[Bug 18549] New: There should be a warning that logging out of Koha will leave browser session logged in to OAuth
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Bug ID: 18549 Summary: There should be a warning that logging out of Koha will leave browser session logged in to OAuth Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: gmcharlt@gmail.com Reporter: nick@bywatersolutions.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org
From bug 16892
Nick: For CAS we have casLogout - can we have something similar here? I think disconcerting if a patron signs in via google, signs out of Koha and walks away leaving their google auth intact unintentionally Mark: This is the problem. If you have multiple tabs, let's say gmail in one, and Koha in the other. If Koha does a forced logout, then your gmail tab will be affected. This is the problem that is widely known. I was thinking of actually doing another bug to drop-down choose what kind of log out. Martin: A federated logout is actually pretty rare in my experience, though it is possible. As you say Mark, it 'feels' strange to the user that logging out of seemingly unrelated apps can have the knock on effect of logging out apps in other tabs that happen to share an aouth2 openid connect identity provider. On a related note, I'm not sure I saw any code out end to support such a federated logout triggered by another service in our end either... but perhaps I missed it ;) Nick: Perhaps if OAuth is activated just a note added that when you log out of Koha you may still be logged in via google? I agree a user with many tabs open may not expect this, but a patron using a shared machine in the library who signs in to place a hold or renew may never visit their email or expect that they have signed in to that. I think a pop-up when logging out to say "Hey, you are logged in to google, and they know lots of stuff about you" wouldn't hurt, who can say if it would help :-) Mark: Perhaps this type of discussion should happen on another bug report, as this bug has nothing to do with logging out. :) Also, yes, some sort of warning should be displayed, somewhere, somehow. Nick: It can happen here now :-) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com, mtompset@hotmail.com, | |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=16892 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|gmcharlt@gmail.com |mtompset@hotmail.com --- Comment #1 from M. Tompsett <mtompset@hotmail.com> --- Thanks for the CC user on this bug. I'll attempt something for this problem, and see what you folks think. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #2 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Cheers for splitting this out. Great to hear you're going to give it a punt Mark, I'd love to see the federated logout fully implemented, but I'm not expecting that here. If we do go down that route, I feel we need to impliment both ends in the same bug.. i.e. both our 'SLO caller' which needs to be attached to the logout button and the 'SLO listener' which if memory servers is a double iframe based hack in OpenID Connect. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Martin Renvoize from comment #2)
If we do go down that route, I feel we need to impliment both ends in the same bug.. i.e. both our 'SLO caller' which needs to be attached to the logout button and the 'SLO listener' which if memory servers is a double iframe based hack in OpenID Connect.
Or a simpler logout redirect. http://stackoverflow.com/questions/4202161/google-account-logout-and-redirec... Though, I vaguely recall seeing the iframe business, and thinking, "YUCK!" The thought is a modal popup with a nice message explaining the two choices: Koha Only or Koha+Google. The first does the normal URL, the later does the redirect URL. Seem like a decent plan? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #4 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 63198 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=63198&action=edit Bug 18549: Provide logout modal dialogue I'm sure someone else could make the bootstrap and javascript prettier. However, this functions. TEST PLAN --------- 1) log in with Google OAuth and log out -- notice if you click login again, you continue as if you never logged out. This is because the current log out is a Koha only logout. 2) apply patch 3) log in with Google OAuth and log out 4) click 'Koha only' 5) log in with Google OAuth -- same continuation as before. 6) log out, but click 'Koha and Google' 7) log in with Google OAuth -- authentication is required again 8) koha qa test tools -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #63198|0 |1 is obsolete| | --- Comment #5 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 63212 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=63212&action=edit Bug 18549: Provide logout modal dialogue I'm sure someone else could make the bootstrap and javascript prettier. However, this functions. TEST PLAN --------- 1) log in with Google OAuth and log out -- notice if you click login again, you continue as if you never logged out. This is because the current log out is a Koha only logout. 2) apply patch 3) log in with Google OAuth and log out 4) click 'Koha only' 5) log in with Google OAuth -- same continuation as before. 6) log out, but click 'Koha and Google' 7) log in with Google OAuth -- authentication is required again 8) koha qa test tools Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #6 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I think this bug is somewhat misleading to the user, unfortunately. Here's some questions that only the most technically aware will think to ask at this point. 1) If I login to app A (also a google openid connect consumer), then login to koha, then logout of app A will I be logged out of Koha too? - Current answer - No 2) If I loging to google, then login to Koha, then logout of Google will I also be logged out of Koha - Current answer - No 3) I've logged into Koha, then logged into App A, I then logout of Koha using the 'Logout of Koha and Google' option.. can I assume I'm also logged out of App A - Current Answer - No (and we can never ensure that either, as App A needs to support SLO too) I think the current (as in, in master) implementation is more 'the norm' and that adding this patch actually obfuscates that clarity a bit more.. By allowing a 'logout of google too' option, you're inferring that a google logout affects koha in some way, when in fact it does not. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.meusburger@biblibr | |e.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Would appreciate some more input on this really, I think for me it's all about being clear about what is happening and what we support. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #8 from Nick Clemens <nick@bywatersolutions.com> --- (In reply to Martin Renvoize from comment #7)
Would appreciate some more input on this really, I think for me it's all about being clear about what is happening and what we support.
Your points about the 'logout of google' option are fair, I just still feel like there should be at least a warning that you might be logged in to google. I suppose if an institution is enabling this option they bear some responsibility for training their users, a warning just seems friendly. Perhaps a syspref to allow warning or federated logout with explanatory text in the manual about what apps need to support to allow this logout to work? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |In Discussion -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #9 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Martin Renvoize from comment #6)
I think this bug is somewhat misleading to the user, unfortunately. [SNIP] I think the current (as in, in master) implementation is more 'the norm'
It is. The problem is that if users walk away, someone else can click 'login' and become the person who just left.
and that adding this patch actually obfuscates that clarity a bit more.
That's what the whole dialogue message is supposed to make clear. If your objection is with the explanation, then feel free to suggest alternative wording.
By allowing a 'logout of google too' option, you're inferring that a google logout affects koha in some way, when in fact it does not.
No, I am implying that by choosing that option, other google related tabs/windows in the same browser may be affected. You inferred incorrectly, so clearly the dialogue message needs tweaking, because 'Koha and Google' is the button name, not what you are logging in and out of manually in random order. TAB A: GMail TAB B: Koha OPAC logged in via OAuth Click logout in OPAC. Get dialogue (because you've applied this patch) Click 'Koha and Google' your TAB A will be affected, and you will be forced to relogin in to continue reading your GMail. But if you click 'Koha only', TAB A is not affected, but you suffer the next user can become you problem when the next person clicks the Koha OPAC login. I suspect this is why people go with the most complex and horrid iframe solution, because that may do some authorization revoking without actually logging out and thus not have the potential identity theft issue. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #10 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- We had a lot of similar discussions about Shibboleth around here. The patrons use public computers in the library to search, place holds etc. and then they walk away, unaware that they are still logged into email and several other services the single sign on works for - although they logged out of the OPAC. We could make the warning optional, but I think it would be a nice thing to have. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 --- Comment #11 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Katrin Fischer from comment #10)
We could make the warning optional, but I think it would be a nice thing to have.
A system preference: Koha Only (default), Koha and Google, Prompt (recommended to give users freedom of choice)? If Koha Only, log out URL generates page similar to currently. If Koha and Google, log out URL generates the double logout version. If Prompt, modal popup like now. Would that be acceptable? I've been tinkering with revoking the authorization token after log in, the problem is Google stores session information in cookies, which I am having difficulty eliminating. This makes clicking on the previous email auto-magically log in. google.com: SSID and SID, accounts.google.com: LSID, ACCOUNT_CHOOSER. Get rid of those four cookies manually, and a login is forced without the previous email being remembered. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Claudio <costalc@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |costalc@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 Mason James <mtj@kohaaloha.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtj@kohaaloha.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=18549 hannah.co@northwestu.edu changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hannah.co@northwestu.edu -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org