Bug 17486 - Remove 'Mozilla Persona' as an authentication method
Summary: Remove 'Mozilla Persona' as an authentication method
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 9587
Blocks: 17554 broke, openidconnect, persona, removal
  Show dependency tree / graph
 
Reported: 2016-10-23 09:37 UTC by Martin Renvoize (ashimema)
Modified: 2017-12-07 22:16 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
'Persona' never really took off, and although many browsers currently support it, very few services actually implement it. This has lead its founders, Mozilla, to end the project. On November 30th, 2016, Mozilla closed the persona.org services. Now the feature is deleted from Koha.
Version(s) released in:
Circulation function:

Attachments
Bug 17486: Remove Mozilla Persona (27.86 KB, patch)
2016-12-14 17:33 UTC, Jonathan Druart 		Details | Diff | Splinter Review
[SIGNED-OFF] Bug 17486: Remove Mozilla Persona (27.95 KB, patch)
2016-12-14 18:00 UTC, Owen Leonard 		Details | Diff | Splinter Review
Bug 17486: Remove Mozilla Persona (27.95 KB, patch)
2016-12-29 09:56 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 17486: Remove Mozilla Persona (28.13 KB, patch)
2017-01-06 08:12 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Bug 17486: [QA Follow-up] Changes as to set_userenv (2.50 KB, patch)
2017-01-06 08:12 UTC, Marcel de Rooy 		Details | Diff | Splinter Review
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2016-10-23 09:37:52 UTC 
Persona never really took off, and although many browsers currently support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their own words:

=================================================================================
Persona is no longer actively developed by Mozilla. Mozilla has committed to operational and security support of the persona.org services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services. Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=================================================================================

Given the above, and that the Persona authentication methods as a whole are no longer being actively maintained by anyone anywhere to ensure ongoing security, we should deprecate the option from koha.
Comment 1 Jonathan Druart 2016-12-14 17:33:24 UTC 
Created attachment 58183 [details] [review]
Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=================================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=================================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted
Comment 2 Owen Leonard 2016-12-14 18:00:27 UTC 
Created attachment 58186 [details] [review]
[SIGNED-OFF] Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=============================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=============================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Martin Renvoize (ashimema) 2016-12-15 08:37:58 UTC 
Code looks good to me, but I've added Chris to the cc list in the hopes he might come along and take a quick look too. As the original implementor of Persona he might spot something we've missed.
Comment 4 Chris Cormack 2016-12-21 18:54:23 UTC 
Looks ok to me, sad to see what was a great idea disappear.

But we have gluu to look at now https://www.gluu.org/
Comment 5 Jonathan Druart 2016-12-29 09:56:11 UTC 
Created attachment 58485 [details] [review]
Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=============================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=============================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 6 Jonathan Druart 2016-12-29 09:56:59 UTC 
Patches rebased (conflicts with bug 17209 fixed).
Comment 7 Marcel de Rooy 2017-01-06 07:29:56 UTC 
QA: Looking here now.
Comment 8 Marcel de Rooy 2017-01-06 08:12:46 UTC 
Created attachment 58623 [details] [review]
Bug 17486: Remove Mozilla Persona

Persona never really took off, and although many browsers currently
support it, very few services actually implement it.

This has lead to it's founders, Mozilla, to end the project. In their
own words:

=============================================================================
Persona is no longer actively developed by Mozilla. Mozilla has
committed to operational and security support of the persona.org
services until November 30th, 2016.

On November 30th, 2016, Mozilla will shut down the persona.org services.
Persona.org and related domains will be taken offline.

If you run a website that relies on Persona, you need to implement an
alternative login solution for your users before this date.

For more information, see this guide to migrating your site away from
Persona:

https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers

=============================================================================

Given the above, and that the Persona authentication methods as a whole
are no longer being actively maintained by anyone anywhere to ensure
ongoing security, we should deprecate the option from koha.

Test plan:
Apply this patch and make sure you do not find any references of Persona
Have a look at patches from bug 9587 and confirm that everything has
been reverted

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Code looks good to me.
Also ran several tests including: Auth.t, Auth_with_shibboleth.t.
Comment 9 Marcel de Rooy 2017-01-06 08:12:54 UTC 
Created attachment 58624 [details] [review]
Bug 17486: [QA Follow-up] Changes as to set_userenv

Add shibboleth parameter to POD of set_userenv.
Removed a 12th set_userenv parameter from Borrower_Discharge.t.
Replaced set_userenv call in PatronLists.t looking like a fortunate typo.

Test plan:
Run the two corrected tests.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 10 Kyle M Hall (khall) 2017-01-13 12:35:09 UTC 
Pushed to master for 17.05, thanks Marcel, Jonathan!
Comment 11 Katrin Fischer 2017-01-15 18:47:12 UTC 
This won't get ported back to 16.11.x as it is an enhancement.
Comment 12 Jonathan Druart 2017-01-16 09:00:23 UTC 
(In reply to Katrin Fischer from comment #11)
> This won't get ported back to 16.11.x as it is an enhancement.

Maybe it would make sense to backport this one, the service is no longer available.
Comment 13 Katrin Fischer 2017-01-16 09:10:40 UTC 
I am applying the "It doesn't hurt it's there right now" rule, minimizing risk that his could theoretically cause a new bug :)
Comment 14 Mark Tompsett 2017-04-03 01:00:50 UTC 
(In reply to Katrin Fischer from comment #13)
> I am applying the "It doesn't hurt it's there right now" rule, minimizing
> risk that his could theoretically cause a new bug :)

Wise call. :)