[Bug 16282] New: Usernames should be case sensitive
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Bug ID: 16282 Summary: Usernames should be case sensitive Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Patrons Assignee: koha-bugs@lists.koha-community.org Reporter: chris@bigballofwax.co.nz QA Contact: testopia@bugs.koha-community.org CC: gmcharlt@gmail.com, kyle.m.hall@gmail.com Currently we don't care about case sensitivity for usernames, this is mostly ok, except when doing SSO ... with many systems who do care about case sensitivity, we can get username collisions. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #1 from Chris Cormack <chris@bigballofwax.co.nz> --- This only changes for the internal methods of Koha So not Shibboleth, LDAP etc, they all function the same as they were. Just anything that uses Koha's internal login method is affected. For upgrades, behaviour will stay the same, the syspref will go in off. But for new installs they will have case sensitive usernames. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #2 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 50442 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=50442&action=edit Bug 16282 : Setting up the database for case sensitive usernames Just adding a syspref For upgrade, current behaviour stays the same For new installs, usernames are now case sensitive -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #3 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 50443 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=50443&action=edit Bug 16282 : Make check_pw_internal case sensitve for user names To test: 1/ Make a user with a username like Fish 2/ Login to OPAC and staff side, test you can login with username fish, FISH, FIsh etc 3/ Apply patch, set UsernamesCaseSensitive to No 4/ Login again to OPAC and staff side, test you can still use fish, FISH 5/ Set syspref to Yes 6/ Try logging in with fish, note you cant 7/ Login with Fish successfully -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #4 from Chris Cormack <chris@bigballofwax.co.nz> --- Created attachment 50447 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=50447&action=edit Bug 16282 : Making GetMember be case sensitive for userid The main place this changes is SIP GetMember with a username is only used in 3 places C4/SIP/ILS/Patron.pm: $kp = GetMember(cardnumber=>$patron_id) || GetMember(userid=>$patron_id); misc/load_testing/benchmark_staff.pl: unless defined C4::Members::GetMember(userid => $user); tools/import_borrowers.pl: $member = GetMember( 'userid' => $borrower{'userid'} ); To Test SIP 1/ Apply patches, set syspref to No (it should be No already but just in case) 2/ Restart the SIP server 3/ Login to SIP with a userid and password combo 4/ Notice no change, try with different case for userid 5/ Switch on the syspref 6/ Restart the SIP server 7/ Notice the userid/username case sensitive now The benchmarking script appears faulty anyway, but if you can get it to run, it should now care about case sensitive usernames if you have the syspref on. To test borrower import 1/ Apply patch, check syspref is No 2/ Import borrowers with the userid being the matchpoint notice case doesn't matter 3/ Switch syspref to Yes 4/ Import borrowers again, now they will only match if the userid(username) matches exactly (Case sensitive) -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff --- Comment #5 from Chris Cormack <chris@bigballofwax.co.nz> --- Just to note ILSDI AuthenticPatron, svc/authenticate will all respect this syspref also I assume the REST api will too, but it's all woo woo magic so hard to actually tell how it is authenticating. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com --- Comment #6 from Nick Clemens <nick@bywatersolutions.com> --- I tried testing this patch, it works well for regular sign in to koha. Import borrowers I couldn't test (but I think 15840 has an issue) SIP - can this be tested using the sip_cli_emulator? If so I couldn't figure a method -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #7 from Chris Cormack <chris@bigballofwax.co.nz> ---
SIP - can this be tested using the sip_cli_emulator? If so I couldn't figure a method
Perhaps, I tested this with an EzProxy set up that was connected to Koha via SIP. I'll see if I can figure out how to get the emulator to do it. I think it's just using cardnumber though. But probably can extend it -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #8 from M. Tompsett <mtompset@hotmail.com> --- Comment on attachment 50443 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=50443 Bug 16282 : Make check_pw_internal case sensitve for user names Review of attachment 50443: --> (https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=16282&attachment=50443) ----------------------------------------------------------------- ::: C4/Auth.pm @@ +1793,5 @@
+ my $sth; + if ( C4::Context->preference('UsernamesCaseSensitive') ){ + # This query does a case sensitive query, but it first does a insensitive one so that the index can still be used + # This will mean we don't get a nasty performance hit + $sth = $dbh->prepare("SELECT * FROM (SELECT password,cardnumber,borrowernumber,userid,firstname,surname,borrowers.branchcode,branches.branchname,flags FROM borrowers JOIN branches ON borrowers.branchcode=branches.branchcode WHERE userid= ?) AS firstpass WHERE BINARY userid = ?");
WHERE BINARY? This is a MySQL-ism, is it not? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |chris@bigballofwax.co.nz |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 --- Comment #9 from Owen Leonard <oleonard@myacpl.org> --- (In reply to M. Tompsett from comment #8)
WHERE BINARY? This is a MySQL-ism, is it not?
Is it? Anyone able to point to documentation? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com --- Comment #10 from M. Tompsett <mtompset@hotmail.com> --- (In reply to Owen Leonard from comment #9)
(In reply to M. Tompsett from comment #8)
WHERE BINARY? This is a MySQL-ism, is it not?
Is it? Anyone able to point to documentation?
https://dev.mysql.com/doc/refman/5.7/en/cast-functions.html I can't find such a casting name for postgres sqlite or other SQLs. Though, I could be wrong. Which is why I was asking for confirmation. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |veron@veron.ch --- Comment #11 from Marc Véron <veron@veron.ch> --- (In reply to M. Tompsett from comment #10)
(In reply to Owen Leonard from comment #9)
(In reply to M. Tompsett from comment #8)
WHERE BINARY? This is a MySQL-ism, is it not?
Is it? Anyone able to point to documentation?
https://dev.mysql.com/doc/refman/5.7/en/cast-functions.html I can't find such a casting name for postgres sqlite or other SQLs. Though, I could be wrong. Which is why I was asking for confirmation.
WHERE BINARY does not exist e.g. for Oracle: http://stackoverflow.com/questions/14819724/where-binary-in-oracle -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Marc Véron <veron@veron.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=18424 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #12 from Owen Leonard <oleonard@myacpl.org> ---
WHERE BINARY does not exist e.g. for Oracle: http://stackoverflow.com/questions/14819724/where-binary-in-oracle
So this should be Failed QA? Please correct the status if not. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=17829 --- Comment #13 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Note that I am going to remove GetMember on bug 17829. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 jdemuth@roseville.ca.us <jdemuth@roseville.ca.us> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jdemuth@roseville.ca.us -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16282 Ray Delahunty <r.delahunty@arts.ac.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |r.delahunty@arts.ac.uk See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=41171 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org