- Koha - lists.katipo.co.nz

Re: [Koha] Koha Digest, Vol 237, Issue 7 - AI bot scrapers on library sites
by Dwight Walker 23 Jul '25

23 Jul '25

I found this article on how many libraries worldwide are being attacked by AI bot scrapers which are badly written and make many connections instead of one. http://www.libraryjournal.com/story/news/ai-bots-swarm-library-cultural-her… July 12, 2025 10:00 AM, koha-request(a)lists.katipo.co.nz wrote: > Send Koha mailing list submissions to > koha(a)lists.katipo.co.nz > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.katipo.co.nz/mailman/listinfo/koha > or, via email, send a message with subject or body 'help' to > koha-request(a)lists.katipo.co.nz > > You can reach the person managing the list at > koha-owner(a)lists.katipo.co.nz > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Koha digest..." > > Today's Topics: > > 1. Re: Missing shelf browser (Elaine Bradtke) > 2. Re: Slowness & outages (Stowasser Rainer) > 3. Re: Slowness & outages (Michael Kuhn) > 4. Re: Slowness & outages (Thomas Klausner) > 5. Re: Slowness & outages (Mark Alexander) > 6. Re: Slowness & outages (Mark Alexander) > 7. Re: Slowness & outages (Jason Boyer) > 8. Re: Slowness & outages (Mark Alexander) > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 10 Jul 2025 20:46:51 -0700 > From: Elaine Bradtke <eb(a)efdss.org> > To: koha <koha(a)lists.katipo.co.nz> > Subject: Re: [Koha] Missing shelf browser > Message-ID: > <CAPdfUuw16QHchDeQiZrb_jTup9LL12GSP9NWzqgnHvjbTKpgRQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > To clarify, the buttons to go back to the list or move to the next or > previous record are not displayed. > > Elaine > VWML <https://www.efdss.org/vwml> > > On Thu, Jul 10, 2025 at 4:16 PM Elaine Bradtke <eb(a)efdss.org> wrote: > >> We've just upgraded to 25.05.01. We use zebra searching. >> The browse shelf feature has vanished. We're also not able to go back to >> the list of search results. >> I didn't see any applicable preferences that needed to be changed. >> Has anyone else seen this? Any ideas what might be the problem? >> Thanks >> >> Elaine Bradtke >> VWML <https://www.efdss.org/vwml> >> English Folk Dance and Song Society <https://www.efdss.org> >> Cecil Sharp House, 2 Regent's Park Road, London NW1 7AY >> Tel +44 (0) 20 7485 2206 (This number is for the English Folk Dance and >> Song Society in London, England. If you wish to phone me personally, send >> an e-mail first. I work off site) >> -------------------------------------------------------------------------- >> Registered Company No. 297142 >> Charity Registered in England and Wales No. 305999 > > ------------------------------ > > Message: 2 > Date: Fri, 11 Jul 2025 05:31:17 +0000 > From: Stowasser Rainer <Rainer.Stowasser(a)geosphere.at> > To: Mark Alexander <marka(a)pobox.com>, Koha <Koha(a)lists.katipo.co.nz> > Subject: Re: [Koha] Slowness & outages > Message-ID: <fee81ed2aae24d3b95d5bbd1b68ace84(a)geosphere.at> > Content-Type: text/plain; charset="Windows-1252" > > we had the same Problem > > so our support firm hks3 installed > > https://anubis.techaro.lol > > it works fine. > > Kind regards > Hofrat Mag. Rainer Stowasser > Geosphere Austria IKS-Services > Vice Head Library, Publisher, Archive > branch manager Hohe Warte > > Hohe Warte 38, 1190 Vienna > T. +43 1 360 26 2006 > rainer.stowasser(a)geosphere.at | www.geosphere.at > > GeoSphere Austria – Bundesanstalt für Geologie, Geophysik, Klimatologie und Meteorologie | Anstalt > öffentlichen Rechts > Firmensitz: Hohe Warte 38, 1190 Wien | Firmenbuchnummer: 584036 b | Firmenbuchgericht: > Handelsgericht Wien > > ________________________________________ > Von: Koha <koha-bounces(a)lists.katipo.co.nz> im Auftrag von Mark Alexander <marka(a)pobox.com> > Gesendet: Donnerstag, 10. Juli 2025 23:34:26 > An: Koha > Betreff: Re: [Koha] Slowness & outages > > It looks I spoke too soon about my use of iptables to block out of > control web crawlers. Our Koha installation is now being attacked by > crawlers, and there are so many that using iptables isn't practical. > > Examining /var/log/apache2/other_vhosts_access.log shows that these > crawlers don't use any identification that can be used by fail2ban. > Here are a couple of them (with the name of our library changed, and URLs > shorted): > > koha.example.com:443 14.248.94.197 - - [10/Jul/2025:17:19:11 -0400] "GET > /cgi-bin/koha/opac-search.pl?... HTTP/1.1" 200 15946 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X > 10_11_1 rv:4.0; bem-ZM) AppleWebKit/535.45.1 (KHTML, like Gecko) Version/4.0.2 Safari/535.45.1" > koha.example.com:443 200.71.98.253 - - [10/Jul/2025:17:19:11 -0400] "GET > /cgi-bin/koha/opac-search.pl?... HTTP/1.1" 200 15960 "-" "Mozilla/5.0 (compatible; MSIE 9.0; > Windows CE; Trident/4.0)" > > Running a grep|sed|sort|uniq filter on the log show that we're being > attacked by almost 1000 crawlers today. > > I've tried adding these lines to /etc/apache2/apache2.conf: > > <IfModule mpm_worker_module> > MaxRequestWorkers 5 > </IfModule> > > But the attacks still keep both CPUs busy; top reports them as > follows: > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > 10319 rpl-koha 20 0 288340 234040 20880 R 80.1 5.9 0:04.14 /usr/share/koha > 10085 rpl-koha 20 0 0 0 0 R 68.1 0.0 0:17.03 starman worker > > I'm not sure what to do next. I had thought of using the apache2 > authz_core module to restrict Koha to a handful of IP addresses, such > as those used by computers at the library. But this would prevent > patrons from accessing the OPAC from home. I'm pretty desperate now. > Suggestions welcome. > > This is on Linode, in case that makes a difference. > > -- > I'm doing my part to help preserve life on earth > by trying to preserve my own. --Ashleigh Brilliant > > _______________________________________________ > > Koha mailing list http://koha-community.org > Koha(a)lists.katipo.co.nz > Unsubscribe: https://lists.katipo.co.nz/mailman/listinfo/koha > EXTERNAL EMAIL: Do not click any links or open any attachments unless you trust the sender and know > the content is safe. > > ------------------------------ > > Message: 3 > Date: Fri, 11 Jul 2025 09:21:27 +0200 > From: Michael Kuhn <mik(a)adminkuhn.ch> > To: koha(a)lists.katipo.co.nz > Subject: Re: [Koha] Slowness & outages > Message-ID: <0e7a0155-56bd-45d3-9c4c-c409ab5e4ba8(a)adminkuhn.ch> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Hi > > There is some documentation how to implement Anubis when running Koha: > > https://www.koha-support.eu/using-anubis-with-koha > > I tried it on my Koha demo installation ( https://koha.adminkuhn.ch ) > and as far as I can say it's the best approach. > > Best wishes: Michael > -- > Geschäftsführer · Diplombibliothekar BBS, Informatiker eidg. Fachausweis > Admin Kuhn GmbH · Pappelstrasse 20 · 4123 Allschwil · Schweiz > T 0041 (0)61 261 55 61 · E mik(a)adminkuhn.ch · W www.adminkuhn.ch > > Am 11.07.25 um 07:31 schrieb Stowasser Rainer: > >> we had the same Problem >> >> so our support firm hks3 installed >> >> https://anubis.techaro.lol >> >> it works fine. >> >> Kind regards >> Hofrat Mag. Rainer Stowasser >> Geosphere Austria IKS-Services >> Vice Head Library, Publisher, Archive >> branch manager Hohe Warte >> >> Hohe Warte 38, 1190 Vienna >> T. +43 1 360 26 2006 >> rainer.stowasser(a)geosphere.at | www.geosphere.at >> >> GeoSphere Austria – Bundesanstalt für Geologie, Geophysik, Klimatologie und Meteorologie | Anstalt >> öffentlichen Rechts >> Firmensitz: Hohe Warte 38, 1190 Wien | Firmenbuchnummer: 584036 b | Firmenbuchgericht: >> Handelsgericht Wien >> >> ________________________________________ >> Von: Koha <koha-bounces(a)lists.katipo.co.nz> im Auftrag von Mark Alexander <marka(a)pobox.com> >> Gesendet: Donnerstag, 10. Juli 2025 23:34:26 >> An: Koha >> Betreff: Re: [Koha] Slowness & outages >> >> It looks I spoke too soon about my use of iptables to block out of >> control web crawlers. Our Koha installation is now being attacked by >> crawlers, and there are so many that using iptables isn't practical. >> >> Examining /var/log/apache2/other_vhosts_access.log shows that these >> crawlers don't use any identification that can be used by fail2ban. >> Here are a couple of them (with the name of our library changed, and URLs >> shorted): >> >> koha.example.com:443 14.248.94.197 - - [10/Jul/2025:17:19:11 -0400] "GET >> /cgi-bin/koha/opac-search.pl?... HTTP/1.1" 200 15946 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X >> 10_11_1 rv:4.0; bem-ZM) AppleWebKit/535.45.1 (KHTML, like Gecko) Version/4.0.2 Safari/535.45.1" >> koha.example.com:443 200.71.98.253 - - [10/Jul/2025:17:19:11 -0400] "GET >> /cgi-bin/koha/opac-search.pl?... HTTP/1.1" 200 15960 "-" "Mozilla/5.0 (compatible; MSIE 9.0; >> Windows CE; Trident/4.0)" >> >> Running a grep|sed|sort|uniq filter on the log show that we're being >> attacked by almost 1000 crawlers today. >> >> I've tried adding these lines to /etc/apache2/apache2.conf: >> >> <IfModule mpm_worker_module> >> MaxRequestWorkers 5 >> </IfModule> >> >> But the attacks still keep both CPUs busy; top reports them as >> follows: >> >> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND >> 10319 rpl-koha 20 0 288340 234040 20880 R 80.1 5.9 0:04.14 /usr/share/koha >> 10085 rpl-koha 20 0 0 0 0 R 68.1 0.0 0:17.03 starman worker >> >> I'm not sure what to do next. I had thought of using the apache2 >> authz_core module to restrict Koha to a handful of IP addresses, such >> as those used by computers at the library. But this would prevent >> patrons from accessing the OPAC from home. I'm pretty desperate now. >> Suggestions welcome. >> >> This is on Linode, in case that makes a difference. >> >> -- >> I'm doing my part to help preserve life on earth >> by trying to preserve my own. --Ashleigh Brilliant >> >> _______________________________________________ >> >> Koha mailing list http://koha-community.org >> Koha(a)lists.katipo.co.nz >> Unsubscribe: https://lists.katipo.co.nz/mailman/listinfo/koha >> EXTERNAL EMAIL: Do not click any links or open any attachments unless you trust the sender and know >> the content is safe. >> >> _______________________________________________ >> >> Koha mailing list http://koha-community.org >> Koha(a)lists.katipo.co.nz >> Unsubscribe: https://lists.katipo.co.nz/mailman/listinfo/koha > > -- > Geschäftsführer · Diplombibliothekar BBS, Informatiker eidg. Fachausweis > Admin Kuhn GmbH · Pappelstrasse 20 · 4123 Allschwil · Schweiz > T 0041 (0)61 261 55 61 · E mik(a)adminkuhn.ch · W www.adminkuhn.ch > > ------------------------------ > > Message: 4 > Date: Fri, 11 Jul 2025 09:24:22 +0200 > From: Thomas Klausner <domm(a)plix.at> > To: koha(a)lists.katipo.co.nz > Subject: Re: [Koha] Slowness & outages > Message-ID: <aHC8JhVmBCNH_1ni(a)f13.plix.at> > Content-Type: text/plain; charset=us-ascii > > Hi! > > On Fri, Jul 11, 2025 at 05:31:17AM +0000, Stowasser Rainer wrote: > >> so our support firm hks3 installed >> >> https://anubis.techaro.lol >> >> it works fine. > > See a bit more info in our blog post here: https://www.koha-support.eu/using-anubis-with-koha > > OpenFifth also published a nice post, with a bit more background info: > https://openfifth.co.uk/fighting-the-ai-bots > > Greetings, > domm (HKS3) > > -- > Thomas Klausner domm https://domm.plix.at > Just another ( Perl | Postgres | Koha | Bicycle | Food | Photo | Vinyl ) Hacker > > Today I managed to write a #Postgres query using 2 CTEs and a window function to delete some > duplicate values (which should have been prevented by a proper unique constraint..) with only a > tiny peek into the docs (I forgot the name of the `row_number()` function). > [ 2025-07-10 19:40 > https://domm.plix.at/microblog.html ] > > Today #mst passed away. I really enjoyed meeting him at conferences, listeing to his weird & > wonderful (and thus very Perlish) talks and chatting with him during the social track. I guess I > use some of his code every day. :-( #Perl > https://www.shadowcat.co.uk/2025/07/09/ripples-they-cause-in-the-world > [ 2025-07-09 19:32 > https://domm.plix.at/microblog.html ] > > ------------------------------ > > Message: 5 > Date: Fri, 11 Jul 2025 07:45:36 -0400 > From: Mark Alexander <marka(a)pobox.com> > To: Stowasser Rainer <Rainer.Stowasser(a)geosphere.at> > Cc: Koha <Koha(a)lists.katipo.co.nz> > Subject: Re: [Koha] Slowness & outages > Message-ID: <1752234305-csup-4163(a)bionic.bloovis.com> > Content-Type: text/plain; charset=UTF-8; > > Excerpts from Stowasser Rainer's message of 2025-07-11 05:31:17 UTC: >> https://anubis.techaro.lol > > Thank you! I will look into this now. > > -- > I'm trying to live my life -- a task so difficult it > has never been attempted before. --Ashleigh Brilliant > > ------------------------------ > > Message: 6 > Date: Fri, 11 Jul 2025 08:22:17 -0400 > From: Mark Alexander <marka(a)pobox.com> > To: Thomas Klausner <domm(a)plix.at> > Cc: koha <koha(a)lists.katipo.co.nz> > Subject: Re: [Koha] Slowness & outages > Message-ID: <1752235419-csup-4685(a)bionic.bloovis.com> > Content-Type: text/plain; charset=UTF-8; > > Excerpts from Thomas Klausner's message of 2025-07-11 07:24:22 UTC: >> See a bit more info in our blog post here: https://www.koha-support.eu/using-anubis-with-koha > > This is helpful, but I'm puzzled by this line from the SSL configuration example: > > AssignUserID < > > This looks like it's missing something. I'm assuming it should be the > same as the equivalent line from the localhost:80 configuration > example: > > AssignUserID <instancename>-koha <instancename>-koha > > -- > My object is to save the world, while still leading > a pleasant life. --Ashleigh Brilliant > > ------------------------------ > > Message: 7 > Date: Fri, 11 Jul 2025 11:09:30 -0400 > From: Jason Boyer <JBoyer(a)equinoxoli.org> > To: Mark Alexander <marka(a)pobox.com> > Cc: koha <koha(a)lists.katipo.co.nz> > Subject: Re: [Koha] Slowness & outages > Message-ID: > <CANhZHJPi3EmYRa36HwbRJkad8=pZETPdt4vsLP2KsuMpCXYz9w(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hi Mark, while I would encourage you to keep looking into Anubis something > you can do to buy yourself some more time is to block user agents that are > almost certainly fake. One of your examples shows what claims to be MSIE 9 > running on Windows CE. Actual patrons are not running anything with Windows > 9X, NT 3/4/5, or CE, all of which you're likely to find single requests per > IP in your logs (and mostly wouldn't even be able connect to modern TLS). > Also blocking anything claiming to be Chrome or Firefox with a version less > than 100 (several years old by now) will make a huge difference without > actually impacting real users. Though that one may need to be narrowed down > to just Windows and macOS if you have some locations using old Linux > machines (usually Raspberry Pi's) running older versions of Chrome, because > it can't keep itself up to date as easily on Linux. > Good luck! > > Jason > > -- > Jason Boyer > Senior System Administrator > Equinox Open Library Initiative > JBoyer(a)equinoxOLI.org > +1 (877) Open-ILS (673-6457) > https://equinoxOLI.org > > On Fri, Jul 11, 2025 at 8:22 AM Mark Alexander <marka(a)pobox.com> wrote: > >> Excerpts from Thomas Klausner's message of 2025-07-11 07:24:22 UTC: >> See a bit more info in our blog post here: >> https://www.koha-support.eu/using-anubis-with-koha >> >> This is helpful, but I'm puzzled by this line from the SSL configuration >> example: >> >> AssignUserID < >> >> This looks like it's missing something. I'm assuming it should be the >> same as the equivalent line from the localhost:80 configuration >> example: >> >> AssignUserID <instancename>-koha <instancename>-koha >> >> -- >> My object is to save the world, while still leading >> a pleasant life. --Ashleigh Brilliant >> >> _______________________________________________ >> >> Koha mailing list http://koha-community.org >> Koha(a)lists.katipo.co.nz >> Unsubscribe: https://lists.katipo.co.nz/mailman/listinfo/koha > > ------------------------------ > > Message: 8 > Date: Fri, 11 Jul 2025 13:33:09 -0400 > From: Mark Alexander <marka(a)pobox.com> > To: koha <koha(a)lists.katipo.co.nz> > Subject: Re: [Koha] Slowness & outages > Message-ID: <1752254994-csup-1824(a)bionic.bloovis.com> > Content-Type: text/plain; charset=UTF-8; > > Excerpts from Jason Boyer's message of 2025-07-11 15:09:30 UTC: >> Hi Mark, while I would encourage you to keep looking into Anubis something >> you can do to buy yourself some more time is to block user agents that are >> almost certainly fake. > > I've implemented Anubis on our Koha installation, and it seems to be working. > > -- > Try to have as good a life as you can > under the circumstances. --Ashleigh Brilliant > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Koha mailing list > Koha(a)lists.katipo.co.nz > https://lists.katipo.co.nz/mailman/listinfo/koha > > ------------------------------ > > End of Koha Digest, Vol 237, Issue 7 > ************************************ Dwight Walker WWWalker Web Development Pty Ltd https://wwwalker.com.au

1 0

koha-US General Meeting Minutes for Wednesday, July 02, 2025
by Kristi Krueger 16 Jul '25

16 Jul '25

Hello, Here's a link to the minutes from the koha-US General Meeting held on Wednesday, July 02, 2025- https://docs.google.com/document/d/1TUKk8CAmbELtJ48Nf3X5stwgJTsGJIOChYSFPxS… The recording for the general meeting has been posted; there's a link to the recording in the minutes. koha-US meetings are open to all! The next general meeting will be on Wednesday, 06 August, 2025 at 8:30 am PT / 9:30 am MT / 10:30 am CT / 11:30 am ET. The next board meeting will be on Wednesday, 13 August, 2025 at 8:30 am PT / 9:30 am MT / 10:30 am CT / 11:30 am ET. Kristi Krueger koha-US Secretary secretary(a)koha-us.org

1 0

koha-US Board Meeting Minutes for July 09, 2025
by Kristi Krueger 15 Jul '25

15 Jul '25

Hello, Here's a link to the minutes from the koha-US board meeting on Wednesday, July 09, 2025- https://docs.google.com/document/d/1uA2PiSLz1n398tKpHRHab94XS3pZfljK0Ttt0o3… Special thanks go to Chip Halvorsen for covering the minutes from this meeting! koha-US meetings are open to all! Board meetings are held on the second Wednesday of each month at 8:30 PT / 9:30 MT / 10:30 CT / 11:30 ET. The next koha-US General Meeting will be on Wednesday, August 06 @ 8:30 PT / 9:30 MT / 10:30 CT / 11:30 ET (time converter <https://timeanddate.com/worldclock/fixedtime.html?msg=koha-US+February+Gene…> ). Please note, the minutes for the General Meeting from July 02 are still forthcoming. If you have additional topics for the General Meeting agenda, please send them to secretary(a)koha-us.org. Kristi Krueger koha-US Secretary secretary(a)koha-us.org

1 0

Call for news - Newsletter July 2025
by Michael Kuhn 14 Jul '25

14 Jul '25

Hi I'm collecting news for the July 2025 Koha Community Newsletter. Please send anything noteworthy to: mik (at) adminkuhn (dot) ch News criteria: * Relevant news items can be of any length. * Images are fine. * Anything and everything Koha. * Submit by the 26th of the month. Text format criteria: * Just structured plain text, or * HTML text to include tables or similar For events: * Consider adding your event to the Koha Community calendar at https://koha-community.org/calendar/ Thank you! Michael Kuhn Editor, Koha Community Newsletter

1 0

Slowness & outages
by Chris Davis 12 Jul '25

12 Jul '25

Dear Colleagues, My library consortium is hosted by ByWater Solutions and during the last seven days, several times Koha has been slow and then there's an outage for thirty to sixty minutes then things are fine for a while, then there's more slowness and outage. ByWater is addressing these issues, but I want to know if anyone else's sites or clients are having issues like these? I am also trying to get educated on modern internet threats and causes for issues like this. ByWater told us that the cause of these issues are the many, many AI bots that are crawling our site and ByWater has put our site behind CloudFlare for protection. I also know that at https://status.bywatersolutions.com, ByWater mentioned that their upstream provider have had issues with SSL errors and major data packet loss. Thank you, Christopher Davis Technical Services Specialist Lincoln County Library District (541) 264-8141 <tel:5412648141> christopher.davis(a)lincolncolibrarydist.org www.lincolncolibrarydist.org <https://www.lincolncolibrarydist.org> Click to view my schedule or book an appointment w/ me <https://calendar.app.google/6Ymx4UrHiTfR6faaA>

10 14

Missing shelf browser
by Elaine Bradtke 11 Jul '25

11 Jul '25

We've just upgraded to 25.05.01. We use zebra searching. The browse shelf feature has vanished. We're also not able to go back to the list of search results. I didn't see any applicable preferences that needed to be changed. Has anyone else seen this? Any ideas what might be the problem? Thanks Elaine Bradtke VWML <https://www.efdss.org/vwml> English Folk Dance and Song Society <https://www.efdss.org> Cecil Sharp House, 2 Regent's Park Road, London NW1 7AY Tel +44 (0) 20 7485 2206 (This number is for the English Folk Dance and Song Society in London, England. If you wish to phone me personally, send an e-mail first. I work off site) -------------------------------------------------------------------------- Registered Company No. 297142 Charity Registered in England and Wales No. 305999

1 1

koha-US Board Meeting Reminder for Wednesday, July 09, 2025
by Kristi Krueger 07 Jul '25

07 Jul '25

Hello! The next koha-US Board Meeting is Wednesday, July 9, 2025. When: 8:30a PT / 11:30a ET (time converter <https://www.timeanddate.com/worldclock/fixedtime.html?msg=koha-US+Board+Mee…> ) Where: Zoom <https://us02web.zoom.us/j/293750042?pwd=SGQzS2pmU3prNFhYRHNaeTFhOHN4QT09> Agenda: https://docs.google.com/document/d/15GkKrKRKKj4wtQTmZF3nr4DLOOZiB__t0LtILm_… If you have additional topics for the agenda, please send them to secretary(a)koha-us.org. Meetings are held via Zoom video conferencing. A microphone and webcam are recommended but not required. Zoom is available for Windows, Mac, and Linux on desktops, and Android and iOS on mobile devices. For help getting started, visit: https://support.zoom.us/hc/en-us/categories/200101697 These meetings are always free and open to any and all. Kristi Krueger koha-US Secretary secretary(a)koha-US.org

1 0

The Terrific Every-Other-Thursday Training Video | 520
by BRANNON, CHRISTOPHER 04 Jul '25

04 Jul '25

koha-US supplies the Koha community with wealth of information, some development opportunities, and an assortment special interest groups for many topics Koha, not to mention five seasons of a couple of good looking guys trying to educate the community on using Koha beyond the out-of-the-box experience. Today George will talk about one of several quick reference guides available to new users. https://youtu.be/AI2MkpZyiSs Sincerely, Christopher Brannon koha-US Admin

1 0

Re: [Koha] moving from local IP to OpenAthens SSO access - Koha users
by David Cook 03 Jul '25

03 Jul '25

Hi Jeff, Joel has broken things down overall pretty well here. I'll step you through a little example. - Koha connects to Microsoft Entra ID using OpenID Connect - OpenAthens connects to Microsoft Entra ID using OpenID Connect (or whatever protocol but this one is the easiest to setup) - Koha contains catalogue records with OpenAthens links - User clicks a "Microsoft Login" button on Koha, they're redirected to Microsoft Entra ID, they login, they're redirected back to Koha as an authenticated user - User does some searching in Koha and click on an OpenAthens link. OpenAthens redirects them to Microsoft Entra ID. Microsoft Entra ID recognizes they're already logged in (so the user doesn't need to log in again), and redirects back to OpenAthens as an authenticated user - User does further work in Koha or OpenAthens and they don't involve Microsoft Entra ID anymore, since they're now logged into these apps. I would recommend using OpenID Connect as your SSO protocol, as it's easy to setup and very effective. In new versions of Koha, you can set it up largely on your own. The only thing you need your Koha provider to do is restart your Koha instance after you put in the configuration. -- One of my Koha libraries actually has a more advanced setup. They wanted to use SSO with Koha and OpenAthens, but they didn't have an Identity Provider like Microsoft Entra ID. So what we did is we hosted the open source Identity Provider Keycloak for them, and we built an extension that lets Keycloak use Koha's user store as its user database. We then hooked Koha and OpenAthens up to Keycloak using OpenID Connect, so they got SSO while being able to manage everything in Koha and users got to keep their existing passwords. -- Overall, it's not a particularly complicated process. IT people might try to scare you about it, but if the technical people know what they're doing - it's very simple. Using SAML instead of OpenID Connect does take more work to setup because the Koha and the Identity Provider (and the OpenAthens and the Identity Provider) needs to produce a signed metadata file to exchange, and Koha needs additional server-side config, but it's the same SSO concept at the end of the day, so same end user user experience. Anyway, hope that helps! David Cook Senior Software Engineer Prosentient Systems Suite 7.03 6a Glen St Milsons Point NSW 2061 Australia Office: 02 9212 0899 -----Original Message----- Date: Wed, 2 Jul 2025 15:15:51 -0500 From: "Coehoorn, Joel" <jcoehoorn(a)york.edu> To: Jeffrey Gabel <jeff.gabel(a)brooklaw.edu> Cc: Koha Community Mailing List <koha(a)lists.katipo.co.nz>, "koha-us(a)koha-us.org" <koha-us(a)koha-us.org> Subject: Re: [Koha] moving from local IP to OpenAthens SSO access - Koha users Message-ID: <CAMSeE4aBJ0mpD+qNkOw4hsTH7i-fJ3hpTHnX7Gaa6=gqLyy_Og(a)mail.gmail.com> Content-Type: text/plain; charset="UTF-8" For this to work, you should **already** have functional SSO in your organization, usually including between Koha and a primary identity provider, such as MS Active Directory, Google, MS Azure/Entra, or an open provider of some sort (usually some flavor of LDAP). This might be provided by something like Okta, Duo, AD FS, MS Entra Enterprise Applications, or some other SAML or SAS (or even OAuth) service. OpenAthens then uses your existing SSO service to simplify connecting to licensed academic services: things like discovery, journals, serial articles, academic search, etc. You only need to set up the **one** connection between your SSO service and OpenAthens, and then OpenAthens has already done the hard work to know how to federate this with anyone else you might need. This allowed us, for example, to retire an old and insecure EZProxy service for students to get remote access to our licensed digital collections. But you need to have the initial SSO going first. Note Koha does *not* necessarily need to participate in this process at all. In this scheme, Koha is just one more application, and OpenAthens is another. Both depend on your SSO connection to an identity provider separate from each other. We used to have students connect to Koha via a SAML SSO connection, and this connection still works, but today students here interact with our catalog entirely via the EBSCO Discovery platform. The authentication path between EBSCO and our network is EBSCO => OpenAthens => AD FS (SAML) SSO => MS Active Directory. Eventually it will be EBSCO => OpenAthens => MS Entra Enterprise Application => MS Entra/Azure AD, but that's still a ways off. The main thing is neither case ever involves our Koha installation. But that's the student view. Library staff still directly use Koha for circulation and cataloguing. They authenticate to Koha via SSO, which is Koha => AD FS (SAML) SSO => MS Active Directory. (And the setup between Koha and AD FS was **not** simple or trivial, let me tell you). But again: this is optional. We could give library staff direct accounts/credentials within Koha, and skip the SSO here. The point is: you want existing separate SSO infrastructure before starting with OpenAthens. Then Koha can participate as a service provider/relying party to use account infrastructure and credentials kept elsewhere. This is also useful for getting MFA working, which makes the GLBA people happy. But I'm not sure I've ever seen it act as an identity provider, and its participation with an OpenAthens integration is a separate thing. I don't see it as part of the flow between your identity provider and OpenAthens, or between OpenAthens and other applications. If you're wanting to use existing accounts (and credentials) in Koha as an Identity Provider (IdP), it may be possible but I've not heard of anyone attempting it. *Joel Coehoorn* Director of Information Technology *York University* Office: 402-363-5603 | jcoehoorn(a)york.edu | york.edu

1 0

moving from local IP to OpenAthens SSO access - Koha users
by Jeffrey Gabel 03 Jul '25

03 Jul '25

Hello, Brooklyn Law School is in the process of moving to SSO access with OpenAthens. We are wondering if other Koha users who have gone through this process could share their experiences and give advice. We are not clear on how an automated Athenizing of links in our cataloging will work. We also don't have any information about how to deal Athenizing links going forward as the catalog's holdings continue to change. Any help would be greatly appreciated. Thanks, Jeff Gabel Acquisitions Librarian Brooklyn Law School Library 250 Joralemon Street Brooklyn, NY 11201 718-780-7978 jeff.gabel(a)brooklaw.edu

2 1