Bug 17486

Summary: Remove 'Mozilla Persona' as an authentication method
Product: Koha Reporter: Martin Renvoize <martin.renvoize>
Component: AuthenticationAssignee: Jonathan Druart <jonathan.druart+koha>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: enhancement    
Priority: P5 - low CC: chris, dcook, dpavlin, jonathan.druart+koha, josef.moravec, katrin.fischer, kyle, m.de.rooy, martin.renvoize, mtompset, veron, ztajoli
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
'Persona' never really took off, and although many browsers currently support it, very few services actually implement it. This has lead its founders, Mozilla, to end the project. On November 30th, 2016, Mozilla closed the persona.org services. Now the feature is deleted from Koha.
Version(s) released in:
Bug Depends on: 9587    
Bug Blocks: 17554, 18144    
Attachments: Bug 17486: Remove Mozilla Persona
[SIGNED-OFF] Bug 17486: Remove Mozilla Persona
Bug 17486: Remove Mozilla Persona
Bug 17486: Remove Mozilla Persona
Bug 17486: [QA Follow-up] Changes as to set_userenv

Description Martin Renvoize 2016-10-23 09:37:52 UTC
Persona never really took off, and although many browsers currently support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their own words:

=================================================================================
Persona is no longer actively developed by Mozilla. Mozilla has committed to operational and security support of the persona.org services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=================================================================================

Given the above, and that the Persona authentication methods as a whole are no longer being actively maintained by anyone anywhere to ensure ongoing security, we should deprecate the option from koha.
Comment 1 Jonathan Druart 2016-12-14 17:33:24 UTC
Created attachment 58183 [details] [review]
Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=================================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=================================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted
Comment 2 Owen Leonard 2016-12-14 18:00:27 UTC
Created attachment 58186 [details] [review]
[SIGNED-OFF] Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=============================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=============================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Martin Renvoize 2016-12-15 08:37:58 UTC
Code looks good to me, but I've added Chris to the cc list in the hopes he might come along and take a quick look too. As the original implementor of Persona he might spot something we've missed.
Comment 4 Chris Cormack 2016-12-21 18:54:23 UTC
Looks ok to me, sad to see what was a great idea disappear.

But we have gluu to look at now https://www.gluu.org/
Comment 5 Jonathan Druart 2016-12-29 09:56:11 UTC
Created attachment 58485 [details] [review]
Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=============================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=============================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 6 Jonathan Druart 2016-12-29 09:56:59 UTC
Patches rebased (conflicts with bug 17209 fixed).
Comment 7 Marcel de Rooy 2017-01-06 07:29:56 UTC
QA: Looking here now.
Comment 8 Marcel de Rooy 2017-01-06 08:12:46 UTC
Created attachment 58623 [details] [review]
Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=============================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=============================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Code looks good to me.
Also ran several tests including: Auth.t, Auth_with_shibboleth.t.
Comment 9 Marcel de Rooy 2017-01-06 08:12:54 UTC
Created attachment 58624 [details] [review]
Bug 17486: [QA Follow-up] Changes as to set_userenv

Add shibboleth parameter to POD of set_userenv.
Removed a 12th set_userenv parameter from Borrower_Discharge.t.
Replaced set_userenv call in PatronLists.t looking like a fortunate typo.

Test plan:
Run the two corrected tests.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Kyle M Hall 2017-01-13 12:35:09 UTC
Pushed to master for 17.05, thanks Marcel, Jonathan!
Comment 11 Katrin Fischer 2017-01-15 18:47:12 UTC
This won't get ported back to 16.11.x as it is an enhancement.
Comment 12 Jonathan Druart 2017-01-16 09:00:23 UTC
(In reply to Katrin Fischer from comment #11)
> This won't get ported back to 16.11.x as it is an enhancement.

Maybe it would make sense to backport this one, the service is no longer available.
Comment 13 Katrin Fischer 2017-01-16 09:10:40 UTC
I am applying the "It doesn't hurt it's there right now" rule, minimizing risk that his could theoretically cause a new bug :)
Comment 14 Mark Tompsett 2017-04-03 01:00:50 UTC
(In reply to Katrin Fischer from comment #13)
> I am applying the "It doesn't hurt it's there right now" rule, minimizing
> risk that his could theoretically cause a new bug :)

Wise call. :)