtual Hackathon as an alternative. Some ideas have been added to the Wiki <https://wiki.koha-community.org/wiki/Virtual_Hackfest_2020>and a Trello <https://trello.com/b/8PHH9gJ2/virtual-hackfest2020bugzilla> board exists to capture peoples intentions and work efforts over the week. To get us started, ByWater have offered to host a couple of live streams: * Wednesday, March 25th Koha Virtual Hackfest - Documentation 9:00am EST / 1:00pm UTC https://www.youtube.com/user/bywatersolutions/live ------------------------------ * Friday, March 27th Koha Virtual Hackfest - Code Spaghetti 11:00am EST / 3:00pm UTC https://www.youtube.com/user/bywatersolutions/live I intend to host at least one myself aimed at getting people started with how to pick bugs to test and use the community sandboxes to sign them off. IRC <https://koha-community.org/get-involved/irc/> will be full of people keen to help and get involved to do pop in. I look forward to seeing many of you online next week, *Martin Renvoize* <https://www.ptfs-europe.com> Development Team Manager Community Release Manager (19.11, 20.05) *Phone:* +44 (0) 1483 378728 *Mobile:* +44 (0) 7725 985 636 *Email:* martin.renvoize(a)ptfs-europe.com *Fax:* +44 (0) 800 756 6384 www.ptfs-europe.com Registered in the United Kingdom No. 06416372 VAT Reg No. 925 7211 30 The information contained in this email message may be privileged, confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this email message in error, please email the sender at info(a)ptfs-europe.com

1 0

Koha packaging problems (Deb10/Buster)
by Mason James 16 Mar '20

16 Mar '20

Hi Koha devs We have a dependency problem with the release of debian-10 and the following packages. (debian-11 is ok) libmojolicious-perl libmojolicious-plugin-openapi-perl libyaml-libyaml-perl The packages require specific versions to be built for specific debian releases, due to their dependencies. This type of problem has occurred before: an example is the libcryptx-perl/ubuntu-16.04 bug. or elasicsearch with jessie... https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23128 The specifics of the dependency problem are quite complex so I wont bore you unless you really ask :) It seems the best solution is to create a new 'distro' repo that contains a small number of additional distro-specific packages. This should allow us to support every type of koha/distro (and arch) combination Here's an example of a Koha sources.list file... (We can name the distro releases/aliases as we please) deb http://debian.koha-community.org/koha [19.05|19.11|stable|oldstable|oldoldstable] main deb http://debian.koha-community.org/distro [debian9|ubuntu16.04|bionic|ubuntu-oldstable|stable] main FYI: It's possible to add the distro-specific packages to the existing 'koha' repo, but that should probably be avoided due to managing the extra complexity (its cleaner to separate the two repos imho) Two other options... 1/ use kc.org debian packages, with cpanminus (or similar) providing the distro specific packages (extra installation steps and complexity) 2/ ignore the problem for now, and accept that older koha/distro combinations will be forced to break Does anyone have any other solutions that I have missed, or a better solution even? Cheers, Mason

4 10

Call for news: March 2020 Koha Newsletter
by Koha Newsletter 14 Mar '20

14 Mar '20

I'm collecting news for the March newsletter. Send anything noteworthy to: k o h a news AT gmail dot com News criteria: --------------------------- ** For events **: - Please include dates for past events. If I can't find dates I may not add it. - Announcements for future events with dates T.B.A. are fine ...Eg., Kohacon - For past events , **** one month back is the cut-off ****. * News items can be of any length. * Images are fine * Anything and everything Koha. * Submit by the 26th of the month. If you are working on an interesting project or development related to Koha, please let me know and I'll include it in the development section. Thank you! -- Chad Roseburg Editor, Koha Community Newsletter

1 0

String Freeze Notice
by Joy Nelson 13 Mar '20

13 Mar '20

Greetings! Just a quick note that string freeze will go into effect on 3/15/2020 for the maintenance branches. Maintenance releases scheduled for the 24th. -- Joy Nelson President, Koha Division ByWater Solutions <http://bywatersolutions.com> Support and Consulting for Open Source Software Phone/Fax (888)900-8944 What is Koha? <http://bywatersolutions.com/what-is-koha/>

1 0

REST API not working in koha-testing-docker?
by dcook＠prosentient.com.au 13 Mar '20

13 Mar '20

Hi all, I'm finally getting around to playing with the REST API, but it's not quite working as expected. In koha-testing-docker (with the latest koha-testing-docker git repo and Docker images as of this writing), I'm getting the following in the browser: 1. 200 OK a. http://localhost:8080/api/v1/.html b. http://localhost:8080/api/v1/ or http://localhost:8080/api/v1/.json 2. 500 Internal Server error (with no obvious messages in the server logs other than a missing "Routing to a callback") a. http://localhost:8080/api/v1/items b. http://localhost:8080/api/v1/patrons c. http://localhost:8080/api/v1/libraries If I use "curl" or a Perl script, then I get a 401 error instead of a 500 error. (Although in Koha 19.11, I can get JSON results in either the browser or with curl for those endpoints, but that's a whole other matter.) RESTBasicAuth = 1 means I can use the API via curl, but still nothing via the browser. Which is fine I guess in practice but it's not really what you'd expect. I often use browser requests to test out GET requests for APIs. I don't really get how RESTPublicAPI works either. If it's disabled, it says '{"error":"Configuration prevents the usage of this endpoint by unprivileged users"}', but that doesn't seem accurate, since disabling that system preference blocks the /public APIs in general, right? Even if you use a privileged user, it still doesn't work. Actually, even with RESTPublicAPI enabled, I can't get the /public endpoints to work. I get errors like this '{"error":"Authorization failure. Missing required permission(s).","required_permissions":null}'. This email is getting a bit long and I think I have a million other API problems, so I might just work through one by one and open Bugzilla tickets as I go. David Cook Systems Librarian Prosentient Systems 72/330 Wattle St Ultimo, NSW 2007 Australia Office: 02 9212 0899 Direct: 02 8005 0595

5 10