https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43334 Bug ID: 43334 Summary: Implement OIDC Third-Party Initiated Login endpoint Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: tomascohen@gmail.com QA Contact: martin.renvoize@openfifth.co.uk CC: dpavlin@rot13.org Depends on: 42719 Target Milestone: --- Bug 42719 fixes the immediate 500 crash when an IdP initiates login without an existing session. However, the current approach silently creates a session and proceeds, which is susceptible to login CSRF (an attacker could craft a link that initiates login on behalf of the user). The OIDC spec defines a proper Third-Party Initiated Login flow: https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLog... Proposed implementation: 1. New endpoint: GET /api/v1/public/oauth/initiate-login Parameters (per spec): - iss (required): issuer identifier, must match a configured provider - login_hint (optional): hint about which user to authenticate - target_link_uri (optional): where to redirect after login 2. The endpoint: - Validates iss against configured OAuth providers in koha-conf.xml - Returns 400 if iss does not match any known provider - Renders a confirmation page: 'Provider X is requesting login. Proceed?' - On confirmation, redirects to the existing /api/v1/public/oauth/login/{provider}/{interface} flow 3. This defeats login CSRF because: - User interaction is required before the OAuth dance begins - The session and CSRF state are only created after user consent The existing Mojolicious::Plugin::OAuth2 flow remains unchanged. This endpoint sits in front of it, resolving iss to a provider name and gating on user confirmation. The session-creation logic from bug 42719 remains useful: after user confirms, the login endpoint may still need to create a session if none exists. Libraries using Okta (or similar IdPs) would configure the initiate_login_uri in their IdP app settings to point to this endpoint. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42719 [Bug 42719] OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists (IdP-initiated flow) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.