Summary: | Remove 'Mozilla Persona' as an authentication method | ||
---|---|---|---|
Product: | Koha | Reporter: | Martin Renvoize (ashimema) <martin.renvoize> |
Component: | Authentication | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | chris, dcook, dpavlin, jonathan.druart, josef.moravec, kyle, m.de.rooy, martin.renvoize, mtompset, veron, ztajoli |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: |
'Persona' never really took off, and although many browsers currently support it, very few services actually implement it. This has lead its founders, Mozilla, to end the project. On November 30th, 2016, Mozilla closed the persona.org services. Now the feature is deleted from Koha.
|
Version(s) released in: | |
Circulation function: | |||
Bug Depends on: | 9587 | ||
Bug Blocks: | 17554, 18144 | ||
Attachments: |
Bug 17486: Remove Mozilla Persona
[SIGNED-OFF] Bug 17486: Remove Mozilla Persona Bug 17486: Remove Mozilla Persona Bug 17486: Remove Mozilla Persona Bug 17486: [QA Follow-up] Changes as to set_userenv |
Description
Martin Renvoize (ashimema)
2016-10-23 09:37:52 UTC
Created attachment 58183 [details] [review] Bug 17486: Remove Mozilla Persona Persona never really took off, and although many browsers currently support it, very few services actually implement it. This has lead to it's founders, Mozilla, to end the project. In their own words: ================================================================================= Persona is no longer actively developed by Mozilla. Mozilla has committed to operational and security support of the persona.org services until November 30th, 2016. On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline. If you run a website that relies on Persona, you need to implement an alternative login solution for your users before this date. For more information, see this guide to migrating your site away from Persona: https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers ================================================================================= Given the above, and that the Persona authentication methods as a whole are no longer being actively maintained by anyone anywhere to ensure ongoing security, we should deprecate the option from koha. Test plan: Apply this patch and make sure you do not find any references of Persona Have a look at patches from bug 9587 and confirm that everything has been reverted Created attachment 58186 [details] [review] [SIGNED-OFF] Bug 17486: Remove Mozilla Persona Persona never really took off, and although many browsers currently support it, very few services actually implement it. This has lead to it's founders, Mozilla, to end the project. In their own words: ============================================================================= Persona is no longer actively developed by Mozilla. Mozilla has committed to operational and security support of the persona.org services until November 30th, 2016. On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline. If you run a website that relies on Persona, you need to implement an alternative login solution for your users before this date. For more information, see this guide to migrating your site away from Persona: https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers ============================================================================= Given the above, and that the Persona authentication methods as a whole are no longer being actively maintained by anyone anywhere to ensure ongoing security, we should deprecate the option from koha. Test plan: Apply this patch and make sure you do not find any references of Persona Have a look at patches from bug 9587 and confirm that everything has been reverted Signed-off-by: Owen Leonard <oleonard@myacpl.org> Code looks good to me, but I've added Chris to the cc list in the hopes he might come along and take a quick look too. As the original implementor of Persona he might spot something we've missed. Looks ok to me, sad to see what was a great idea disappear. But we have gluu to look at now https://www.gluu.org/ Created attachment 58485 [details] [review] Bug 17486: Remove Mozilla Persona Persona never really took off, and although many browsers currently support it, very few services actually implement it. This has lead to it's founders, Mozilla, to end the project. In their own words: ============================================================================= Persona is no longer actively developed by Mozilla. Mozilla has committed to operational and security support of the persona.org services until November 30th, 2016. On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline. If you run a website that relies on Persona, you need to implement an alternative login solution for your users before this date. For more information, see this guide to migrating your site away from Persona: https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers ============================================================================= Given the above, and that the Persona authentication methods as a whole are no longer being actively maintained by anyone anywhere to ensure ongoing security, we should deprecate the option from koha. Test plan: Apply this patch and make sure you do not find any references of Persona Have a look at patches from bug 9587 and confirm that everything has been reverted Signed-off-by: Owen Leonard <oleonard@myacpl.org> QA: Looking here now. Created attachment 58623 [details] [review] Bug 17486: Remove Mozilla Persona Persona never really took off, and although many browsers currently support it, very few services actually implement it. This has lead to it's founders, Mozilla, to end the project. In their own words: ============================================================================= Persona is no longer actively developed by Mozilla. Mozilla has committed to operational and security support of the persona.org services until November 30th, 2016. On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline. If you run a website that relies on Persona, you need to implement an alternative login solution for your users before this date. For more information, see this guide to migrating your site away from Persona: https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers ============================================================================= Given the above, and that the Persona authentication methods as a whole are no longer being actively maintained by anyone anywhere to ensure ongoing security, we should deprecate the option from koha. Test plan: Apply this patch and make sure you do not find any references of Persona Have a look at patches from bug 9587 and confirm that everything has been reverted Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Code looks good to me. Also ran several tests including: Auth.t, Auth_with_shibboleth.t. Created attachment 58624 [details] [review] Bug 17486: [QA Follow-up] Changes as to set_userenv Add shibboleth parameter to POD of set_userenv. Removed a 12th set_userenv parameter from Borrower_Discharge.t. Replaced set_userenv call in PatronLists.t looking like a fortunate typo. Test plan: Run the two corrected tests. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 17.05, thanks Marcel, Jonathan! This won't get ported back to 16.11.x as it is an enhancement. (In reply to Katrin Fischer from comment #11) > This won't get ported back to 16.11.x as it is an enhancement. Maybe it would make sense to backport this one, the service is no longer available. I am applying the "It doesn't hurt it's there right now" rule, minimizing risk that his could theoretically cause a new bug :) (In reply to Katrin Fischer from comment #13) > I am applying the "It doesn't hurt it's there right now" rule, minimizing > risk that his could theoretically cause a new bug :) Wise call. :) |