PUC Technical Requirements for Alma and Primo Implementation

Technical
Requirements for Alma

and Primo
Implementation

Ex Libris Confidential

CONFIDENTIAL INFORMATION

The information herein is the property of Ex Libris Ltd. or its affiliates and any misuse or abuse will result in
economic loss. DO NOT COPY UNLESS YOU HAVE BEEN GIVEN SPECIFIC WRITTEN
AUTHORIZATION FROM EX LIBRIS LTD.
This document is provided for limited and restricted purposes in accordance with a binding contract with
Ex Libris Ltd. or an affiliate. The information herein includes trade secrets and is confidential.

DISCLAIMER

The information in this document will be subject to periodic change and updating. Please confirm that you
have the most current documentation. There are no warranties of any kind, express or implied, provided in
this documentation, other than those expressly agreed upon in the applicable Ex Libris contract. This
information is provided AS IS. Unless otherwise agreed, Ex Libris shall not be liable for any damages for use
of this document, including, without limitation, consequential, punitive, indirect or direct damages.
Any references in this document to third-party material (including third-party Web sites) are provided for
convenience only and do not in any manner serve as an endorsement of that third-party material or those
Web sites. The third-party materials are not part of the materials for this Ex Libris product and Ex Libris has
no liability for such materials.

TRADEMARKS

"Ex Libris," the Ex Libris bridge , Alma, Primo, Aleph, Alephino, Voyager, SFX, MetaLib, Verde, DigiTool,
Preservation, URM, Alma, Voyager, ENCompass, Endeavor eZConnect, WebVoyage, Citation Server,
LinkFinder and LinkFinder Plus, and other marks are trademarks or registered trademarks of Ex Libris Ltd.
or its affiliates.
The absence of a name or logo in this list does not constitute a waiver of any and all intellectual property
rights that Ex Libris Ltd. or its affiliates have established in any of its products, features, or service names or
logos.
Trademarks of various third-party products, which may include the following, are referenced in this
documentation. Ex Libris does not claim any rights in these trademarks. Use of these marks does not imply
endorsement by Ex Libris of these third-party products, or endorsement by these third parties of Ex Libris
products.
Oracle is a registered trademark of Oracle Corporation.
UNIX is a registered trademark in the United States and other countries, licensed exclusively through
X/Open Company Ltd.
Microsoft, the Microsoft logo, MS, MS-DOS, Microsoft PowerPoint, Visual Basic, Visual C++, Win32,
Microsoft Windows, the Windows logo, Microsoft Notepad, Microsoft Windows Explorer, Microsoft
Internet Explorer, and Windows NT are registered trademarks and ActiveX is a trademark of the Microsoft
Corporation in the United States and/or other countries.
Unicode and the Unicode logo are registered trademarks of Unicode, Inc.
Google is a registered trademark of Google, Inc.

Copyright Ex Libris Limited, 2016. All rights reserved.
Document updated: January 2016

Web address: http://www.exlibrisgroup.com

Ex Libris Confidential 2

Table of Contents

1 Introduction 4

The Alma Cloud Deployment Model 4

2 Making the Cloud Vision a Reality 5

True Multi-tenancy 5

Vendor-Managed Updates 5

Seamless Integration/Open Platform 6

Security 6

Performance and Service Availability 7

3 Network Communication 8

Browser Communication 8

Browser Display Resolutions and Other Requirements 8
Browser Certification 9
Discontinued Browser Version Support 10

Network Communication 10

Alma IP Range 10
Alma-Primo 11
Alma-Primo PDS (Patron Directory Services) 11
Primo Back Office 12
Alma-MetaLib (When MetaLib is in Use) 12
Alma – Self-Check Machines/SIP-based Systems 12
Alma-Financial/SIS Systems/Vendor EOD, EDI/SMS (File-Based) 13
OCLC Connexion 13
ISO Resource Sharing (ILL) 13
Data Providing 14
Alma Authentication 14
Printers 15
Mail Relay Gateways 15
UStat 16
Network Communication Diagram and Table 16

Ex Libris Confidential 3

1

Introduction

Ex Libris Alma is a pure cloud-based Software-as-a-Service (SaaS). Its architecture is
based on leading cloud technologies, offering a secure, scalable SaaS. As a SaaS solution,
Alma is accessible over the Web, requiring a Web browser for the end user. The move to
a cloud-based SaaS offers great benefits and cost savings, together with faster response
time to user requests. This document describes Alma cloud fundamentals, the
technology driving the Alma cloud, the IT side of the Alma cloud infrastructure, and the
Alma cloud's interaction with local library systems.

The Alma Cloud Deployment Model

Ex Libris operates its cloud infrastructure as a private cloud, which is solely available for
use by its customer community. This deployment model differs from a public cloud,
which is available to the general public, or a hybrid cloud, which is a combination of two
or more clouds.
Private cloud implementation provides Ex Libris with the opportunity to benefit from
cloud computing without compromising on the architectural control required to ensure
integrity of its customers’ data, systems, and processes.

Note: This document goes hand-in-hand with the Getting Ready for Alma and Primo
Implementation document, also available under Alma > Product Documentation >
Implementation on the Documentation Center.

Ex Libris Confidential 4

2

Making the Cloud Vision a Reality

True Multi-tenancy

The Alma system is based on multi-tenant architecture, in which the resources – both the
source code of the application and the underlying database – are shared, in order to
support multiple customers simultaneously.

Strict data isolation is applied to all layers of the Alma application: user-interface
branding isolation, database isolation (via Oracle Virtual Private Database), storage
isolation, and FTP-level isolation.

Ex Libris is committed to deliver a reliable and secure application to each of the residing
customers. The customers’ user experience is similar to that of a user who runs a
dedicated application. Moreover, this delivery model enables Ex Libris to provide its
customers with a fault-tolerant computing environment that includes dynamic resource
allocation.

Vendor-Managed Updates

Because Alma is designed in accordance with the SaaS model, and deployed as a cloud-
based service, it is Ex Libris' full responsibility to handle the software updates and
upgrades. Ex Libris is committed to ensuring that its customers always have access to
the latest features and incurs all the costs of maintaining and upgrading the required
software. This enables all customers to fully take advantage of the latest Alma features
and innovation.

The software updates are deployed on a live system. It is of the highest priority,
therefore, that updates be handled in a seamless manner for customers in production.

Ex Libris handles the ongoing monthly releases, which include defect fixes and minor
enhancements and do not impact day-to-day business. In the future, there will also be
periodic releases (about three times a year), which will include new features and
functionality.

Ex Libris Confidential 5

Seamless Integration/Open Platform

Alma is built using a service-oriented architecture (SOA) and embodies Ex Libris’ Open
Platform philosophy. This enables openness and interoperability between Alma, the
Data Services environment, and other applications in the library environment – whether
developed by third-parties or locally.

The Open Platform means open interfaces. It contains Apps, Web services, Web
adapters, Application Programming Interfaces (APIs), plug-in interfaces, and more.

The Open Platform allows customers to share customer-written code so that one
customer can benefit from the developments of another customer, leveraging the
investments made by others for the benefit of everyone.

The following illustration demonstrates the various options for utilizing the Alma Open
Platform to integrate with remote systems that are part of the institution and library
landscape.

Security

Cloud security and confidentiality are top concerns with cloud computing and SaaS
architecture. Committed to providing its customers with the most secure and reliable
environment, Ex Libris has developed a multi-tiered security model that covers all
aspects of cloud-based Ex Libris systems. The security model and controls are based on
renowned international protocols and standards and industry best practices, such as
ISO/IEC 27001:2005 and ISO/IEC 27002, the standards for an information security
management system (ISMS).

Ex Libris Confidential 6

Performance and Service Availability

Ex Libris is aware of the fact that the performance of its cloud applications can have a
significant impact on customer adoption and satisfaction. Ex Libris’ cloud data centers
leverage their infrastructure-renowned technologies and applications in order to meet
the performance service-level agreements (SLAs) to which the Ex Libris is committed.

Moreover, Ex Libris employs a dedicated cloud services team, which is responsible for
monitoring the applications and platform performance and issuing periodic SLA
reports.

Ex Libris Confidential 7

3

Network Communication

As a library management solution, Alma must communicate with different local library
systems. This section describes the different local systems with which Alma may need to
communicate and the communication methods used.

Browser Communication

As a true cloud solution, Alma requires only a browser for the end user. Alma supports
all the leading browsers: Chrome, Firefox and Internet Explorer. There is an ongoing
process of monitoring new browser versions and checking their compatibility with
Alma. Full browser support details are noted below.

Browser to Alma communication is conducted using SSL, over ports 443. The URLs
(domains) to be used are provided to you by your Ex Libris project manager.

Note: Due to HTTP/S network latency in APAC countries (which is not prevalent in other
countries), Ex Libris provides both primary and alternate domain names. The primary
domain name points to an accelerated server. It is referred to as <Alma domain> in the
documentation. In cases where the accelerated server is not working, or for non-HTTP/S
connections to Alma, use the alternate domain name, referred to in the Alma
documentation as <Alma alternate domain>.

Similarly, primary and alternate delivery domain names are provided for APAC countries.
The alternate delivery domain name is referred to in the documentation as <Alma alternate
delivery domain>.

Browser Display Resolutions and Other Requirements
 The Alma user interface is designed to work with the following screen resolutions

and monitors:

 Minimum recommended monitor size is 17”; 19” is preferable.
 Minimum required resolution is 1024x768 (1280*800 recommended).

Ex Libris Confidential 8

 For all browsers, you must enable JavaScript, cookies, and SSL 3.0.

Browser Certification

Ex Libris’ browser certification is based on industry usage statistics (W3C) as published
on the following site: http://www.w3schools.com/browsers/browsers_stats.asp.

The following table describes the certified browsers:

Browser Description

Microsoft® Internet Explorer® Certified versions: 8,9,10

Ex Libris will make every effort to test and certify a new
browser version for Microsoft® Internet Explorer® when its
industry usage is over 20% of all versions of this browser.

Mozilla® Firefox® Ex Libris makes every effort to test and certify the most recent
Google Chrome™ stable version of Firefox on an on-going basis.

In addition, Mozilla offers an Extended Support Release (ESR)
based on the official release of Firefox for desktops for use by
organizations, including schools, universities, businesses, and
others who need extended support for mass deployments.

Ex Libris will make every effort to test and certified the latest
ESR version, after the overlap period between the older and
newer ESR version is over.

As with Firefox, Ex Libris makes every effort to test and certify
the most recent stable version.

Note: Google Chrome applies updates automatically.

Note:

- For staff users, Alma supports browsers whose total usage (across all versions) exceeds
20% for a certain time, based on industry usage statistics.

- Browser certification for Analytics may not be as updated as browser certification for
Alma, although we strive to ensure that updates for Alma are applied to Analytics as soon
as possible.

- Primo end-user interface additionally supports Safari® 6+ for Mac®.

Ex Libris Confidential 9

Discontinued Browser Version Support

Ex Libris may discontinue supporting a certain browser version based on its industry
usage in general and actual usage in Alma. Issues reported that are specific to a browser
version that has been discontinued will not be actively investigated or corrected.

Ex Libris will give prior notice when support of a browser version is discontinued.

Network Communication

To function properly and completely, Alma must communicate with different locally
installed systems, such as financial systems, student information systems (SIS), self-
check (SIP) machines, and other third-party systems.

The sections below describe the different components that Alma may communicate with
outside of its cloud network. There is a table listing the different network
communications used, as well as a network diagram illustrating the communication,
protocol, and direction (in/out). Not all listed communications are necessarily relevant
for each institution.

Note: Ex Libris does not provide an FTP/SFTP server. If you need to store files on an
FTP/SFTP server for file-based integrations with Alma, you must provide your own FTP
server.

Alma IP Range

Some local systems with which Alma integrates (for example, ERP, SIS, SFTP, SIP
machines) may require these Ex Libris regional IP/s in order to communicate with Alma.

The following IPs/IP ranges must be allowed access to/from your institution. (Note that
the IP ranges below are in CIDR notation.)

 In North America (refers to the Ex Libris Chicago data center):

66.151.7.128/26 [66.151.7.128-191]
66.151.7.192/28 [66.151.7.192-207]
74.217.12.128/27 [74.217.12.128-159]
66.151.14.129
64.74.237.229
64.74.237.233
64.74.237.221

 In Europe (refers to the Ex Libris Amsterdam data center):

95.172.90.160/27 [95.172.90.160-191]
31.186.254.128/28 [31.186.254.128-143]

Ex Libris Confidential 10

 In APAC (refers to the Ex Libris Singapore data center):

117.20.42.16/31 [117.20.42.16-17]
117.20.42.32/27 [117.20.42.32-63]
117.20.42.137

Note that access to the above IP ranges may require firewall settings at the institution
level and inclusion in the institution's SPF DNS record (in order to avoid Alma emails
potentially being handled as spam).

Alma-Primo

Ex Libris Primo customers that are also Alma users work with Primo in the Ex Libris
cloud and thus benefit from a complete cloud environment and smooth updates of both
solutions. Alma and Primo communicate within the Ex Libris cloud network and the
only external communication is between patrons and Primo functions over port 80 or
443.

Note: If you have PCs in your institution that are open only to specific servers and ports
(and specifically to Primo), make sure that these PCs/firewalls are also open to the Alma
server and port.

The topology of Alma with a local Primo is no longer supported; the following
description remains in this document for backward compatibility purposes only. In such
cases, Alma communicates with Primo in a bi-directional manner, as follows:

 AlmaPrimo: an OAI-PMH XML of published metadata is sent from Alma to Primo

via Secured FTP over ports 21/22

 Alma Primo: bi directional HTTP/S communication of patron services over port

443

For more information on Alma-Primo integration, refer to the Alma-Primo Integration
information on the Ex Libris Knowledge Center.

Alma-Primo PDS (Patron Directory Services)

Patron requests delivered to Alma via Primo (Get It, View It, and so forth) are verified
and authenticated prior to any service being rendered. The flow is such that patrons are
first required to authenticate in Primo PDS. After they successfully authenticate, they
receive an authentication token. Alma communicates with Primo-PDS in a bi-directional
manner, over a secured HTTP/S port (443), in order to validate the patron authentication
token prior to providing the requested services.

Ex Libris Confidential 11

Primo Back Office

In order for staff users to access the Primo Back Office, outgoing HTTP/S communication
must be allowed/opened on port 1601. Port 1443 is used for Primo Back Office access for
environments that were set up with SSL.

Alma-MetaLib (When MetaLib is in Use)

For local installations of MetaLib, where MetaLib communicates with Alma for full-text
indication, the communication between Alma and MetaLib is via API over HTTP port
80.

For hosted MetaLib, Alma and MetaLib communicate within the Ex Libris cloud
network.

Alma – Self-Check Machines/SIP-based Systems

Alma supports communication over the SIP2 protocol, which is used primarily for
communication with local self-check machines. The communication is bi-directional.

Since the vast majority of the SIP-based systems were built and designed without the
cloud in mind, the SIP2 protocol lacks several components in order to fully support a
cloud-based SaaS – namely, a unique institution ID and secure communication channel
(which is supported in SIP3). Once SIP3 becomes the de-facto standard with cloud
capabilities, Ex Libris will support it as well.

To secure SIP2 communication, Alma uses an open source SSL encryption wrapper
called Stunnel (http://www.stunnel.org). This is a lightweight component installed
locally on standard operating systems, such as Linux or Windows (see supported
operating systems: https://www.stunnel.org/ports.html). This component creates a
secure TCP "tunnel" communication over port 6443 with Alma and also serves as a
means to uniquely identify and securely route each institution’s requests.

The communication flow is as follows:

 The SIP2 local machines communicate with Stunnel software that is installed on the

local Windows/Linux workstation.

 The Stunnel encryption component encrypts the TCP communication using a

standard encryption method and a security certificate, and will send the SIP2
requests to the Alma cloud over the secure port 6443.

Ex Libris Confidential 12

The following diagram describes this architecture:

Alma-Financial/SIS Systems/Vendor EOD, EDI/SMS (File-Based)

Alma exchanges data with local financial systems, student information solutions, and
embedded order data (EOD) using files. FTP or secure FTP is used to facilitate this
communication over ports 21/22. SMS communication is also file-based via FTP or
secure FTP.

For information on integrating Alma with these systems, refer to the Alma Integration
with External Systems information on the Ex Libris Knowledge Center.

OCLC Connexion

OCLC Connexion (Web or client) interacts with Alma using the TCP-based protocol.
Communication occurs via a single port (5500), rather than multiple ports, in order to
simplify implementation, while maintaining secure and separate access per institution to
the service. This port is open on Ex Libris' side. Ensure that it is open for your institution
as well for the workstations which require OCLC Connexion communication with Alma

To support communication via port 5500, configuration is required in both Alma and
OCLC Connexion (Client/Web). For details, refer to the Importing Records from OCLC
Connexion section of the Alma Integration with External Systems information on the Ex
Libris Knowledge Center.

ISO Resource Sharing (ILL)

Alma enables you to process a full set of resource sharing activities and manage
communication with resource sharing partners via port 9001, using the following ISO
resource sharing (ILL) messages:

Ex Libris Confidential 13

 ILL Request
 Shipped
 Received
 Returned
 Checked-In
 Answer – Unfilled
 Cancel/Cancel Reply
 General Messages

To setup the communication, configuration is required in Alma. For details, refer to the
Resource Sharing Requests section of the Alma Integration with External Systems
information on the Ex Libris Knowledge Center.

Data Providing

Alma supports several different standard methods of sharing Alma title data with third-
parties. Some involve standard online protocols to allow authorized individuals to
search their Alma catalog directly (Z39.50 – TCP, OAI-PMH – HTTP/S, SRU-SRW –
HTTP/S, Google scholar and other third-parties from the Primo service page and Alma
delivery – HTTP/S).

Others involve publishing data for use outside of Alma (using Alma’s robust publishing
platform) in a file-based manner using FTP or Secure FTP.

Alma Authentication

To ensure data privacy, end-user authentication must be performed via an institutional
identity management system (such as Lightweight Directory Access Protocol/LDAP or
SAML 2.0). Your external authentication system must be up and running properly
before you can begin Alma implementation.

Alma supports authentication of staff users via the institutional LDAP (Lightweight
Directory Access Protocol), using a secure connection. The connection should be secured
with a certificate issued by a recognized certificate authority (such as Comodo, Verisign,
or Thawte). To allow LDAP integration, the Alma Data Center IP ranges (mentioned
above, according to your location) must be defined. You must also open the port for
communication initiated by Alma in the firewall (port 636), as listed in the table below.

In addition, Alma supports SAML (Security Assertion Markup Language), which is an
XML-based, open standard data format for exchanging authentication and authorization
data between parties via HTTP/S—in particular, between an identity provider and a
service provider such as Alma. The most important problem that SAML addresses is the

Ex Libris Confidential 14

Web browser single sign-on (SSO) problem. Alma supports the SAML 2.0 Web Browser
SSO profile.

For more information on LDAP and SAML, refer to the Authentication of Users in
Alma section of the Alma Administration information in the Ex Libris Knowledge Center.

Printers

As a cloud solution, Alma cannot simply be connected directly to your local
network/printers due to security concerns and technical limitations. Printing from Alma,
therefore, is handled via email. Each library/institution defines the email addresses of its
local printers in Alma, which route staff-oriented, Alma-originating e-mails (including
request and transit slips) to the appropriate printer.

Newer printers have their own built-in email addresses to support cloud computing. If
you are using a new printer, therefore, the email address for notifications should be the
printer’s email address.

Older printers do not support direct emailing and will therefore require a print proxy.
There are several applications available to manage printer routing. For example:

 MS Outlook printing rules – It is possible to create an email address and link this

address to a printer via your MS Outlook printing rules.

 Automatic Email Manager (AEM) by Namtuk – For details, see

http://www.namtuk.com/

Note: The above are examples only. Any print proxy that meets your institution's needs
can be used.

Mail Relay Gateways

For email communication, Alma uses dedicated mail-relay servers in each region.

Ex Libris supports Transport Layer Security (TLS) on the Alma email servers to deliver
mail securely.

Secure SMTP over TLS includes the following key features:

 Encrypted messages – TLS uses Public Key Infrastructure (PKI) to encrypt messages

from mail server to mail server.

 Authentication – TLS supports the use of digital certificates to authenticate the

receiving servers. This process verifies that the receivers (or senders) are the
legitimate receivers/senders, which helps prevent spoofing.

The preferred (default) setup of the Alma email servers involves the use of encrypted
transactions. If a customer’s email servers support TLS, Ex Libris upgrades the SMTP
session to use TLS. If TLS is not supported on the customer’s email servers, Ex Libris
establishes the session without TLS.

Ex Libris Confidential 15

Alma email servers support encrypted emails (TLS) signed with the Go Daddy
certificate. If a customer’s email servers support TLS, it is recommended that Go Daddy
be added as a root certificate authority to the MTA. (Note that when the certificate is not
verified, the email is delivered as “untrusted” to the customer.)

If the customer has taken security measures to restrict the SMTP servers that are
permitted to send out email appearing to come from the customer domain, the mail
relay gateways should be added as permitted SMTP servers.

The mail-relay server URLs and IPs are as follows:

 APAC: smtp-ap01.hosted.exlibrisgroup.com [117.20.42.11]
 Europe: smtp-eu00.hosted.exlibrisgroup.com [95.172.90.143] and smtp-

eu01.hosted.exlibrisgroup.com [95.172.90.156] – These two smtp addresses are not
specific for eu00 or eu01 Alma instances (despite the smtp naming), rather both smtp
allowances must be made for any European Alma instance.

 North America: smtp01.hosted.exlibrisgroup.com [64.74.237.230]

UStat

UStat (an Ex Libris usage statistics service) allows the collecting and reporting of usage
statistics information supplied by vendors (content providers) in COUNTER format.
Alma integrates with UStat to allow seamless reporting in Alma Analytics.

UStat requires port 8801 for HTTPS access and port 1443 for HTTPS PDS access.

Network Communication Diagram and Table

The following diagram describes the different possible network communications with
Alma. In a typical customer environment, many of the connections will be applicable,
depending on:

 the system used (such as LDAP or SIP)
 the location of some of the products, such as Primo, Primo-PDS, and MetaLib. These

products may be located either in the Ex Libris cloud—in which case no ports
between these products and Alma need to be opened from the customer network,
since Alma communicates with these products inside the Ex Libris cloud—or at a
customer facility, requiring the described ports to be opened.

Ex Libris Confidential 16

The table below summarizes the complete network communication between the Alma
cloud and the customer's network:

Initiator Target Protocol Ports Comments

Staff Workstation Alma HTTPS 443
(Browser)

Staff Workstation Primo (Back HTTP or HTTPS 1601 (HTTP)
1443 (HTTPS)
(Browser) Office)

Stunnel Alma SSL-secured SIP2 6443 Using Stunnel
Workstation
(SIP2 Self-Check
Stations)

Stunnel Alma SSL-secured 6443 Using Stunnel
Workstation
(Dematic ASRS
remote storage
facility system)

Ex Libris Confidential 17

Initiator Target Protocol Ports Comments

Alma Stunnel SSL-secured 5001 Using Stunnel
Workstation
(Dematic ASRS Publishing
remote storage
facility system) Primo central
registration with
Financial System Alma S/FTP 21/22 Alma URL
Secure FTP 21/22 Via Primo
Student Alma services page
Information directed to
Solutions Alma’s delivery
services
OCLC Alma TCP 5500 210 is open on all
Connexion TCP 9001 production
environments;
Another Alma sandbox
Resource sharing environments
(ILL) system support only 210
(Alma or non-
Alma)

Alma Primo S/FTP 21/22

Primo Alma HTTP or HTTPS 80 or 443

Primo Central Alma HTTPS 443

Google Scholar Alma (via Primo) HTTP or HTTPS 80 or 443
and other third-
party electronic
service providers

Z39.50 data Alma TCP 1921 or 210
providing

OAI-PMH data Alma HTTPS 443
providing

Ex Libris Confidential 18

Initiator Target Protocol Ports Comments

SRU-SRW data Alma HTTPS 443 Note: 8991 is the
providing default port for
Primo PDS HTTP or HTTPS 80 or 443 PDS bor_info,
Alma but may be
8991 (for changed on the
ViewIt/GetIt Primo side.
functionality)
Print via email
Alma Secure LDAP SSL-secured 636 messages
443
SAML (SSO) IDP Alma HTTPS 443
server 21/22

Alma Electronic access HTTPS 25
Proxy (EZProxy, 8801
etc.) 1443

Alma - S/FTP S/FTP server S/FTP
file-based
integrations:

1. SIS

2. ERP/financial

3. MD import
including EOD

4. Bursar payment
fines/fees

5. EDI

6. SMS

7. Publishing
platform

8. File-based
remote storage

Alma Email Server SMTP

Customer UStat HTTPS
Customer UStat PDS HTTPS

Ex Libris Confidential 19