<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">As we have been getting LDAP set up for our local ArchivesSpace instance, our IT staff have raised a number of questions about the security of the login process, as well as the use of the staff interface. I have included portions of their
comments below:<o:p></o:p></p>
<p style="margin-left:.5in"><span style="color:#A0A0A8">Forwarded message:<o:p></o:p></span></p>
<p style="margin-left:.5in"><span style="color:#A0A0A8">On Friday, November 15, 2013 at 10:25 AM, David Brownell wrote:<o:p></o:p></span></p>
<p style="margin-left:.5in"><b>Subject:</b> RE: archivesspace and ldap and SSL<span style="color:#A0A0A8"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">archivesspace doesn't proxy nicely so it's nearly impossible to secure. I think it is still possible to proxy
<i>if it has its own IP address</i> but DS1 [our web application server] already has 4 and I'm not sure I'm willing to do that for this. It makes the whole thing less maintainable.<br>
<br>
It needs to be at the path's root because it does things like send you to /login. So I can't have it be /archivesspace (because it doesn't send you to /archivesspace/login). I have not seen any way to change the path of the thing, so that I can have it live
on /archivesspace/blah. Do you know of a way to change that? I messed with the config.rb frontend_url but it's NOT a URL, it's only looking at the host and port. Not the path!<br>
<br>
That said, I can work on LDAP authentication, but without a means of a secure connection, I don't want to do that and expose peoples password in plaintext.<br>
<br>
What are your thoughts? <br>
<br>
P.S. When I say "context" I mean the stuff after the server. For example, If I gave a url --
<a href="http://ds1.lib.byu.edu:9080/blah" target="_blank">http://ds1.lib.byu.edu:9080/blah</a> -- /blah would be the context.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="margin-left:.5in;text-align:center">
<span style="color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><br>
<b>Sent:</b> Monday, November 18, 2013 9:37 AM<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:12.0pt;font-family:"Times New Roman","serif";color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:black">I don’t know of a way to change it so it can live on /archivespace/blah. I think the url structure is pretty well baked in. It sounds like we might need to have a dedicated IP address.
It doesn’t necessarily need to live on DS1, if that helps. <o:p></o:p></span></p>
<div align="center" style="margin-left:.5in;text-align:center"><span style="color:black">
<hr size="2" width="100%" align="center">
</span></div>
<p style="margin-left:.5in"><br>
<b>Date:</b> Monday, November 18, 2013 at 9:53:13 AM<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">It's really,
<i>really</i> important that HTTP-listening applications that accept a password have the ability to do HTTPS. archivesspace needs to have the ability to listen on HTTPS with the ability to use a signed certificate for the communication.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal">Are there configuration options for making the login/staff interface available over HTTPS? Is this something that is expected to change in future versions of the software? And how should we advise our IT staff on setting this up on the
server?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for your guidance,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Cory Nimer<o:p></o:p></p>
<p class="MsoNormal">Manuscripts Cataloger/Metadata Specialist<o:p></o:p></p>
<p class="MsoNormal">Brigham Young University<o:p></o:p></p>
<p class="MsoNormal">1108 HBLL<o:p></o:p></p>
<p class="MsoNormal">(801) 422-6091<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>