https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.derscheid@lmscloud.de --- Comment #2 from Paul Derscheid <paul.derscheid@lmscloud.de> --- This is properly the best guidance on how to incorporate it: https://www.passkeys.com/guide What we also should do beforehand is to decide on how we'd like to do JSON-RPC in Koha :) See bugs: - 30652: RPC style action endpoint for choosing matches - 34784: Add ability to populate empty item call numbers for a record based on the itemcallnumber system preference - 38224: Move populate_empty_callnumbers logic into Koha::Biblio for reusability - 38226: Add RPC endpoint for batch filling empty callnumbers - 38745: Add a proof of concept JSON-RPC driven endpoint for RPC style calls that don't fit REST ideals Can't yet declare one of them as a dependency for this one. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #3 from David Nind <david@davidnind.com> --- An article from Troy Hunt attempting to explain passkeys and why they are needed: Passkeys for Normal People (5 May 2025), https://www.troyhunt.com/passkeys-for-normal-people/ -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #4 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 185295 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185295&action=edit Bug 39601: Atomic update -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #6 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 185297 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=185297&action=edit Bug 39601: Add staff passkeys (WebAuthn) support Introduce staff passkey (WebAuthn) registration and authentication in Koha. Provides REST endpoints, persistence, UI hooks, and session integration so staff can register a passkey against a patron record and authenticate on the staff login screen using platform authenticators. Implementation: - New controller Koha::REST::V1::Webauthn with endpoints: - POST /api/v1/webauthn/register/challenge - POST /api/v1/webauthn/register - POST /api/v1/webauthn/authenticate/challenge - POST /api/v1/webauthn/authenticate - Use Authen::WebAuthn validate_registration/validate_assertion - Generate cryptographically secure challenges; store challenge and patron_id in the session - Handle base64url consistently for WebAuthn fields; convert to/from standard base64 at the API boundary - Derive origin and rp_id from StaffClientBaseURL (or the request URL) to enforce correct WebAuthn origins - Persist credentials (credential_id, public_key as raw bytes) in the new webauthn_credentials table; set created_on as DATETIME; update sign_count and last_used after successful authentication - Build allowCredentials from stored credential IDs for authentication challenges - On successful authentication, issue a staff session and set the CGISESSID cookie so the user is logged in to the staff interface API: - Add api/v1/swagger/paths/webauthn.yaml defining the WebAuthn endpoints, request/response schemas (including allowCredentials), and x-koha- authorization requiring the catalogue permission DB: - Add webauthn_credentials table via installer/data/mysql/atomicupdate/ bug_39601_add_passkey_support.pl - Add Koha::Schema::Result::WebauthnCredential and Koha::WebauthnCredential(s) object classes UI: - Staff login: add JS helper (auth-webauthn.inc) to request a challenge, convert base64url to bytes, call navigator.credentials.get, send results with credentials: "same-origin", and redirect to mainpage on success - Patron page: add JS helper (passkey-register.inc) to request a registration challenge, include RS256 in pubKeyCredParams for compatibility, convert base64url to bytes, and submit attestation for storage Tests: - t/db_dependent/api/v1/webauthn.t: verify challenge endpoints accept patron_id and userid; return 404 when no credentials; include a mocked registration negative path; follow Koha testing conventions - t/db_dependent/Koha/WebauthnCredentials.t: cover ORM add/search/update/delete Documentation notes: - StaffClientBaseURL must match the scheme/host used by the browser (typically https). Ensure staff is served over the same origin for WebAuthn. - New routes under /api/v1/webauthn and a new table webauthn_credentials. Test plan: 1) Apply patches 2) Run database updates to create webauthn_credentials (updatedatabase). 3) Set StaffClientBaseURL to your staff URL (e.g., http://<name>-intra.localhost when using ktd_proxy, haven't tested with unproxied ktd) and ensure the staff interface is served over the same origin. 4) As a staff user, open a patron record and click Register Passkey from More. Complete the OS-native passkey dialog. Verify a row is stored in webauthn_credentials. - This worked well in Zen (Firefox under the hood), less so with Chromium. - Unsure whether ungoogled Chromium supports using the system password manager, worked with a browser-based password manager, though. - Best to test with many browsers! 5) Navigate to the staff login page and choose Sign in with passkey. Verify a challenge is returned, the browser prompts, and you are logged into the staff interface (redirect to mainpage). 6) Call authenticate_challenge for a patron without credentials and verify a 404 response. 7) Run: - prove t/db_dependent/Koha/WebauthnCredential.t - prove t/db_dependent/api/v1/webauthn.t 8) Sign off or review and FQA. NOTE: I think the controllers still need refactoring, this is more a POC regarding the backend. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #8 from David Cook <dcook@prosentient.com.au> --- (In reply to Paul Derscheid from comment #7)

Forgot something: you need to install libauthen-authn-perl via apt.

I think that should be libauthen-webauthn-perl -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |paul.derscheid@lmscloud.de |ity.org | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #11 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Thanks for testing Katrin, maybe something has changed in main. I will take a look this afternoon. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #190988|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #15 from Paul Derscheid <paul.derscheid@lmscloud.de> --- I think the DBIC commit was incorrect in the previous iteration. Corrected it, tests pass now and the registration and authentication flows work in Chromium. Please have another look if you want, Katrin. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Failed QA |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #185297|0 |1 is obsolete| | --- Comment #18 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 194697 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=194697&action=edit Bug 39601: Add staff passkeys (WebAuthn) support Introduce staff passkey (WebAuthn) registration and authentication in Koha. Provides REST endpoints, persistence, UI hooks, and session integration so staff can register a passkey against a patron record and authenticate on the staff login screen using platform authenticators. Implementation: - New helper module Koha::Auth::WebAuthn encapsulating origin/RP ID derivation, challenge generation and validation, patron resolution, base64url encoding utilities, and session management - New controller Koha::REST::V1::Webauthn with endpoints: - POST /api/v1/webauthn/register/challenge - POST /api/v1/webauthn/register - POST /api/v1/webauthn/authenticate/challenge - POST /api/v1/webauthn/authenticate - New typed exception classes in Koha::Exceptions::WebAuthn - Use Authen::WebAuthn validate_registration/validate_assertion - Generate cryptographically secure challenges via Bytes::Random::Secure; store challenge, patron_id and timestamp in the session with 10-minute TTL and consume-after-use to prevent replay - Handle base64url consistently for WebAuthn fields; convert to/from standard base64 at the API boundary - Derive origin and rp_id from StaffClientBaseURL (or the request URL) to enforce correct WebAuthn origins; support reverse proxy headers and http->https origin upgrade - Persist credentials (credential_id, public_key as raw bytes) in the new webauthn_credentials table; update sign_count and last_used_date after successful authentication - Build allowCredentials from stored credential IDs for authentication challenges - On successful authentication, verify account is not locked, issue a staff session and set the CGISESSID cookie so the user is logged in to the staff interface Security: - Challenge TTL (10 min) and single-use consumption prevent replay attacks - Fail-closed patron match guard rejects if either patron ID is undefined - Explicit credential pubkey existence check before assertion validation - account_locked check before issuing session - $is_https derived from already-upgraded origin (not recomputed) API: - Add api/v1/swagger/paths/webauthn.yaml defining the WebAuthn endpoints, request/response schemas (including rp_id/rpId, allowCredentials) - Register endpoints require catalogue permission - Authenticate endpoints are public (no x-koha-authorization) since they are login endpoints DB: - Add webauthn_credentials table via installer/data/mysql/atomicupdate/ bug_39601_add_passkey_support.pl and kohastructure.sql - PK: webauthn_credential_id (per SQL7), COLLATE=utf8mb4_unicode_ci, column COMMENTs, ON UPDATE CASCADE, VARBINARY(1024) for credential_id - Date columns: created_date (timestamp), last_used_date (datetime) per SQL14 - Add Koha::WebauthnCredential(s) object classes UI: - Staff login: add JS helper (auth-webauthn.inc) to request a challenge, convert base64url to bytes, call navigator.credentials.get, send results with credentials: "same-origin", and redirect to mainpage on success - Patron page: add JS helper (passkey-register.inc) to request a registration challenge, include RS256 in pubKeyCredParams for compatibility, convert base64url to bytes, and submit attestation for storage - Modern JS throughout (const/let, arrow functions, JSDoc, loop-based toBase64 to avoid stack overflow on large buffers) - aria-label on passkey login button for accessibility - __x() for translatable strings with placeholders Tests: - t/db_dependent/api/v1/webauthn.t: verify challenge endpoints accept patron_id and userid; return 404 when no credentials; include a mocked registration negative path; follow Koha testing conventions - t/db_dependent/Koha/WebauthnCredentials.t: cover ORM add/search/update/ delete with per-subtest transaction isolation Test plan: 1) Apply patches 2) Run database updates to create webauthn_credentials (updatedatabase). 3) Set StaffClientBaseURL to your staff URL (e.g., http://<name>-intra.localhost when using ktd_proxy, haven't tested with unproxied ktd) and ensure the staff interface is served over the same origin. 4) As a staff user, open a patron record and click Register Passkey from More. Complete the OS-native passkey dialog. Verify a row is stored in webauthn_credentials. - This worked well in Zen (Firefox under the hood), less so with Chromium. - Unsure whether ungoogled Chromium supports using the system password manager, worked with a browser-based password manager, though. - Best to test with many browsers! 5) Navigate to the staff login page and choose Sign in with passkey. Verify a challenge is returned, the browser prompts, and you are logged into the staff interface (redirect to mainpage). 6) Call authenticate_challenge for a patron without credentials and verify a 404 response. 7) Run: - prove t/db_dependent/Koha/WebauthnCredentials.t - prove t/db_dependent/api/v1/webauthn.t 8) Sign off or review and FQA. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #20 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Thanks for another thorough review, Katrin. I've rewritten the entire patch set from scratch incorporating all your feedback plus additional improvements found during a full coding guidelines review. 1) QA test failures — All resolved in the rewrite: - Forbidden patterns (http:// URLs, DateTime->now, current_timestamp syntax), all fixed - POD coverage — added for all public subs - Tidiness — all files run through misc/devel/tidy.pl - Template filters — [% USE raw %] added where needed - File permissions — exec flags set on .t files and atomic update - Test::NoWarnings — added to WebauthnCredentials.t 2) Code review a) Spelling: Consistent "Register passkey" throughout. b) Translatability: Fixed. The space is now between </i> and <span>, not inside the translatable string: <i class="fa fa-key"></i> <span class="d-none d-sm-inline">Passkey</span> c) "Username:" in JS: Completely removed. Patron context now comes from hidden inputs populated by template variables. 3) Testing: "Registration error: {msg}" This was a JS i18n bug. I incorrectly used __().format() which only supports %s placeholders, but the strings had {name} placeholders. Changed to __x() which uses Koha.i18n.expand() for named placeholders. Error messages should now render correctly. 4) Answers to your questions a) Testing without hardware: - Chrome/Chromium: DevTools → More tools → WebAuthn. Create a virtual authenticator (check "Supports resident keys" and "Supports user verification"). This simulates a passkey without any hardware. - Firefox: Set security.webauth.webauthn_enable_softtoken = true in about:config. - Password managers like Bitwarden or 1Password can also act as passkey providers. b) "Call authenticate_challenge for a patron without credentials": This means: send POST /api/v1/webauthn/authenticate/challenge with a patron_id for a patron who has zero rows in webauthn_credentials, and verify you get HTTP 404 with {"error": "No credentials registered"}. The test suite already covers this (subtest 2 in webauthn.t). Additional improvements in this rewrite beyond QA fixes: - Extracted business logic to Koha::Auth::WebAuthn (thin controller pattern) - Added typed exceptions (Koha::Exceptions::WebAuthn) - Challenge TTL (10 min), single-use consumption, fail-closed patron matching - account_locked check before issuing session - Explicit credential pubkey lookup check before assertion validation - eval/$@ replaced with try/catch throughout - PK renamed to webauthn_credential_id (SQL7), column COMMENTs added (SQL11) - Date columns follow SQL14: created_date (timestamp), last_used_date (datetime) - COLLATE=utf8mb4_unicode_ci, ON UPDATE CASCADE - Table added to kohastructure.sql - Authenticate endpoints made public (no x-koha-authorization — they're login endpoints) - aria-label on passkey button for accessibility - Licence headers on test files -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #21 from David Cook <dcook@prosentient.com.au> --- Hoping to look at this one more soon... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 Paul Derscheid <paul.derscheid@lmscloud.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #194697|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #22 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 199068 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199068&action=edit Bug 39601: Atomic update Patch from commit 11f6cea -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #24 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Created attachment 199070 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=199070&action=edit Bug 39601: [DO NOT PUSH] DBIC changes Patch from commit b624525 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #25 from David Nind <david@davidnind.com> --- I attempted to test, but couldn't get things to work. Main issues: 1. Clicking on "Passkey" on the log in page: "Passkeys are not supported by this browser." 2. Can only see More > Register passkey for the koha patron - get this message when clicking on "Register passkey": "Registration error: Passkeys are not supported by this browser." May be something to do with staffClientBaseURL. I also think that the test plan needs updating to reflect all the comments, and to make sure things work as expected. Testing notes (using standard KTD (not proxied), Ubuntu 22.04 desktop, various browsers[1]): 1. I did this: - Applied patches - Installed required CPAN module: sudo apt-get install libauthen-webauthn-perl - Updated the database: updatedatabase - Rebuilt everything (not sure if this is required): yarn build - DBIC - not sure if it is needed, but ran dbic anyway: dbic - Restart everything: restart_all 2. Clicking on "Passkey" on the log in page: "Passkeys are not supported by this browser." 3. Can only see More > Register passkey for the koha patron - get this message when clicking on "Register passkey": "Registration error: Passkeys are not supported by this browser." [1] Browsers I attempted to test on =================================== 1. Firefox 152.04 2. LibreWolf (based on Firefox) 3. Google Chrome (150.0.7871.46) 4. Chromium (149.0.7827.196) KTD setup for domain name/URL ============================= 1. staffClientBaseURL: http://kohadev-intra.koha-testing:8081 2. KTD .env set up: KOHA_DOMAIN=.koha-testing KOHA_INSTANCE=kohadev KOHA_INTRANET_PORT=8081 KOHA_INTRANET_PREFIX= KOHA_INTRANET_SUFFIX=-intra 3. Local hosts file - /etc/hosts ... 127.0.0.1 koha-testing 127.0.0.1 kohadev-intra.koha-testing -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #27 from Paul Derscheid <paul.derscheid@lmscloud.de> --- Hi David, thanks for taking a look. It's troubling that it seems it did not work at all :/ -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39601 --- Comment #29 from Jake Deery <jake.deery@openfifth.co.uk> --- Its a great piece of work, though! Passkeys in Koha will be exceptionally cool. I'll be watching closely. -- You are receiving this mail because: You are watching all bug changes.