[Bug 23771] New: CAS/Shib Authentication can fail when multiple users with no userid/cardnumber defined and one of them is locked
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Bug ID: 23771 Summary: CAS/Shib Authentication can fail when multiple users with no userid/cardnumber defined and one of them is locked Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Authentication Assignee: nick@bywatersolutions.com Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org When logging in via cas no userid is passed to checkpw, however, we still seek out users with a null userid/cardnumber. If one of those users has a locked account and it happens to be the one chosen, we won't continue to CAS/Shib login (or LDAP, but LDAP shouldn't get a blank userid) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 --- Comment #1 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 93847 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=93847&action=edit Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com, | |matthias.meusburger@biblibr | |e.com, tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #93847|0 |1 is obsolete| | --- Comment #2 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 93860 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=93860&action=edit Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #93860|0 |1 is obsolete| | --- Comment #3 from Liz Rea <wizzyrea@gmail.com> --- Created attachment 93951 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=93951&action=edit Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Liz Rea <wizzyrea@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |wizzyrea@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #93951|0 |1 is obsolete| | --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 94018 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=94018&action=edit Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #5 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Works well, Passing QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)| |19.11.00 released in| | Status|Passed QA |Pushed to master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Nice work! Pushed to master for 19.11.00 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m Version(s)|19.11.00 |19.11.00,19.05.05 released in| | Status|Pushed to master |Pushed to stable --- Comment #7 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 19.05.x for 19.05.05 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23771 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40275 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40275 [Bug 40275] Add Koha::Patrons->find_by_identifier() -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org