https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #1 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 53257 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=53257&action=edit Bug 16892: Add automatic patron registration via OAuth2 login 10988 added the ability to log into the OPAC authenticating with Google Open ID Connect. This extends it, by allowing an unregistered patron to have an account automatically created with default category code and branch. This is accomplished by adding 3 system preferences. - GoogleOpenIDConnectAutoRegister whether it will attempt to auto-register the patron. - GoogleOpenIDConnectDefaultCategory This category code will be used to create Google OpenID Connect patrons. - GoogleOpenIDConnectDefaultBranch' This branch code will be used to create Google OpenID Connect patrons. Sponsored-by: Tulong Aklatan -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #3 from M. Tompsett <mtompset@hotmail.com> --- TEST PLAN --------- 1) backup the database 2) run upgrade: ./installer/data/mysql/updatedatabase.pl -- proves the atomic update. 3) run it again: -- proves the INSERT IGNORE is done 4) drop the database and recreate it mysql> drop database koha_library; mysql> create database koha_library; 5) run the web installer 6) log into the staff client 7) Home -> Koha administration -> Global system preferences -> Administration -- GoogleOpenIDConnectAutoRegister, GoogleOpenIDConnectDefaultBranch, and GoogleOpenIDConnectDefaultCategory should be visible in the "Google OpenID Connect" section. -- proves the admin.pref is correct 8) In a new tab, go to https://console.developers.google.com/project and log in. 9) Click 'CREATE PROJECT' 10) Enter a project name which isn't going to scare the user off. (e.g. {institution} Library Authentication) 11) Wait a bit, then click 'Credentials' on the left pane. 12) Click the 'Create credentials' drop down button, and select 'OAuth client ID' 13) Click the 'Configure consent screen' button 14) Enter at least a product name which isn't going to scare the user off. (e.g. {institution} Library) 15) Click 'Save' 16) Select 'Web application' 17) Enter at least a memorable name whose purpose is clear. (e.g. {institution} Library Credentials) 18) Enter the OPAC URL into the 'Authorized JavaScript origins' text box 19) Enter a URL of the form: {OPACBaseURL}/cgi-bin/koha/svc/auth/googleopenidconnect into the 'Authorized redirect URIs' text box. 20) Click the 'Create' button. 21) Copy the client ID into the 'GoogleOAuth2ClientID' system preference 22) Copy the client secret into the 'GoogleOAuth2ClientSecret' system preference 23) Change the 'GoogleOpenIDConnect' system preference to 'Use'. 24) Change the 'GoogleOpenIDConnectAutoRegister' system preference to 'Allow' 25) Enter default branch and category values. (for all sample data: GoogleOpenIDConnectDefaultBranch=CPL, GoogleOpenIDConnectDefaultCategory=PT) 26) Click 'Save all Administration preferences' 27) Click 'OPAC' in the left pane. 28) Make sure OPACBaseURL is set. 27) Open the OPAC and click 'Log in to your account' 28) Click 'Allow' to authorize Google. -- should end up at opac-user page. -- proves everything works. :) NOTE: Because of the nature of OAuth, authenticating this way does not force a Google log out and the user MUST make a secondary effort to log out or close the browser. Otherwise, a person from the same terminal could abuse that person's Google account. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Josef Moravec <josef.moravec@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |josef.moravec@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #5 from David Cook <dcook@prosentient.com.au> --- This seems odd to me. I have a local Open ID Connect implementation for a Koha client, but they control the authentication server too. I auto-register anyone missing from Koha who already exists on the server, but I don't understand why you would if you didn't control the server. What library would want any Gmail user auto-enrolled? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #7 from M. Tompsett <mtompset@hotmail.com> --- Jerwyn, I think you missed David's point. This does not limit to a particular domain. Though, you do bring up a valid counter point, but would need further implementation. Google does provide domain hosting capabilities which those using their services do control the domain. There is currently no logic in this code to actually limit the domain, which is what David is complaining about, I think. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #9 from Jerwyn <os.jerwynfernandez@gmail.com> --- Created attachment 56081 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=56081&action=edit domain -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #11 from David Cook <dcook@prosentient.com.au> --- Ahh, sounds good. I suppose I'm still not happy that this feature is Google-specific and wasn't made to be more general, but I had the opportunity to contribute my Open ID Connect code and didn't, so I can't complain too much :p. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #53257|0 |1 is obsolete| | --- Comment #13 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 57111 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=57111&action=edit Bug 16892: Add automatic patron registration via OAuth2 login 10988 added the ability to log into the OPAC authenticating with Google Open ID Connect. This extends it, by allowing an unregistered patron to have an account automatically created with default category code and branch. This is accomplished by adding 3 system preferences. - GoogleOpenIDConnectAutoRegister whether it will attempt to auto-register the patron. - GoogleOpenIDConnectDefaultCategory This category code will be used to create Google OpenID Connect patrons. - GoogleOpenIDConnectDefaultBranch' This branch code will be used to create Google OpenID Connect patrons. Sponsored-by: Tulong Aklatan -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #53488|0 |1 is obsolete| | --- Comment #15 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 57113 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=57113&action=edit Bug 16892: Follow up with adding missing IGNORE -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 PTFS Europe Sandboxes <sandboxes@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sandboxes@ptfs-europe.com Status|Needs Signoff |Signed Off --- Comment #17 from PTFS Europe Sandboxes <sandboxes@ptfs-europe.com> --- Patch tested with a sandbox, by Eugene Espinoza <eugenegf@yahoo.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 PTFS Europe Sandboxes <sandboxes@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #57112|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #18 from PTFS Europe Sandboxes <sandboxes@ptfs-europe.com> --- Created attachment 58373 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=58373&action=edit Bug 16892: Add automatic patron registration via OAuth2 login 10988 added the ability to log into the OPAC authenticating with Google Open ID Connect. This extends it, by allowing an unregistered patron to have an account automatically created with default category code and branch. This is accomplished by adding 3 system preferences. - GoogleOpenIDConnectAutoRegister whether it will attempt to auto-register the patron. - GoogleOpenIDConnectDefaultCategory This category code will be used to create Google OpenID Connect patrons. - GoogleOpenIDConnectDefaultBranch' This branch code will be used to create Google OpenID Connect patrons. Sponsored-by: Tulong Aklatan Signed-off-by: Eugene Espinoza <eugenegf@yahoo.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #20 from PTFS Europe Sandboxes <sandboxes@ptfs-europe.com> --- Created attachment 58375 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=58375&action=edit Bug 16892: Follow up with adding missing IGNORE Signed-off-by: Eugene Espinoza <eugenegf@yahoo.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Bug 16892 depends on bug 10988, which changed state. Bug 10988 Summary: Allow login via Google OAuth2 (OpenID Connect) https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10988 What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #58373|0 |1 is obsolete| | --- Comment #24 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 61801 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=61801&action=edit Bug 16892: Add automatic patron registration via OAuth2 login 10988 added the ability to log into the OPAC authenticating with Google Open ID Connect. This extends it, by allowing an unregistered patron to have an account automatically created with default category code and branch. This is accomplished by adding 3 system preferences. - GoogleOpenIDConnectAutoRegister whether it will attempt to auto-register the patron. - GoogleOpenIDConnectDefaultCategory This category code will be used to create Google OpenID Connect patrons. - GoogleOpenIDConnectDefaultBranch' This branch code will be used to create Google OpenID Connect patrons. Sponsored-by: Tulong Aklatan -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #58375|0 |1 is obsolete| | --- Comment #26 from M. Tompsett <mtompset@hotmail.com> --- Created attachment 61803 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=61803&action=edit Bug 16892: Follow up with adding missing IGNORE -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 sandboxes@biblibre.com <sandboxes@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off CC| |sandboxes@biblibre.com --- Comment #28 from sandboxes@biblibre.com <sandboxes@biblibre.com> --- Patch tested with a sandbox, by Eugene Jose Espinoza <eugenegf@yahoo.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 sandboxes@biblibre.com <sandboxes@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #61802|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 sandboxes@biblibre.com <sandboxes@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #61804|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #30 from sandboxes@biblibre.com <sandboxes@biblibre.com> --- Created attachment 61887 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=61887&action=edit Bug 16892: System Preferences This adds the missing system preferences for a fresh install. Signed-off-by: Eugene Jose Espinoza <eugenegf@yahoo.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #32 from sandboxes@biblibre.com <sandboxes@biblibre.com> --- Created attachment 61889 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=61889&action=edit Bug 16892: Follow up use AddMember as per QA comment Same Test plan as before. Signed-off-by: Eugene Jose Espinoza <eugenegf@yahoo.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #35 from M. Tompsett <mtompset@hotmail.com> --- ARG! I really hate them constantly changing the interface. It makes it so much harder to help people set up. First you need to confirm the Google OAuth works normally: Go to https://console.developers.google.com/project Log in Click '+ Create Project' Type in a project name and click 'CREATE' -- the notification bell will highlight Select the creation notification with the project just created Click 'Go to APIs overview' Click 'Credentials' in the left panel Click the 'Create credentials' drop-down button Click 'OAuth client ID' Click 'Configure consent screen' Put it a meaningful string into the Product Name (e.g. South Pole Library Authentication) Fill in the other fields as desired (or not) Click 'Save' Click the 'Web application' radio button Change the 'AUTHORIZED JAVASCRIPT ORIGINS' to your OPACBaseURL. (http://localhost:8080) Change the 'AUTHORIZED REDIRECT URIS' to point to the new googleoauth2 script (http://localhost:8080/cgi-bin/koha/svc/auth/googleopenidconnect) Click 'Create' Copy and paste the 'Client ID' into the GoogleOAuth2ClientID system preference. Copy and paste the 'client secret' into the GoogleOAuth2ClientSecret system preference. Change the GoogleOpenIDConnect system preference to 'Use'. Click 'Save all Administration preferences' Click 'OK' to dismiss the client ID and client secret dialogue. In the OPAC, click 'Log in to your account'. -- You should get a confirmation request, if you are already logged in, OR a login screen if you are not. -- You need to have the primary email address set to one authenticated by Google in order to log in. -- OPACBaseURL system preference needs to be set as well. This confirms you have the Google Authentication set up. Make sure your google email is not associated with an account now, or you have a second account to test with that has no patron matching. Apply the patch Upgrade the database Make sure you set the three new system preferences: GoogleOpenIDConnectAutoRegister - Allow GoogleOpenIDConnectDefaultBranch - Any valid existing branchcode. GoogleOpenIDConnectDefaultCategory - Any valid existing patron category. Attempt to log in with a Google account not associated with a Koha account. -- should succeed Searching for patron in Staff client should show they are that branch and category. Run koha qa test tools. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #61886|0 |1 is obsolete| | Attachment #61887|0 |1 is obsolete| | Attachment #61888|0 |1 is obsolete| | Attachment #61889|0 |1 is obsolete| | --- Comment #37 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 63117 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=63117&action=edit Bug 16892: Add automatic patron registration via OAuth2 login 10988 added the ability to log into the OPAC authenticating with Google Open ID Connect. This extends it, by allowing an unregistered patron to have an account automatically created with default category code and branch. This is accomplished by adding 3 system preferences. - GoogleOpenIDConnectAutoRegister whether it will attempt to auto-register the patron. - GoogleOpenIDConnectDefaultCategory This category code will be used to create Google OpenID Connect patrons. - GoogleOpenIDConnectDefaultBranch' This branch code will be used to create Google OpenID Connect patrons. Sponsored-by: Tulong Aklatan Signed-off-by: Eugene Jose Espinoza <eugenegf@yahoo.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #39 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 63119 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=63119&action=edit Bug 16892: Follow up with adding missing IGNORE Signed-off-by: Eugene Jose Espinoza <eugenegf@yahoo.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #41 from Nick Clemens <nick@bywatersolutions.com> --- Tested with new instrcutions, works as advertised, the code looks good to me I tested under plack/memcached and saw no difference when I removed the find for borrower so think that can be safely removed. One question, out of scope: For CAS we have casLogout - can we have something similar here? I think disconcerting if a patron signs in via google, signs out of Koha and walks away leaving their google auth intact unintentionally Leaving at SO for final comments from Jonathan -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com --- Comment #43 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- A federated logout is actually pretty rare in my experience, though it is possible. As you say Mark, it 'feels' strange to the user that logging out of seemingly unrelated apps can have the knock on effect of logging out apps in other tabs that happen to share an aouth2 openid connect identity provider. On a related note, I'm not sure I saw any code out end to support such a federated logout triggered by another service in our end either... but perhaps I missed it ;) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #45 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Nick Clemens from comment #44)

Perhaps if OAuth is activated just a note added that when you log out of Koha you may still be logged in via google? [SNIP]

Perhaps this type of discussion should happen on another bug report, as this bug has nothing to do with logging out. :) Also, yes, some sort of warning should be displayed, somewhere, somehow. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #46 from Nick Clemens <nick@bywatersolutions.com> --- Moving to PQA, Jonathan can comment at Rm level now :-) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |ASSIGNED -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #49 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Jonathan Druart from comment #47)

However I think it would be good to handle a wrong or non-existent patron category or branchcode (GoogleOpenIDConnectDefaultCategory and GoogleOpenIDConnectDefaultBranch).

I have no problem with that. That's reasonable.

Usually I am not in favour of over-checking everything but it sounds like it is needed here (in order to avoid the 500).

I'm having the darnedest time with my $patron_category = Koha::Patron::Categories->find( $valid_category_code ); being undef. :( -- Working on it. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |Needs Signoff Patch complexity|Small patch |Medium patch -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #52 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to David Cook from comment #48)

(In reply to Jonathan Druart from comment #47)

...

Everything looks fine to me. However I think it would be good to handle a wrong or non-existent patron category or branchcode (GoogleOpenIDConnectDefaultCategory and GoogleOpenIDConnectDefaultBranch). Usually I am not in favour of over-checking everything but it sounds like it is needed here (in order to avoid the 500).

I still think it's a shame that we hard-coded "Google" into the system preferences, when OpenIDConnect can be implemented by other providers, but I think I'm flogging a dead horse on that one...

Not introduced by this patch set, they use the existing pattern. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Bug 16892 depends on bug 10988, which changed state. Bug 10988 Summary: Allow login via Google OAuth2 (OpenID Connect) https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10988 What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |UNCONFIRMED Resolution|FIXED |--- -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |RESOLVED CC| |fridolin.somers@biblibre.co | |m Resolution|--- |FIXED --- Comment #54 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Enhancement not pushed to 17.05.x -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16892 --- Comment #56 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- David earns the necromancer badge... -- You are receiving this mail because: You are watching all bug changes.