https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #1 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 72865 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72865&action=edit Bug 20402: Implement OAuth2 authentication for REST API It implements only the "client credentials" flow with basic scopes support (only one is defined, "patrons.read"). API Clients are defined in $KOHA_CONF. Test plan: 1. In $KOHA_CONF, add an <api_client> element under <config>: <api_client> <client_id>$CLIENT_ID</client_id> <client_secret>$CLIENT_SECRET</client_secret> <scope>patrons.read</scope> </api_client> 2. Apply patch, run updatedatabase.pl and reload starman 3. Install Firefox extension RESTer [1] 4. In RESTer, go to "Authorization" tab and create a new OAuth2 configuration: - OAuth flow: Client credentials - Access Token Request Method: POST - Access Token Request Endpoint: http://koha/api/v1/oauth/token - Access Token Request Client Authentication: Credentials in request body - Client ID: $CLIENT_ID - Client Secret: $CLIENT_SECRET - Scopes: patrons.read 5. Click on the newly created configuration to generate a new token (which will be valid only for an hour) 6. Set method to GET and url to http://koha/api/v1/patrons It should return 200 OK with the list of patrons 7. Remove or change the <scope> from $KOHA_CONF (reload starman & memcached) and see that you cannot generate a new token. Then reset the scope to its initial value 8. Edit api/v1/swagger/paths/patrons.json, locate 'x-koha-scopes' (2 occurences) and change the values to something else. Reload starman. Repeat step 6 and see that you receive a 403 Forbidden status Undo your changes in api/v1/swagger/paths/patrons.json and reload starman again. 9. Wait an hour (or run the following SQL query: UPDATE oauth_access_tokens SET expires = 0) and repeat step 6. You should have a 403 Forbidden status, and the token must have been removed from the database. [1] https://addons.mozilla.org/en-US/firefox/addon/rester/ -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72865|0 |1 is obsolete| | --- Comment #3 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 72886 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72886&action=edit Bug 20402: Implement OAuth2 authentication for REST API It implements only the "client credentials" flow with basic scopes support (only one is defined, "patrons.read"). API Clients are defined in $KOHA_CONF. Test plan: 0. Install Net::OAuth2::AuthorizationServer 0.16 1. In $KOHA_CONF, add an <api_client> element under <config>: <api_client> <client_id>$CLIENT_ID</client_id> <client_secret>$CLIENT_SECRET</client_secret> <scope>patrons.read</scope> </api_client> 2. Apply patch, run updatedatabase.pl and reload starman 3. Install Firefox extension RESTer [1] 4. In RESTer, go to "Authorization" tab and create a new OAuth2 configuration: - OAuth flow: Client credentials - Access Token Request Method: POST - Access Token Request Endpoint: http://$KOHA_URL/api/v1/oauth/token - Access Token Request Client Authentication: Credentials in request body - Client ID: $CLIENT_ID - Client Secret: $CLIENT_SECRET - Scopes: patrons.read 5. Click on the newly created configuration to generate a new token (which will be valid only for an hour) 6. In RESTer, set HTTP method to GET and url to http://$KOHA_URL/api/v1/patrons then click on SEND It should return 200 OK with the list of patrons 7. Remove or change the <scope> from $KOHA_CONF (reload starman & memcached) and see that you cannot generate a new token. Then reset the scope to its initial value 8. Edit api/v1/swagger/paths/patrons.json, locate 'x-koha-scopes' (2 occurences) and change the values to something else. Reload starman. Repeat step 6 and see that you receive a 403 Forbidden status Undo your changes in api/v1/swagger/paths/patrons.json and reload starman again. 9. Wait an hour (or run the following SQL query: UPDATE oauth_access_tokens SET expires = 0) and repeat step 6. You should have a 403 Forbidden status, and the token must have been removed from the database. [1] https://addons.mozilla.org/en-US/firefox/addon/rester/ -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72874|0 |1 is obsolete| | --- Comment #5 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 72888 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72888&action=edit Bug 20402: Follow-up to correct uninitialized failures Added type => 'access' to the token request line in Koha/REST/V1/OAuth.pm based on my quick skim of /usr/share/perl5/Net/OAuth2/AuthorizationServer/Defaults.pm which was complaining, and seemed to allow valid values of 'auth', 'refresh', and 'access'. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72886|0 |1 is obsolete| | --- Comment #7 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 72892 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72892&action=edit Bug 20402: Implement OAuth2 authentication for REST API It implements only the "client credentials" flow with basic scopes support (only one is defined, "patrons.read"). API Clients are defined in $KOHA_CONF. Test plan: 0. Install Net::OAuth2::AuthorizationServer 0.16 1. In $KOHA_CONF, add an <api_client> element under <config>: <api_client> <client_id>$CLIENT_ID</client_id> <client_secret>$CLIENT_SECRET</client_secret> <scope>patrons.read</scope> </api_client> 2. Apply patch, run updatedatabase.pl and reload starman 3. Install Firefox extension RESTer [1] 4. In RESTer, go to "Authorization" tab and create a new OAuth2 configuration: - OAuth flow: Client credentials - Access Token Request Method: POST - Access Token Request Endpoint: http://$KOHA_URL/api/v1/oauth/token - Access Token Request Client Authentication: Credentials in request body - Client ID: $CLIENT_ID - Client Secret: $CLIENT_SECRET - Scopes: patrons.read 5. Click on the newly created configuration to generate a new token (which will be valid only for an hour) 6. In RESTer, set HTTP method to GET and url to http://$KOHA_URL/api/v1/patrons then click on SEND It should return 200 OK with the list of patrons 7. Remove or change the <scope> from $KOHA_CONF (reload starman & memcached) and see that you cannot generate a new token. Then reset the scope to its initial value 8. Edit api/v1/swagger/paths/patrons.json, locate 'x-koha-scopes' (2 occurences) and change the values to something else. Reload starman. Repeat step 6 and see that you receive a 403 Forbidden status Undo your changes in api/v1/swagger/paths/patrons.json and reload starman again. 9. Wait an hour (or run the following SQL query: UPDATE oauth_access_tokens SET expires = 0) and repeat step 6. You should have a 403 Forbidden status, and the token must have been removed from the database. [1] https://addons.mozilla.org/en-US/firefox/addon/rester/ Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #72888|0 |1 is obsolete| | --- Comment #9 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 72894 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=72894&action=edit Bug 20402: Follow-up to correct uninitialized failures Added type => 'access' to the token request line in Koha/REST/V1/OAuth.pm based on my quick skim of /usr/share/perl5/Net/OAuth2/AuthorizationServer/Defaults.pm which was complaining, and seemed to allow valid values of 'auth', 'refresh', and 'access'. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Marcel de Rooy <m.de.rooy@rijksmuseum.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |m.de.rooy@rijksmuseum.nl --- Comment #11 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- Julian: Unit tests ? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #13 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 73087 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=73087&action=edit Bug 20402: Add cronjob script to delete expired tokens Test plan: 1. Generate X tokens (X > 1) 2. mysql> UPDATE oauth_access_tokens SET expires = 0 3. Generate Y tokens (Y > 1) 4. Run the script 5. Verify that only Y tokens remains -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #15 from Julian Maurice <julian.maurice@biblibre.com> --- (In reply to Tomás Cohen Arazi from comment #14)

- I think the way scopes are defined needs more thinking, also its relation to permissions. The patchset adds patrons.read but I'm sure we need a spec on how this are defined and documented. I agree. It looks like OpenAPI spec covers that (https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#sec...) but I'm not sure if we can and should use this.

About relation to permissions, do you think we should have 1:1 relationship between scopes and permissions ? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #17 from Tomás Cohen Arazi <tomascohen@gmail.com> --- I think we should tie api id and keys to patrons to take advantage of the current permission system. And introduce the use of scopes at a later stage. Julian: can you do it? i.e. pick the code you once wrote for having patrons create api keys on the staff interface? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |ASSIGNED --- Comment #19 from Julian Maurice <julian.maurice@biblibre.com> --- It has been decided during the IRC meeting to make it possible to tie an API client with an existing patron and to use their permissions. We give up the scopes for now, as it would require much more discussions and we want OAuth2 in 18.05 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #21 from Julian Maurice <julian.maurice@biblibre.com> --- A few notes about the last patch: - I attached it only as an easy way to see the last changes, beacause I will squash all patches into one clean patch. - The use of Mojolicious::Plugin::OAuth2::Server was suggested on IRC, but it only helps removing a few lines of code. I'm not sure it's worth it (new non-packaged dependency) - The test plan in comment 7 is not correct anymore. Before testing, please wait until I squash all patch and write a new test plan (or use your brain to guess a new test plan :)) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff --- Comment #23 from Julian Maurice <julian.maurice@biblibre.com> --- All patches squashed and rebased on master. Please test ! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #25 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Julian Maurice from comment #21)

A few notes about the last patch: - I attached it only as an easy way to see the last changes, beacause I will squash all patches into one clean patch. - The use of Mojolicious::Plugin::OAuth2::Server was suggested on IRC, but it only helps removing a few lines of code. I'm not sure it's worth it (new non-packaged dependency) - The test plan in comment 7 is not correct anymore. Before testing, please wait until I squash all patch and write a new test plan (or use your brain to guess a new test plan :))

When I tested using the Mojo plugin, I didn't find a clear way to implement several grant flows. And my guess was that sticking to using the core lib was easier. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #26 from Julian Maurice <julian.maurice@biblibre.com> --- (In reply to Josef Moravec from comment #24)

Token is removed, but i got status 500 Can you check the logs? I just tested and for me it returns 401 as expected

One test is failing for me I didn't launch the tests after the rebase and I missed that required permissions for /patrons have changed. I will fix that in a follow-up

-- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #28 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74051 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74051&action=edit Bug 20402: Fix oauth.t GET /patrons now requires { "borrowers": 1 } instead of { "borrowers": "edit_borrowers" } -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #29 from Josef Moravec <josef.moravec@gmail.com> --- Tested on another devbox, now I got 401 Unauthorized. I have an idea of what is going on: This only adds new authorization method, but the authorization with cookies (eg. when you are normally logged into koha) is still taken into account. But yesterday I used the koha database user to change permission of api user - so token was expired and oauth say unauthorized, then cookie was found bud the logged in user was database user and that's the reason why it exploded -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74050|0 |1 is obsolete| | Attachment #74051|0 |1 is obsolete| | --- Comment #30 from Josef Moravec <josef.moravec@gmail.com> --- Created attachment 74069 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74069&action=edit Bug 20402: Implement OAuth2 authentication for REST API It implements only the "client credentials" flow with no scopes support. API clients are tied to an existing patron and have the same permissions as the patron they are tied to. API Clients are defined in $KOHA_CONF. Test plan: 0. Install Net::OAuth2::AuthorizationServer 0.16 and Mojolicious::Plugin::OAuth2::Server 0.40 1. In $KOHA_CONF, add an <api_client> element under <config>: <api_client> <client_id>$CLIENT_ID</client_id> <client_secret>$CLIENT_SECRET</client_secret> <patron_id>X</patron_id> <!-- X is an existing borrowernumber --> </api_client> 2. Apply patch, run updatedatabase.pl and reload starman 3. Install Firefox extension RESTer [1] 4. In RESTer, go to "Authorization" tab and create a new OAuth2 configuration: - OAuth flow: Client credentials - Access Token Request Method: POST - Access Token Request Endpoint: http://$KOHA_URL/api/v1/oauth/token - Access Token Request Client Authentication: Credentials in request body - Client ID: $CLIENT_ID - Client Secret: $CLIENT_SECRET 5. Click on the newly created configuration to generate a new token (which will be valid only for an hour) 6. In RESTer, set HTTP method to GET and url to http://$KOHA_URL/api/v1/patrons then click on SEND If patron X has permission 'borrowers', it should return 200 OK with the list of patrons Otherwise it should return 403 with the list of required permissions (Please test both cases) 7. Wait an hour (or run the following SQL query: UPDATE oauth_access_tokens SET expires = 0) and repeat step 6. You should have a 403 Forbidden status, and the token must have been removed from the database. 8. Create a bunch of tokens using RESTer, make some of them expires using the previous SQL query, and run the following command: misc/cronjobs/cleanup_database.pl --oauth-tokens Verify that expired tokens were removed, and that the others are still there 9. prove t/db_dependent/api/v1/oauth.t [1] https://addons.mozilla.org/en-US/firefox/addon/rester/ Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #32 from Julian Maurice <julian.maurice@biblibre.com> --- (In reply to Josef Moravec from comment #29)

Tested on another devbox, now I got 401 Unauthorized.

I have an idea of what is going on:

This only adds new authorization method, but the authorization with cookies (eg. when you are normally logged into koha) is still taken into account.

But yesterday I used the koha database user to change permission of api user - so token was expired and oauth say unauthorized, then cookie was found bud the logged in user was database user and that's the reason why it exploded

Then maybe we should not try cookie authentication if oauth fail and we have an Authorization header containing 'Bearer' ? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #34 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74088 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74088&action=edit Bug 20402: Don't look at cookies if OAuth2 is attempted and has failed -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|20568 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20568 [Bug 20568] Add API key management interface for patrons -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Julian Maurice <julian.maurice@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74070|0 |1 is obsolete| | --- Comment #36 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74366 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74366&action=edit Bug 20402: Fix oauth.t GET /patrons now requires { "borrowers": 1 } instead of { "borrowers": "edit_borrowers" } Signed-off-by: Josef Moravec <josef.moravec@gmail.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #38 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74368 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74368&action=edit Bug 20402: Remove dependency on Mojo::Plugin::OAuth2::Server -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74365|0 |1 is obsolete| | --- Comment #40 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74380 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74380&action=edit Bug 20402: Implement OAuth2 authentication for REST API It implements only the "client credentials" flow with no scopes support. API clients are tied to an existing patron and have the same permissions as the patron they are tied to. API Clients are defined in $KOHA_CONF. Test plan: 0. Install Net::OAuth2::AuthorizationServer 0.16 1. In $KOHA_CONF, add an <api_client> element under <config>: <api_client> <client_id>$CLIENT_ID</client_id> <client_secret>$CLIENT_SECRET</client_secret> <patron_id>X</patron_id> <!-- X is an existing borrowernumber --> </api_client> 2. Apply patch, run updatedatabase.pl and reload starman 3. Install Firefox extension RESTer [1] 4. In RESTer, go to "Authorization" tab and create a new OAuth2 configuration: - OAuth flow: Client credentials - Access Token Request Method: POST - Access Token Request Endpoint: http://$KOHA_URL/api/v1/oauth/token - Access Token Request Client Authentication: Credentials in request body - Client ID: $CLIENT_ID - Client Secret: $CLIENT_SECRET 5. Click on the newly created configuration to generate a new token (which will be valid only for an hour) 6. In RESTer, set HTTP method to GET and url to http://$KOHA_URL/api/v1/patrons then click on SEND If patron X has permission 'borrowers', it should return 200 OK with the list of patrons Otherwise it should return 403 with the list of required permissions (Please test both cases) 7. Wait an hour (or run the following SQL query: UPDATE oauth_access_tokens SET expires = 0) and repeat step 6. You should have a 403 Forbidden status, and the token must have been removed from the database. 8. Create a bunch of tokens using RESTer, make some of them expires using the previous SQL query, and run the following command: misc/cronjobs/cleanup_database.pl --oauth-tokens Verify that expired tokens were removed, and that the others are still there 9. prove t/db_dependent/api/v1/oauth.t [1] https://addons.mozilla.org/en-US/firefox/addon/rester/ Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74367|0 |1 is obsolete| | --- Comment #42 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74382 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74382&action=edit Bug 20402: Don't look at cookies if OAuth2 is attempted and has failed Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74369|0 |1 is obsolete| | --- Comment #44 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74384 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74384&action=edit Bug 20402: Use TestBuilder->build_object in oauth.t Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #46 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 74386 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74386&action=edit Bug 20402: Add missing POD Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This development adds the release notes| |OAuth2 client credentials | |grant support to Koha. This | |way, securitizing the REST | |api for using it from other | |systems gets easier as it | |follows current standards. Severity|enhancement |new feature -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |20612 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20612 [Bug 20612] Make OAuth2 use patron's client_id/secret pairs -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #49 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- It the key is revoked or deleted, the token is still valid, is it expected? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #58 from Julian Maurice <julian.maurice@biblibre.com> --- Created attachment 74600 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=74600&action=edit Bug 20402: Remove useless call to Koha::OAuthAccessTokens->search -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #60 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- (In reply to Julian Maurice from comment #55)

'any' returns a boolean value, we're looking for the $client hashref here

...

'first' would be more appropriate, sorry, you are totally right, 'any' is not appropriate here at all.

I don't think we should cache the access token, because it can expire

...

Ah, you're using the 'random string' approach for the tokens so the expiry isn't embedded within the token. I've always used JWT's. Apologies, you can't cache it in that case then.

-- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Implement OAuth2 |OAuth2 client credentials |authentication for REST API |grant for REST API -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74381|0 |1 is obsolete| | --- Comment #63 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 75027 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75027&action=edit Bug 20402: Fix oauth.t GET /patrons now requires { "borrowers": 1 } instead of { "borrowers": "edit_borrowers" } Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74383|0 |1 is obsolete| | --- Comment #65 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 75029 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75029&action=edit Bug 20402: Remove dependency on Mojo::Plugin::OAuth2::Server Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74385|0 |1 is obsolete| | --- Comment #67 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 75031 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75031&action=edit Bug 20402: Atomic update and kohastructure.sql fixes Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #74600|0 |1 is obsolete| | --- Comment #69 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 75033 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75033&action=edit Bug 20402: Remove useless call to Koha::OAuthAccessTokens->search -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|20624 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20624 [Bug 20624] Disable the OAuth2 client credentials grant by default -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #71 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 75189 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=75189&action=edit Bug 20402: only output if verbose flag is set -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #73 from David Cook <dcook@prosentient.com.au> --- I know this has already been pushed... but it looks like this allows for only 1 API client? What if you want to have multiple API clients? BibLibre might have Coral talking to Koha's REST API, but maybe a client's Drupal website wants to talk to Koha's REST API too? Right now, I suppose you could share the credentials amongst all the clients, but that doesn't seem like a great long-term option? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 --- Comment #75 from David Cook <dcook@prosentient.com.au> --- (In reply to Julian Maurice from comment #74)

You could define as many API clients as you want in $KOHA_CONF. But this has been replaced by bug 20568 and bug 20612. You can now define API keys in the interface.

Oooh awesome! I've wanted that feature for so long :D. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20402 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=25796 -- You are receiving this mail because: You are watching all bug changes.