2023-05-12 Sys Ops & Management SIG Agenda and Meeting notes

Owned by Ingolf Kuss
Last updated: May 12, 2023

Date and time

10-11 EST

https://openlibraryfoundation.zoom.us/j/591934220?pwd=dXhuVFZoSllHU09qamZoZzZiTWhmQT09

Topics

Attendees

TimeItemWhoNotes

WolfCon PlanningIngolf

The OLF folks want a draft list of session ideas by the first week of June, so less than one month from now.  You can see last year's FOLIO sessions here.  So, what technical sessions should we have this year?

Let's collect ideas for SysOps sessions today.

WolfCon 2023 planning form August 22 - 24nd.

Attendance in person: Tod Olson jroot 

Maccabee Levine has volunteered to wrangle together the technical FOLIO session proposals. 

-------------------------------

Suggestions:  A FOLIO install session (suggested by Ian Walls ?). Relevant to SysOps.

Probably not a big on-person audience of system operators. => Participate in other meetings of technical nature.

Managing deployment. Most are self-deploying.

One project: building a world-wide repository for Helm charts for FOLIO K8s deployment. Maybe not in github. Maybe together with dev team members ?

-----

Allow for a simpler basic install: Define Apps as collections of modules. Mike Taylor gave a presentation last year.

Deployment by Apps.  Not only important for new installers. Easier to automate end-to-end testing. Make testing easier. Enabeling future development.

Maybe the list of supported technologies ?

Sys Ops shall network with other technical folks on WolfCon session.

---------------------------

What needs to be adreesed most urgently ?

What are the most important problems:  documentation in docs.folio.org.  Many decisions that you have to make for your infrastructure.  Decisions about aws storage , minio, elasticsearch installation ,...     a mixture of different guides is online

Contribute back our experiences.

database tuning properly. Migrations runs. SRS imports failed after setup of Metadb. Critical non-folio dependencies need to be better documented.     Sessions with reporting people ?   The guides mention PSQL verion 12. It would be benefitial to switch to newer PSQL versions to increase performance.  

Linköping planning go live last week of July.

Integrations

Discovery integration . 


a new module mod-consortia whch adds consortia functionality to FOLIOIngolf

Let's touch the mod-consortia discussion here.

mod-consortia is a new module that has just undergone TC evaluation and has reached approvement of the TC : [TCR-26] Technical Evaluation of mod-consortia - FOLIO Issue Tracker . It will this become part of a future flower release. It is being planned for Poppy and Quesnelia.

All development issues are under the Epic issue [UXPROD-4049] Features that will be implemented to enhance FOLIO's ability to support consortia - FOLIO Issue Tracker .

mod-consortia adds cross-tenant functionality to FOLIO. 


There will be two new database tables: tenant and tenant_user.  These tables will be placed in the mod_consortia schema. 

The tenant table stores the information what tenant are part of the consortium.

The user_tenat tale is storing users and their associations to affiliations (=members of the consortium).

More details to the database schemas can be found here: Defining Tenant Schema For Consortia - Technical Designs and Decisions - FOLIO Wiki


The module introduces a consortia tenant.

The consortia tenant keeps track of what other tenants are part of the consortia.

As a user, you will experience your associated tenants, but that experience will be mediated by the consortia tenant.

 mod-consortia tries to change as little as possible of the existent functionality .

mod-consortia adds possibilities for managing multi-tenant implementations.
   
This has a lot to do with logins, authetifications and affiliations.
A user will have permissions in one or more tenants.
All users have a single entry point. They all log in via the same URI.
 The system then identifies a "home tenant" for this user.
  Users with multi tenant associations can change the active affiliation. They will then see the content of another tenant.
  A new option: Actions - switch active affiliation

Shadow users

 mod-consortia creates a "shadow user" in tenant C, if a user logs in to the consortia tenant and then switches to tenant C (which he/she is associated with).
  Effectively, the user is another user in tenant C than in tenant A (or B).

Settings

Configurations/settings are unique for all member institutions of a consortium.

In the consortia tenat, there will be additional settings to administer the tenants which are part of the consortium.

There will be a dedicated App "Consortia Manager"

I attached some screen shots that I took during the PC meeting: Screenshot (756).png Screenshot (757).png Screenshot (758).png Screenshot (759).png Screenshot (760).png Screenshot (761).png Screenshot (762).png Screenshot (763).png .

See also Q&A of Alexis Manheim in #folio-product-council Slack channel of today.

See also [MODAT-143] Introduce new token type for cross tenant requests - FOLIO Issue Tracker

----------------------

Raised concerns in the PC meeting:

  • how to not enable cross-tenant functionalities. Will it be practical to not enable the two new modules ? This questions could be likely answered by Sys Ops.
  • security concerns of the security team.  (see Axel's post in [TCR-26] Technical Evaluation of mod-consortia - FOLIO Issue Tracker). The security team raised objections on breaking the tenant separation on the Okapi level. At the moment, a user's Okapi token is unique to a tenant. The implementation plans for mod-consortia seem to imply that the user logs in with the same Okapi token (the token for the consortia tenant) to different affiliated tenants. The security teams considers this a potential security risk. They rather suggest a solution based on a saml sso login (i.e. using mod-login-saml) and having an Identity Provider make the identity checks. In this solution, the same FOLIO user will obtain different tokens , one for each tenant that the user is affiliated to. The authorization to access tenants A,B,C will be given by the identity provider, in this solution. At the Okapi level. the logins of the user will be separate. 
    • The security teams considers breaking the tenant separation on the Okapi level a breaking change and would like to see a reasoning for doing so.

 Not discussed today / Topics for next meeting:




SIG will re-meet May 19th to continue the discussion about planned WolfCon Sessions / participation in WolfCon sessions .

(some European countries have a holiday on Thursday, May 18 – but we will meet on the following day!)


Status of Integrations

Action items

  • Type your task here, using "@" to assign to a user and "//" to select a due date