Page Comparison

Craig McNally 

Axel Dörrer 

Chris Rutledge 

Jakub Skoczen 

Skott Klebe 

• Google doc:  https://docs.google.com/document/d/1LNBWaV4hrL5wVmba2zu_Mc4gdK-Vd6DDzOgcx0ZlR3M/edit#heading=h.5x6ygyohnarz
• Update on action items:
  • Craig McNally no progress, still coming back up to speed after vacation/holiday.  Will provide an update via slack once progress is made.
  • Jakub Skoczen ? wasn't present today - check on status via slack
  • Axel Dörrer is out today - check on status via slack.

• Epic:

  Jira Legacy
  server System JiraJIRA serverId 01505d01-b853-3c2e-90f1-ee9b165564fc key FOLIO-3582

• Feature:

  Jira Legacy
  server System JiraJIRA serverId 01505d01-b853-3c2e-90f1-ee9b165564fc key FOLIO-3583

• User Story:

  Jira Legacy
  server System JiraJIRA serverId 01505d01-b853-3c2e-90f1-ee9b165564fc key FOLIO-3584

• User Story: 

  Jira Legacy
  server System JiraJIRA serverId 01505d01-b853-3c2e-90f1-ee9b165564fc key FOLIO-3709

• Sonar ( https://sonarcloud.io/organizations/folio-org/quality_profiles):
  • Java: All 38 security hotspots rules and all 53 vulnerabilities rules are enabled (2 deprecated vulnerabilities rules are disabled).
  • JavaScript: 53 security hotspots rules and all 27 vulnerabilities rules are enabled.
    • John Coburn will check whether the remaining 2 security hostspots rules should be enabled.
• Snyk: Skott Klebe to take a closer look and add ignore where applicable
• Group reviewed inactive rules 
• decided to enable the two inactive but not deprecated Hotspot Security rules → Julian to activate them 
• The following were created:
  • https://issuesfolio-org.folioatlassian.orgnet/browse/FOLIO-3868 Run OWASP Zed Attack Proxy (ZAP) against Orchid
    • If anyone knows where the findings from running ZAP against Morning Glory are, please let me know, or add the link to this JIRA description yourself.  I was unable to find anything in the community or EBSCO wikis.  Searching through Slack didn't help either
    • Craig McNally will ping Skott Klebe to see if this is something he can do, or maybe we should just wait for Poppy?
  • https://issuesfolio-org.folioatlassian.orgnet/browse/FOLIO-3869 Spike - Revisit Folio auth mechanisms and generate a proposal/RFC
    • We'll need to refine this.  For now it's just a placeholder.

Today:

• Do we want to take a closer look at the JIRAs created last month and try to refine?

Axel Dörrer 

Progress is slow... at most expect monthly updates.

• Pre work has been completed (Python)
• Next step is to parse the RAML for all endpoints/module and run the tests

Today:

• Let's take a closer look at these pen tests and how they overlap with ZAP... are they complimentary?  is there significant overlap?
  • Wait for a week when Axel is on the call to discuss.
  • Who is leading this NCT group?

• Axel Dörrer is out.  Craig McNally will ask via slack.

All

Today:

• No new progress on this.  Needs to be prioritized.

• Update from John Coburn?
  • He was not present - will ask for an update via slack

Julian Ladisch / All

A few wiki pages have been shared on this... See Enhanced Consortia Support(ECS)

Julian Ladisch will discuss his concerns with Olamide, etc. and we can discuss here again if/when needed.

• There's a need to allow for the user to easily switch between tenant contexts
• Maybe making this opt-in is a reasonable approach
  • the restriction would remain unchanged by default, but you could relax this constraint by making an explicit configuration change
• Julian Ladisch met with Thunderjet/Olamide
• mod-consortia/ui-consortia have been submitted for TC review
  • This will probably be raised as part of those reviews
• Added a comment to the

  Jira Legacy
  server System JiraJIRA serverId 01505d01-b853-3c2e-90f1-ee9b165564fc key TCR-26

  :
  Security team disagree with breaking the tenant seperation on okapi token level. We would like to encourage an alternative solution on saml or openid techniques which would be less invasive to the current approach.
• TC would like to split off the security/token concerns from the module acceptance, will be discussed next Wednesday TC's meeting
• Craig McNally  to raise this with the TC again and get the ball rolling on discussing the larger topic (e.g. via a subgroup?  RFC?  something else?)
  • Will involve Axel and Julian to a subgroup
• The TC approved mod-consortia, but also wanted to discuss the concerns raised about tenant isolation and relaxing tenant checks in certain circumstances.  The TC plans to discuss on Monday 6/5 11:00 AM ET. → Julian and Axel to join the meeting
• TC discussed on 2023-06-26 - Consortia Tenant Checks
• Raised this at the TC and the sentiment is that this group should work to resolve concerns with Olamide on its own.  Need to discuss next steps... 
  • Try to find a time for Olamide to discuss with us? 
  • Try to handle this "out of band" via slack, google doc, etc.?
  • Ask Olamide to join one of our Thursday meetings?
  • Something else?

Today:

• Craig McNally will reach out to Olamide to see how he'd like to proceed.Next steps need to be discussed with Axel Dörrer and Julian Ladisch 
• It seems that the conversation at this point is really between Olamide/the consortia team and the security team.
• The key concern is that we've sort of developed a home-grown SSO impl. in Folio modules.
  • One challenge is that we'd need either a single IdP with user data from all tenants, or a federated IdP which dispatches/brokers the calls to other IdPs.
  • Many universities already have some of this setup.

• Jakub Skoczen to bring this to the devops team asking to  bump elasticsearch to a major version in this case
• but there is the concern who should responsible to keep these environments up to date and maintain them in general
• the devops team is greatly lacking on resources and can't take the task permanently
• need to have a discussion in a wider group (TC?)
• Craig McNally to touch base with Jakub Skoczen about this in slack.  Get it on the TC agenda if needed.
  • My guess is that if DevOps can't do this, it will likely fall on the Kitfox team.  It should be discussed with Oleksii P. and Mark V. 
  • I don't think the TC will be helpful here since they don't direct development resources/teams/etc. 
• Craig McNally provided an update - last I heard Ingolf was going to bring this up at the SysOps SIG.  Ingolf may be on vacation.

Today:

• Craig McNally will bump bumped the thread with Ingolf to see if anybody has shown interest.and no volunteers have stepped forward...
• So where do we go with this now?

The wording should be adjusted, it's a little misleading

Also need to determine if this is a must have for the Refresh token work.

See discussion in slack channel for additional details.

TODO:

• Craig McNally to create a JIRA for using SameSite: Lax (or possibly Strict) instead of "None".  See refresh token PR in mod-login.
• Craig McNally to fix up OKAPI-853 with clarifications

Ideas:

• Lock down by default (to the hostname which OKAPI is using), but allow additional origins to be allowed via configuration
• UI developers often need the ability to point a locally hosted UI to a backend hosted elsewhere

Today:

• Deferred to discuss other important topics.Craig McNally will refresh his memory and try to make progress on these action items

• Reviewed tickets which haven't moved recently.  We made it up through EDGERTAC-72, then ran out of time.

Today:

• Not a huge problem due to needing to authenticate first, and the user has the required permissions to get the information sought after.
• If using AWS, WAF bot control may provide some protection w/ little effort - Skott Klebe to investigate.
• Craig McNally to check in with Skott on this