[Bug 31247] New: Staff interface 2FA blocks logging into the OPAC
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Bug ID: 31247 Summary: Staff interface 2FA blocks logging into the OPAC Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: caroline.cyr-la-rose@inlibro.com QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org I noticed when I turned on the 2FA for my staff account, I'm no longer able to log into the OPAC with that same account. I usually use the same account for both, so I find this a major drawback in using 2FA. To test: 1) With 2FA turned off, log into the staff interface with your staff account --> login is normal 2) With 2FA turned off, log into the OPAC with the same account --> login is normal 3) Turn on 2FA 3.1) In System preferences, enable TwoFactorAuthentication 3.2) Go to 'My account' (click your username in the top right and choose 'My account) 3.3) Click More > Manage two-factor authentication 3.4) Click Enable two-factor authentication 3.5) With an authenticator app (I used FreeOTP) scan the QR code 3.6) Enter the PIN provided by the app in the PIN code field 3.7) Click Register with two-factor app 4) Log out of the staff interface 5) Log into the staff interface --> Username, password and two-factor code is needed 6) Log out of the OPAC 7) Log into the OPAC (I used the login box on the right) --> It cycles back to the login page, you can never log in 8) In the staff interface, disable 2FA 8.1) In 'My account', click More > Manage two-factor authentication 8.2) Click Disable two-factor authentication 9) Log into the OPAC --> login is normal -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |20476 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20476 [Bug 20476] Two factor authentication for the staff client - omnibus -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |28786 Severity|major |critical Status|NEW |In Discussion Assignee|koha-bugs@lists.koha-commun |jonathan.druart+koha@gmail. |ity.org |com CC| |jonathan.druart+koha@gmail. | |com Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28786 [Bug 28786] Two-factor authentication for staff client - TOTP -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|In Discussion |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 --- Comment #1 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 138181 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=138181&action=edit Bug 31247: Fix OPAC authentication when 2FA is enabled Silly mistake from bug 28786, the $type should be compared to "opac" instead of "OPAC", erk! Test plan: Turn 2FA on Set it up for an user Login at the OPAC => Without this patch you keep being redirected to the auth form screen => With this patch applied you are able to successfully login -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 --- Comment #2 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- Created attachment 138182 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=138182&action=edit Bug 31247: Add tests -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |rel_22_05_candidate CC| |lucas@bywatersolutions.com, | |m.de.rooy@rijksmuseum.nl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #138181|0 |1 is obsolete| | --- Comment #3 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Created attachment 138183 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=138183&action=edit Bug 31247: Fix OPAC authentication when 2FA is enabled Silly mistake from bug 28786, the $type should be compared to "opac" instead of "OPAC", erk! Test plan: Turn 2FA on Set it up for an user Login at the OPAC => Without this patch you keep being redirected to the auth form screen => With this patch applied you are able to successfully login Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #138182|0 |1 is obsolete| | --- Comment #4 from Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> --- Created attachment 138184 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=138184&action=edit Bug 31247: Add tests Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |victor@tuxayo.net Status|Signed Off |Failed QA --- Comment #5 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Found issue 1. don't apply patch 2. setup 2FA 3. logout staff 4. login and use 2FA 5. go to OPAC 6. logout OPAC (in my setup, on localhost but on a different port, OPAC and staff share session) 7. try to log in the OPAC 8. it fails 9. apply patch and restart services 10. try to log in the OPAC 11. it still fails (nothing in the logs), this is not expected 12. go to staff 13. you are prompted for 2FA 14. cancel (I guess putting the code would also unblock the situation) 15. go to opac and retry logging 16. it works! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|testopia@bugs.koha-communit |victor@tuxayo.net |y.org | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 --- Comment #6 from Victor Grousset/tuxayo <victor@tuxayo.net> --- BTW, step 8 on my test plan, going to the staff interface and hitting cancel to the 2FA doesn't make the OPAC logging work. So the patch is indeed needed. Also, on step 8 if one does the 2FA and retries the OPAC it works. So it seems to show that it's linked to this ticket and that it's incomplete. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Jonathan Druart <jonathan.druart+koha@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Signed Off --- Comment #7 from Jonathan Druart <jonathan.druart+koha@gmail.com> --- You let the session in an unexpected state and change the code? Yes of course it is failing. If you want your steps to work you must truncate the sessions table after you applied the patches. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #138184|0 |1 is obsolete| | --- Comment #8 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 138219 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=138219&action=edit Bug 31247: Add tests Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #138183|0 |1 is obsolete| | --- Comment #9 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Created attachment 138220 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=138220&action=edit Bug 31247: Fix OPAC authentication when 2FA is enabled Silly mistake from bug 28786, the $type should be compared to "opac" instead of "OPAC", erk! Test plan: Turn 2FA on Set it up for an user Login at the OPAC => Without this patch you keep being redirected to the auth form screen => With this patch applied you are able to successfully login Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA --- Comment #10 from Victor Grousset/tuxayo <victor@tuxayo.net> ---
You let the session in an unexpected state and change the code?
Ah ok the bad state comes from before the patch is applied! Thanks for clearing that up. Works, qa script happy, code looks good, passing QA :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |22.11.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 --- Comment #11 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Pushed to master for 22.11. Nice work everyone, thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to master |Pushed to stable Version(s)|22.11.00 |22.11.00, 22.05.06 released in| | --- Comment #12 from Lucas Gass <lucas@bywatersolutions.com> --- Backported to 22.05.x for 22.05.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Arthur Suzuki <arthur.suzuki@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arthur.suzuki@biblibre.com Resolution|--- |FIXED Status|Pushed to stable |RESOLVED --- Comment #13 from Arthur Suzuki <arthur.suzuki@biblibre.com> --- Depends on 2FA feature, won't backport to 21.11! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31247 Lucas Gass <lucas@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords|rel_22_05_candidate | -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org