[Bug 17004] New: REST API: add route to authenticate patron
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Bug ID: 17004 Summary: REST API: add route to authenticate patron Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Web services Assignee: koha-bugs@lists.koha-community.org Reporter: mail@jkozlovsky.cz QA Contact: testopia@bugs.koha-community.org Add API route to authenticate patron. This would be very useful for 3rd party applications, such as NCIP's LookupUser service or simpleSAMLphp IdP for eduGAIN. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jiří Kozlovský <mail@jkozlovsky.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |16652 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16652 [Bug 16652] Omnibus: RestfulAPI supporting services for Vufind and for xnciptoolkit drivers -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Mike <black23@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P3 Text to go in the| |Sposored by Ministry of release notes| |Culture Czech | |Republic/Minucipal Libray | |Ceska Trebova Change sponsored?|--- |Sponsored CC| |black23@gmail.com, | |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Mike <black23@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|Sposored by Ministry of |Municipal Libray Ceska release notes|Culture Czech |Trebova |Republic/Minucipal Libray | |Ceska Trebova | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Lari Taskula <larit@student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |larit@student.uef.fi -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #1 from Lari Taskula <larit@student.uef.fi> --- We have implemented userid/cardnumer & password CGISESSID-authentication. I will rebase it on master and upload the patch here. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jiri Kozlovsky <mail@jkozlovsky.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |In Discussion Summary|REST API: add route to |REST API: add route to |authenticate patron |authenticate patron (Single | |Sign On - SSO) --- Comment #2 from Jiri Kozlovsky <mail@jkozlovsky.cz> --- (In reply to Lari Taskula from comment #1)
We have implemented userid/cardnumer & password CGISESSID-authentication. I will rebase it on master and upload the patch here.
That's nice! So don't you mind me to put your solution here on bugzilla rebased on master with current REST API conventions? I've found your implementation here: https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/api/v1/swagger/pat... (the POST method) I think it would go quiet quick if I omit your dependencies of the PageObject-tests. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #3 from Lari Taskula <larit@student.uef.fi> --- Created attachment 54028 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54028&action=edit Bug 17004: Add API route to authenticate patron (CGISESSID) This patch adds a username/cardnumber and password authentication that returns a session. POST /auth/session (login) Required form data: - "password" - either "userid" or "cardnumber". To test: 1. Make sure you are logged out from Koha. 2. Make a POST request to http://yourlibrary/api/v1/auth/session with form data "userid" => <your_user_id> and "password" => <your_password>. 3. If your userid and password is correct, you should be returned with most basic patron data and your CGISESSID. 4. Also attempt with invalid login to get an error. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #4 from Lari Taskula <larit@student.uef.fi> --- (In reply to Jiri Kozlovsky from comment #2)
(In reply to Lari Taskula from comment #1)
We have implemented userid/cardnumer & password CGISESSID-authentication. I will rebase it on master and upload the patch here.
That's nice! So don't you mind me to put your solution here on bugzilla rebased on master with current REST API conventions?
I've found your implementation here: https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/api/v1/swagger/ paths/auth.json (the POST method)
I think it would go quiet quick if I omit your dependencies of the PageObject-tests. Since our authentication is based on Authentication rewrite (Bug 13920 and its dependencies), it's a bit too much work for me to rebase here now, so instead I decided to write a simple patch from scratch using session, that you can use for testing if you wish. You can mark that patch obsolete if you wish to work on this Bug more!
-- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #5 from Jiri Kozlovsky <mail@jkozlovsky.cz> --- Created attachment 54068 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54068&action=edit Bug 17004: Add API route to authenticate patron This patch adds a username/cardnumber and password authentication that returns a session. POST /auth/session (login) Required form data: - "password" - either "userid" or "cardnumber". To test: 1. Make sure you are logged out from Koha. 2. Make a POST request to http://yourlibrary/api/v1/auth/session with form data "userid" => <your_user_id> and "password" => <your_password>. 3. If your userid and password is correct, you should be returned with most basic patron data and your CGISESSID. 4. Also attempt with invalid login to get an error. 5. Run tests at b/t/db_dependent/api/v1/auth.t Signed-off-by: Jiri Kozlovsky <mail@jkozlovsky.cz> Wow, brilliant work! Thanks for that, it works as expected! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jiri Kozlovsky <mail@jkozlovsky.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Signed Off -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jiri Kozlovsky <mail@jkozlovsky.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54028|0 |1 is obsolete| | --- Comment #6 from Jiri Kozlovsky <mail@jkozlovsky.cz> --- Comment on attachment 54028 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54028 Bug 17004: Add API route to authenticate patron (CGISESSID) My Sign-Off failed to mark this attachment Obsolete, so I'm now doing it manually -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #7 from Lari Taskula <larit@student.uef.fi> --- Created attachment 54682 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54682&action=edit Bug 17004: Add API route for logging out user To test: 1. Login to Koha either by newly introduced POST /auth/session or traditional way. 2. Send a DELETE request to /auth/session 3. Observe that you are no longer logged-in in Koha. 4. Repeat step 2 and observe error about invalid session id. You may find this cURL useful: curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' (replace CGISESSID=... with your CGISESSID) Current status: Signed Off -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Lari Taskula <larit@student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Lari Taskula <larit@student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54682|0 |1 is obsolete| | --- Comment #8 from Lari Taskula <larit@student.uef.fi> --- Created attachment 54683 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54683&action=edit Bug 17004: Add API route for logging out user To test: 1. Login to Koha either by newly introduced POST /auth/session or traditional way. 2. Send a DELETE request to /auth/session 3. Observe that you are no longer logged-in in Koha. 4. Repeat step 2 and observe error about invalid session id. You may find this cURL useful: curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' (replace CGISESSID=... with your CGISESSID) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #9 from Lari Taskula <larit@student.uef.fi> --- (In reply to Lari Taskula from comment #7)
Current status: Signed Off Uncommented wrong line in git bz attach. Current status is Needs Signoff.
-- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Lari Taskula <larit@student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54683|0 |1 is obsolete| | --- Comment #10 from Lari Taskula <larit@student.uef.fi> --- Created attachment 54684 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54684&action=edit Bug 17004: Add API route for logging out user -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Lari Taskula <larit@student.uef.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54684|0 |1 is obsolete| | --- Comment #11 from Lari Taskula <larit@student.uef.fi> --- Created attachment 54711 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54711&action=edit Bug 17004: Add API route for logging out user -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |benjamin.rokseth@kul.oslo.k | |ommune.no --- Comment #12 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- wow, amazing work! very much like the code we use in production, but better! AND with test coverage ;) Would it be possible to also supply patron permissions in the response? I found the easiest way was to just iterate against haspermissions thus: + my $permissions = haspermission($userid); # defaults to all permissions + # delete all empty permissions + while ( my ($key, $val) = each %{$permissions} ) { + delete $permissions->{$key} unless $val; + } then you could just return $permission as a hash object -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #13 from Lari Taskula <larit@student.uef.fi> --- (In reply to Benjamin Rokseth from comment #12)
wow, amazing work! very much like the code we use in production, but better! AND with test coverage ;)
Would it be possible to also supply patron permissions in the response? I found the easiest way was to just iterate against haspermissions thus:
+ my $permissions = haspermission($userid); # defaults to all permissions + # delete all empty permissions + while ( my ($key, $val) = each %{$permissions} ) { + delete $permissions->{$key} unless $val; + }
then you could just return $permission as a hash object Thank you for the kind support, Benjamin! That made my day!
I think permissions could be useful information to provide in the response. Feel free to provide enhancement patches, I would be happy to sign-off them! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jiri Kozlovsky <mail@jkozlovsky.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54068|0 |1 is obsolete| | Attachment #54711|0 |1 is obsolete| | --- Comment #14 from Jiri Kozlovsky <mail@jkozlovsky.cz> --- Created attachment 54953 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54953&action=edit Bug 17004: Add API route to authenticate patron (CGISESSID) including logout POST /auth/session (login) DELETE /auth/session (logout) Required POST data: - "password" - either "userid" or "cardnumber". To test: 1. Make sure you are logged out from Koha. 2. Make a POST request to http://yourlibrary/api/v1/auth/session with form data "userid" => <your_user_id> and "password" => <your_password>. 3. If your userid and password is correct, you should be returned with most basic patron data and your CGISESSID. 4. Also attempt with invalid login to get an error. 5. Send a DELETE request to /auth/session 6. Observe that you are no longer logged-in in Koha. 7. Run tests at b/t/db_dependent/api/v1/auth.t You may find this cURL useful: curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' (replace CGISESSID=... with your CGISESSID) ---- I've rebased both attachments to master (restructuralized swagger definitions). And added proposed permissions as proposed by Benjamin Rokseth. Btw, very nice work Lari! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54953|0 |1 is obsolete| | --- Comment #15 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- Created attachment 54957 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=54957&action=edit Bug 17004: Add API route to authenticate patron (CGISESSID) including logout POST /auth/session (login) DELETE /auth/session (logout) Required POST data: - "password" - either "userid" or "cardnumber". To test: 1. Make sure you are logged out from Koha. 2. Make a POST request to http://yourlibrary/api/v1/auth/session with form data "userid" => <your_user_id> and "password" => <your_password>. 3. If your userid and password is correct, you should be returned with most basic patron data and your CGISESSID. 4. Also attempt with invalid login to get an error. 5. Send a DELETE request to /auth/session 6. Observe that you are no longer logged-in in Koha. 7. Run tests at b/t/db_dependent/api/v1/auth.t You may find this cURL useful: curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' (replace CGISESSID=... with your CGISESSID) ---- I've rebased both attachments to master (restructuralized swagger definitions). And added proposed permissions as proposed by Benjamin Rokseth. Btw, very nice work Lari! Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off --- Comment #16 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- Shit man, you beat me with five minutes! Was just rebasing the same patch ;) Great work, Lari and Jiri! Everything works as expected. Just a sidenote: perhaps we should .gitignore swagger.min.json, or we will face a whole lot of merge issues? I propose this in a new bug. Part of the testing should be to minify anyways, as it will spot issues in references. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #17 from Jiri Kozlovsky <mail@jkozlovsky.cz> --- (In reply to Benjamin Rokseth from comment #16)
Shit man, you beat me with five minutes! Was just rebasing the same patch ;)
Great work, Lari and Jiri! Everything works as expected.
Just a sidenote: perhaps we should .gitignore swagger.min.json, or we will face a whole lot of merge issues? I propose this in a new bug. Part of the testing should be to minify anyways, as it will spot issues in references.
Well then, sorry about that :D I didn't know you're working on it .. maybe an IRC channel would solve such interference? I agree with ignoring all possible minified files in Koha in general. Are there currently any other minified files? I can't think of any right now. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #54957|0 |1 is obsolete| | --- Comment #18 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- Created attachment 55146 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=55146&action=edit Bug 17004: Add API route to authenticate patron (CGISESSID) including logout POST /auth/session (login) DELETE /auth/session (logout) Required POST data: - "password" - either "userid" or "cardnumber". To test: 1. Make sure you are logged out from Koha. 2. Make a POST request to http://yourlibrary/api/v1/auth/session with form data "userid" => <your_user_id> and "password" => <your_password>. 3. If your userid and password is correct, you should be returned with most basic patron data and your CGISESSID. 4. Also attempt with invalid login to get an error. 5. Send a DELETE request to /auth/session 6. Observe that you are no longer logged-in in Koha. 7. Run tests at b/t/db_dependent/api/v1/auth.t You may find this cURL useful: curl -X DELETE http://lib/api/v1/auth/session --cookie 'CGISESSID=88e735aaf7c6cf194a775425cbd00570' (replace CGISESSID=... with your CGISESSID) ---- I've rebased both attachments to master (restructuralized swagger definitions). And added proposed permissions as proposed by Benjamin Rokseth. Btw, very nice work Lari! Signed-off-by: Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #19 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- Rebased against master. Basically just removed swagger.min.json from the patch. And added Bug 17243 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #20 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- Need more to sign-off/QA this one! It's essential for the REST API development, and it's basically nothing new other than a better replacement of the svc authentication with a more sensible authentication approach. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #21 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I don't like this much.. We're in-explicitly mixing Authentication (Are you who you say you are) and Authorization (What can this person/application on behalf of person do) At the very least I believe these functions should be made distinct to prevent leaking security context. The second reason I don't like this is that we're inventing out own wheel. There are lots of solid standards out there to do this sort of thing. We should really be leaning on the shoulders of giants and using an off the shelf standard. OAuth and OpenID connect would be my preferred option personally. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #22 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- (In reply to Martin Renvoize from comment #21)
I don't like this much.. We're in-explicitly mixing Authentication (Are you who you say you are) and Authorization (What can this person/application on behalf of person do)
I believe the main point here is authenticating a service outside koha against its userbase and services, although of course Koha intra and opac should profit from this.
At the very least I believe these functions should be made distinct to prevent leaking security context.
No problem with that, as long as authorization is handled one place only.
The second reason I don't like this is that we're inventing out own wheel. There are lots of solid standards out there to do this sort of thing. We should really be leaning on the shoulders of giants and using an off the shelf standard. OAuth and OpenID connect would be my preferred option personally.
Now this could be debated, openID and oAuth are easy to integrate against and are well formed standards, and would of course lower the barrier to use koha services outside the library without handling login in koha. But to be sure, local login needs to be handled anyways, and to use our library as an example, having a local patron base is a strength rather than a weekness. Being a user of the library implies a presence and represents a place outside the web, and I'm not sure SSO with oauth gives the same sensation. Just my two cent thoughts :) Now to rebase this against master... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #23 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I was actually suggesting Koha act as an OAuth/OpenID Connect provider rather than just a consumer. There's pretty solid Mojolicious Plugin we could use that gives us a chunk of this out of the box: https://metacpan.org/pod/Mojolicious::Plugin::OAuth2::Server It's using something like this that I'm advocating ;) So, when logging in the user would get directed to a Koha login page and then redirected back to whatever SSO consumer they came from. It's clearer to the user what login they should be using and who the original party is that's storing their authentication credentials. OAuth is of course the 'Authorization' side of the story, we'd still need to work out the OpenID Connect side of the story to bring this back down to simple 'user identification'. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |martin.renvoize@ptfs-europe |y.org |.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #24 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- To be clear, I'm trying not to be negative here.. I'm actually really keen for this work.. it's just I'd like to see it done 'right' in a commonly accepted manor so we stand the best chance possible for the api to be adopted in the wider world ;) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #25 from Benjamin Rokseth <benjamin.rokseth@kul.oslo.kommune.no> --- Ah, so I totally misunderstood ;) What you suggest totally makes sense! Hope to see this sooner than later. Unfortunately I'm too deep in other bugs to be any help here at the moment, but would gladly assist in testing/signing off! -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #26 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Well.. I'm bogged down at the minute.. but doing this has been on my todo list for nearly a year ;) If I get a chance, I might try and take some time over christmas to work on it. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |lari.taskula@jns.fi |ity.org | -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl Status|Signed Off |In Discussion --- Comment #27 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Martin Renvoize from comment #26)
Well.. I'm bogged down at the minute.. but doing this has been on my todo list for nearly a year ;)
If I get a chance, I might try and take some time over christmas to work on it.
Moving this to In Discussion in view of the comments above. Sorry.. Martin: Could you tell us which christmas you will be working on it? :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Web services |REST api -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Jon Knight <J.P.Knight@lboro.ac.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |J.P.Knight@lboro.ac.uk -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com --- Comment #28 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Marcel de Rooy from comment #27)
(In reply to Martin Renvoize from comment #26)
Well.. I'm bogged down at the minute.. but doing this has been on my todo list for nearly a year ;)
If I get a chance, I might try and take some time over christmas to work on it.
Moving this to In Discussion in view of the comments above. Sorry.. Martin: Could you tell us which christmas you will be working on it? :)
LOL -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Johanna Räisä <johanna.raisa@koha-suomi.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |johanna.raisa@koha-suomi.fi --- Comment #29 from Johanna Räisä <johanna.raisa@koha-suomi.fi> --- (In reply to Martin Renvoize from comment #23)
I was actually suggesting Koha act as an OAuth/OpenID Connect provider rather than just a consumer.
There's pretty solid Mojolicious Plugin we could use that gives us a chunk of this out of the box: https://metacpan.org/pod/Mojolicious::Plugin::OAuth2::Server
It's using something like this that I'm advocating ;) So, when logging in the user would get directed to a Koha login page and then redirected back to whatever SSO consumer they came from. It's clearer to the user what login they should be using and who the original party is that's storing their authentication credentials.
OAuth is of course the 'Authorization' side of the story, we'd still need to work out the OpenID Connect side of the story to bring this back down to simple 'user identification'.
This would be great for clarity. How about if some service would authenticate on background like SIP does? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Lari Taskula <lari.taskula@hypernova.fi> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|lari.taskula@hypernova.fi |koha-bugs@lists.koha-commun | |ity.org --- Comment #30 from Lari Taskula <lari.taskula@hypernova.fi> --- I'm no longer able to work on this, so I'm setting assignee to default. Feel free to continue this work. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Inspiria <Diwakar.j@inspiria.edu.in> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Diwakar.j@inspiria.edu.in -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #31 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I believe while what Martin suggests here is the "right" way to do it it won't be an option for many legacy systems to implement that. Is there a way we could provide both? A simple auth route that given the user credentials returns some basic information, valid/invalid and maybe a system identifier (borrowernumber) that can be used to get more information about privileges etc? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ulrich.kleiber@bsz-bw.de -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #32 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- People do realise there's a 'AuthenticatePatron' option in ils-di right.. so this being blocked doesn't mean there isn't already an alternative that's been available in Koha for.. I dunno.. a decade? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #33 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Martin Renvoize from comment #32)
People do realise there's a 'AuthenticatePatron' option in ils-di right.. so this being blocked doesn't mean there isn't already an alternative that's been available in Koha for.. I dunno.. a decade?
We might end up going this route, but ILS-DI has its own security concerns as far as I understand. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #34 from Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> --- I think leaving the proven path of pure doctrine is better than the alternative of using ILS-DI for patron authentication, where the password appears in the URL and thus in the Apache log files and the Plack log files. We have legacy systems which are not part of a centralized single sign-on infrastructure. But they are part of our in-house Koha infrastructure. Our patrons do not have to give there password to a third party service. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #35 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Until we implement Koha-as-an-IdP with OAuth2 bells and whistles, it wouldn't hurt to have a way to generate a session using the API the same way the old .pl scripts do. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Marjorie Barry-Vila <marjorie.barry-vila@collecto.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marjorie.barry-vila@collect | |o.ca -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arthur.suzuki@biblibre.com --- Comment #36 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- (In reply to Ulrich Kleiber from comment #34)
I think leaving the proven path of pure doctrine is better than the alternative of using ILS-DI for patron authentication, where the password appears in the URL and thus in the Apache log files and the Plack log files. We have legacy systems which are not part of a centralized single sign-on infrastructure. But they are part of our in-house Koha infrastructure. Our patrons do not have to give there password to a third party service.
About ILS-DI having the password in the URL, the easy fix is to have the third-party software querying Koha with HTTP-POST instead of HTTP-GET, that works. The parameters are then not part of the URL anymore, hence not logged. (still transfered in cleartext if https is not used though) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #37 from David Cook <dcook@prosentient.com.au> --- (In reply to Tomás Cohen Arazi from comment #35)
Until we implement Koha-as-an-IdP with OAuth2 bells and whistles, it wouldn't hurt to have a way to generate a session using the API the same way the old .pl scripts do.
I've already done a lot of this work locally, but it's unpolished, and there's not enough... incentive(?) to upstream it at the moment. But that's really the key. Refactoring checkauth() so that we can create a session with a function call would be great. Then we call leave up the actual authentication to the caller. One day I'll have all the time and money in the world to bring pluggable authentication to Koha hehe. It actually wouldn't take that much time and effort, but there are only 24 hours in the day... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #38 from Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> --- (In reply to Arthur Suzuki from comment #36)
(In reply to Ulrich Kleiber from comment #34)
I think leaving the proven path of pure doctrine is better than the alternative of using ILS-DI for patron authentication, where the password appears in the URL and thus in the Apache log files and the Plack log files. We have legacy systems which are not part of a centralized single sign-on infrastructure. But they are part of our in-house Koha infrastructure. Our patrons do not have to give there password to a third party service.
About ILS-DI having the password in the URL, the easy fix is to have the third-party software querying Koha with HTTP-POST instead of HTTP-GET, that works. The parameters are then not part of the URL anymore, hence not logged. (still transfered in cleartext if https is not used though)
Thanks for your hint Arthur, it works :) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #39 from David Cook <dcook@prosentient.com.au> --- I'm going to add another wrinkle into all of this! Since Koha isn't yet capable of being an OpenID Connect/SAML2 IDP itself, we're using the Keycloak IDAM system instead (which Red Hat very actively develops and supports). The cool part is that I've written an extension using the User Storage SPI (https://www.keycloak.org/docs/latest/server_development/#_user-storage-spi) to use the Koha database as the User Federation provider. Right now, I'm using the existing REST API to GET patrons, but I need a REST API endpoint to validate the credentials entered by the user. I'll be creating a custom endpoint for that this afternoon. *Note that this isn't creating a Koha authentication session. It's just validating that the password entered by the user into Keycloak is the same password stored in the Koha database.* So Keycloak will provide the SSO for Koha and other systems, but the real backend user database (and potentially business rules) will still happen in Koha. I thought about doing the REST API endpoint as a Koha plugin, but I'm going to just code it into our local Koha, so that it's easier to maintain and distribute. Once we've battle tested everything, I could look at sharing. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=30962 -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 mathieu saby <mathsabypro@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mathsabypro@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 --- Comment #40 from David Cook <dcook@prosentient.com.au> --- Now that bug 30962 has been pushed to 22.11.03+, I'll be using that in my Keycloak extension. -- Also I think that bug 30962 might actually meet quite a few of the original goals outlined in this bug report... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=17004 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|In Discussion |RESOLVED --- Comment #41 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to David Cook from comment #40)
Now that bug 30962 has been pushed to 22.11.03+, I'll be using that in my Keycloak extension.
--
Also I think that bug 30962 might actually meet quite a few of the original goals outlined in this bug report...
It feels like this can be closed now. Please reopen if something is still missing. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org