Since we have the onboarding tool that create a superlibrarian patron as well as a misc script (misc/devel/create_superlibrarian.pl), we could reject login with the DB user.
Created attachment 73400 [details] [review] Bug 20489: Prevent DB user login
Something like that, would you agree guys?
Created attachment 73402 [details] [review] Bug 20489: Remove warnings from the interface
(In reply to Jonathan Druart from comment #2) > Something like that, would you agree guys? Sounds good. Second patch contains other stuff too.
(In reply to Marcel de Rooy from comment #4) > (In reply to Jonathan Druart from comment #2) > > Something like that, would you agree guys? > > Sounds good. Second patch contains other stuff too. Agreed!
Created attachment 73425 [details] [review] Bug 20489: Remove warnings from the interface
(In reply to Marcel de Rooy from comment #4) > Second patch contains other stuff too. Indeed, fixed! I was testing the installer part.
No test plan provided, use your knowledge and imagination to know if these patches are relevant and enough.
Tested: Staff OPAC Self-checkout And fresh install Only the fresh install allowed the system log in, as desired.
Attempted steps to go to urls which should trigger modified code in both logged in and logged out states. Failures and successes as expected.
Comment on attachment 73400 [details] [review] Bug 20489: Prevent DB user login Review of attachment 73400 [details] [review]: ----------------------------------------------------------------- ::: acqui/neworderempty.pl @@ +203,5 @@ > my $order_patron = Koha::Patrons->find( $order_user_id ); > push @order_users, $order_patron if $order_patron; > } > + if ( $data->{subscriptionid} ) { > + $template->param( subscriptionid => $data->{subscriptionid} ); This tweak is the one I don't understand.
Created attachment 73528 [details] [review] Bug 20489: Prevent DB user login
Created attachment 73529 [details] [review] Bug 20489: Remove warnings from the interface
(In reply to M. Tompsett from comment #11) > This tweak is the one I don't understand. It was not related to this patch.
Created attachment 73543 [details] [review] Bug 20489: Prevent DB user login Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Created attachment 73544 [details] [review] Bug 20489: Remove warnings from the interface Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
See comment #9 and comment #10 for how I tested.
QA: Looking here
Is the term Basic installation complete? from onboarding still valid? Since you cannot login anymore, you will have to go further..
die "A patron with cardnumber '42' already exists" ??? From the new script misc/devel/create_superlibrarian.pl
Just another note on that script: We should really remove the default koha/koha. Force people to enter something.
Created attachment 74150 [details] [review] Bug 20489: Prevent DB user login Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 74151 [details] [review] Bug 20489: Remove warnings from the interface Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
In the release notes it would be good to refer to the Forgot password feature (hopefully enabled) or the script create_superlibrarian
(In reply to Marcel de Rooy from comment #21) > Just another note on that script: We should really remove the default > koha/koha. Force people to enter something. I think that a blocker for this one.
Pushed to master for 18.05, thanks to everybody involved!
I am not sure yet if this is the cause, but I cannot log in the OPAC with my staff user right now, which is not even superlibrarian?
Ok, reset_all fixed it, still baffled.
For other confused comments see bug 20632.
I am not sure about this one. Won't it remove the possibility to fix a forgotten superlibrarian password? I know there is the script, but it's often hard to get IT run something for you, especially in smaller libraries. Have updates been tested? I don't see that in comment#9. What happens with libraries that didn't add a superlibrarian user in the past (pre-onboarding)? >In the release notes it would be good to refer to the Forgot password feature >(hopefully enabled) or the script create_superlibrarian The reset password feature won't ever be used by all libraries. For example libraries using LDAP, Shibboleth or CAS won't ever use it. Also, why is there no proper test plan or nice description on the commit messages? (looking at you, Jonathan, this time! ;) )
(In reply to Katrin Fischer from comment #30) > I am not sure about this one. > > Won't it remove the possibility to fix a forgotten superlibrarian password? > I know there is the script, but it's often hard to get IT run something for > you, especially in smaller libraries. What is sure is that it put too much work on dev side, see related bug reports. We discussed that several times and I understood there was a general agreement on removing this "feature". It's a long standing problem and we will need to re-educate the users/sysadmin to use other tools, like the script to create real user accounts. I think we will certainly have to provide more tools to replace this workaround. > Have updates been tested? I don't see that in comment#9. Marcel and I did. > What happens with libraries that didn't add a superlibrarian user in the > past (pre-onboarding)? They will have to create a superlibrarian user. > >In the release notes it would be good to refer to the Forgot password feature >(hopefully enabled) or the script create_superlibrarian > > The reset password feature won't ever be used by all libraries. For example > libraries using LDAP, Shibboleth or CAS won't ever use it. I do not understand what it means. > Also, why is there no proper test plan or nice description on the commit > messages? (looking at you, Jonathan, this time! ;) ) I told it on comment 8, the idea was to let testers think about what I forgot.
If you use LDAP, you don't store patron's passwords, so you won't turn on the password reset feature. And you will turn off the password change option in the OPAC, because it will give people wrong ideas :) Could the superlibrarian script be extended a bit (separate bug) to allow for changing passwords from command line?
*** Bug 11590 has been marked as a duplicate of this bug. ***