0010-eureka

Summary

The Folio Eureka Platform (henceforth referred to as Eureka for brevity) represents the next generation of Folio’s architecture which allows the project to operate at enterprise scale and expand its solution space. It seeks to replace custom-developed core components found in the original Folio architecture, with feature-rich, best-of-class, specialized open-source components. The need for this has become critical as Folio has become widely adopted, and particularly in ever increasing numbers in complex configurations such as consortia and national libraries.

Motivation

It became increasingly clear that requirements imposed by some high-profile libraries adopting Folio were going to be very difficult, if not impossible to meet on the current platform.

Scope

This RFC is intended to cover all aspects of Eureka at a high level. This includes:

• Authentication

• Authorization

• Sidecars

• API Gateway/Routing

• Dynamic Scheduling/Timers

• Role Based Access Controls

• Application Formalization

  • Covered in more detail here: 0005-application-formalization

• Application Composition is Out of Scope

Detailed Explanation/Design

New Components

The Eureka platform introduces several new components. These will need to undergo some evaluation process. However, there is insufficient time in the proposed timeline to use the standard TCR/New module evaluation process.

• folio-kong - API Gateway, CORS

• folio-keycloak - Authorization, Authentication

• mgr-applications - Application (and constituent module) registration, Discovery information

• mgr-tenants - Tenant management

• mgr-tenant-entitlements - Application/Tenant entitlements

• folio-module-sidecar - Authorization, module-to-module request routing

• mod-roles-keycloak - Roles and policies

• mod-users-keycloak - Bridges the gap between user records in folio and in keycloak

• mod-consortia-keycloak - Alternative implementation of the consortia interface, compatible with Eureka

• mod-login-keycloak - Alternative implementation of the login interface, compatible with Keycloak

• mod-scheduler - Static and Dynamically defined timers

• mod-okapi-facade - Partial implementation of the okapi interface, primarily to support modules which call okapi APIs to get a list of entitlements, tenants, etc.

• ui-authorization-roles - User interface for role management

• ui-authorization-policies - User interface for policy management

• ui-plugin-select-application - Plugin for selecting/unselecting applications. Used by ui-authorization-roles.

• stripes-authorization-components - Components to be used by modules and applications that handle Authorization (ui-authorization-roles, ui-authorization-capabilities, etc.) duties

• application-poc-tools - Shared library used by many of the components listed above. Yes, it should be renamed.

• folio-flow-engine - Shared library used by some of the manager services

• folio-keycloak-plugins - Keycloak extensions/plugins

Deprecations

The following could be deprecated/archived once Eureka has been fully adopted and these components are no longer within the support period:

• Okapi - Functionality has been delegated to various single-purpose components

  • folio-kong

  • folio-keycloak

  • folio-module-sidecar

  • mgr-tenants

  • mgr-applications

  • mgr-tenant-entitlements

  • mod-scheduler

  • mod-okapi-facade

• mod-authtoken - Replaced by Keycloak/Sidecars

  <