[Bug 18315] New: authentication and authorization refactoring
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Bug ID: 18315 Summary: authentication and authorization refactoring Change sponsored?: --- Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Authentication Assignee: gmcharlt@gmail.com Reporter: oha@oha.it QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org Currently, C4::Auth is responsible to do session management, authentication and authorization. There is no clear separations between them, and the authentication is not modular, making it increasingly harder to maintain and/or introduce no authentication integrations. I was experimenting on this for a while, and I managed to put together few commits in a branch. It started as a proposal, but turned out to be working in _most_ of my tests. here more details: I completely removed any need for CGI and CGI::Session while maintaining a fork-exec aproach to the scripts. (This made it easier to implement Koha::Middleware::Session, Koha::Session::DB and ::KohaCache) Koha::Middleware::Session inject a session object in the Plack request, and invoke Koha::Auth if any authentication tokens are available. Koha::Auth has a list of modules which will be invoked in turn and could be enabled/disabled plack.psgi is changed as well, it has enabled the new Middleware and the applications used are no longer Plack::App::CGIBin but Koha::Middleware::App. here few of the things i want to do to simplify the interaction with the current "legacy" code: I didn't change the scripts or any other module at all, instead I tried to hijack C4::Auth methods to rely on Koha::Session and Koha::Auth. This make it simple to switch back to the previous plack.psgi OR using apache and the normal cgi-bin. authentication should happen upfront, before the script is even started. script will have to verify authorization. authentication MUST be modular, possibly having different systems cooperate. (Some serious discussions must be around this point, especially about accounting and authority) what needs to be done: permissions should be reintroduced. right now permissions are read for the user and set in the template, but no checks are perform on requests. (should be fairly simple to do) reintroduce the code related to shib, cas and any other. more testing, especially for the installer (there is lots of code regarding the web installer which isn't there anymore) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Francesco Rivetti <oha@oha.it> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gmcharlt@gmail.com |oha@oha.it CC| |oha@oha.it -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Francesco Rivetti <oha@oha.it> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org, | |martin.renvoize@ptfs-europe | |.com, tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Francesco Rivetti <oha@oha.it> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://github.com/digibib/ | |Koha/commits/auth_session_r | |efactor -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #1 from Francesco Rivetti <oha@oha.it> --- regarding the web installer, C4::Auth has few places where it returns "maintenance" which i believe happens during the web installer or immediately after. I clean up that part and I must reintroduce it back. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #2 from Francesco Rivetti <oha@oha.it> --- so far, things that does NOT work: - redirects are probably broken - Koha::Auth::Simple tries to authenticate you when you send userid/passwd even when those are sent to create a new user - logout.x fights with login - permissions are there (and with the fixed JOIN) but only used for templates, not for authorization - CGI is mocked, and Session is new. So I expect few modules to land to not implemented methods there. should be easy to add those -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #3 from Francesco Rivetti <oha@oha.it> --- added few more fixes: - honor cgi->redirect() - trap exit() and instead returns what has been sent so far - added session->remote_addr() - added branchname in session and LoginBranchName in templates -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #4 from Francesco Rivetti <oha@oha.it> --- this is something i forgot to mention before: I replaced WrapCGI and CGIBin with Koha::Middleware::App It pretty much do the same thing as WrapCGI (fork and require the cgi script) but instead of having the script building the response, it uses a pipe and serialize the data back to the parent. It's the first step to move the logic from the scripts to proper functions. It handles script exit() properly, and should work properly with other forks, which make it relevant to Bug 15032 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |olli-antti.kivilahti@jns.fi --- Comment #5 from Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> --- Hi! Check out https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/Koha/Auth/Permissi... https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/Koha/Auth.pm https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/Koha/Auth/Route/Pa... https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/C4/Auth.pm#L1713 I rewrote the permission system and authentication system some time ago. Nobody is interested about it, even thought the horrible way of managing permissions is a blocker for writing smooth user interface tests (or REST API tests). Not a lot of people care about user interface tests either. We have been indecisive should we drop my authentication rewrite and revert to the community system, but it is so stale and in a need of a rewrite that we couldn't get back into it. I hope you can work on top of my solution and improve it, instead of reinventing the wheel. It would be great to get best of both worlds. My solution has a compatibility layer between CGI and Mojolicious, normalizing the way HTTP request headers/cookies/parameters are fetched. It would be bestest to get rid of CGI completely and just rewrite everything as a Mojolicious application. Also ashimema and tcohen are working with OAuth2.0 and replacing CGISESSID with JWT. Not sure how they can do it with the current C4::Auth. Maybe they will provide a third and a fourth rewrite :) (I hope not) BTW: Where is your code? I see no attachments? My work in Bugzilla: Bug 7174 - Authentication rewriting -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #6 from Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> --- (In reply to Olli-Antti Kivilahti from comment #5)
BTW: Where is your code? I see no attachments?
But I found the URL to github. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #7 from Francesco Rivetti <oha@oha.it> --- Hi Olli-Antti Kivilahti, I didn't know you were working on it, will have a look immediately. You are right: I haven't submitted any patch here. But you can see what i did so far here: https://github.com/digibib/Koha/commits/auth_session_refactor there are lots of changes on my side, but I might be able to combine what you did so far and integrate it. I just wish there were more hours in a day! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 --- Comment #8 from Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> --- I am relieved to hear that. This auth work just nudged forward in our dev pipeline and Lari is working with it atm. I hope you can work together to bring together the best of both worlds. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=7174 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #9 from David Cook <dcook@prosentient.com.au> --- I have a feeling that a lot of people are thinking about this and maybe working on it separately. It's too bad that we don't have more coordination across distant developers... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=36098 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18315 Magnus Enger <magnus@libriotech.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |magnus@libriotech.no Status|In Discussion |RESOLVED Resolution|--- |DUPLICATE --- Comment #10 from Magnus Enger <magnus@libriotech.no> --- No code and no movement in years. Marking as duplicate of bug 7174. *** This bug has been marked as a duplicate of bug 7174 *** -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org