Bug 21577 - Enable Koha to act as Shibboleth identity provider
Summary: Enable Koha to act as Shibboleth identity provider
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low new feature (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-16 09:49 UTC by Josef Moravec
Modified: 2023-10-19 12:01 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Josef Moravec 2018-10-16 09:49:25 UTC
For us it is important now, as we are going to append our Koha to national project which aims to enable users to use "all" libraries from one place.

Maybe this could be implemented using Net::SAML2::IdP
Comment 1 Michal Denar 2018-10-16 09:54:54 UTC
MAybe we can use https://metacpan.org/pod/Net::SAML2
Comment 2 Josef Moravec 2018-12-21 13:41:40 UTC
I implemented a module for simplesamlphp that is using ils-di, it is here if anybody interested:

https://gitlab.com/josef.moravec/simplesamlphp-koha-ils-di-authentication-module
Comment 3 David Cook 2019-01-02 07:30:07 UTC
Recently, I've been thinking about using Keycloak (https://www.keycloak.org/) as a SAML/OpenID Connect identity provider for Koha, but I suppose Koha is the thing that is acquiring the user information, so maybe it could make sense having it as the identity provider...

...but I'm curious about your use case. I don't think I understand.
Comment 4 Mathieu Pelletier 2019-04-09 09:24:15 UTC
Koha was never really written to function as a shibboleth IDP, so this seems to fall outside the purpose of the project.  That said, you could use SimpleSAML with the SQL Auth plugin to query Koha's borrowers table, effectively making Koha your source for user data.  We have done something similar, but with Moodle as the Idp.

For more information, consider looking here: https://simplesamlphp.org/docs/stable/sqlauth:sql
Comment 5 Josef Moravec 2019-04-09 09:56:59 UTC
(In reply to Mathieu Pelletier from comment #4)
> Koha was never really written to function as a shibboleth IDP, so this seems
> to fall outside the purpose of the project.  That said, you could use
> SimpleSAML with the SQL Auth plugin to query Koha's borrowers table,
> effectively making Koha your source for user data.  We have done something
> similar, but with Moodle as the Idp.
> 
> For more information, consider looking here:
> https://simplesamlphp.org/docs/stable/sqlauth:sql

Hi Mathieu, thanks for your comment,

we are going to use SimpleSAML for IdP, we just wrote plugin for ILS-DI authentication - it is not ideal, but it works...


https://gitlab.com/josef.moravec/simplesamlphp-koha-ils-di-authentication-module
Comment 6 David Cook 2020-04-01 22:46:41 UTC
(In reply to Josef Moravec from comment #0)
> For us it is important now, as we are going to append our Koha to national
> project which aims to enable users to use "all" libraries from one place.
> 

Could you elaborate on this one? I'm still trying to understand the purpose of this bug report.

If you wanted to enable users to use all libraries, wouldn't you want a centralized Identity Provider (like Keycloak) and then connect all the different libraries to it? 

Or is the idea that the national library would run Koha, control the patron database, and all other libraries in the country would authenticate off that national library Koha?

I'm intrigued in any case!
Comment 7 David Cook 2023-10-18 23:14:35 UTC
Btw we've added a REST API endpoint for validating username/password at bug 30962
Comment 8 David Cook 2023-10-18 23:18:34 UTC
I also wrote a Keycloak extension that uses the REST API endpoint from bug 30962 which allows you to use Keycloak as the Identity Provider with the Koha user database as the underlying user datastore. 

I haven't made this extension public yet, as I'm not that keen on supporting it solo. But I suppose I should just do it one of these days...
Comment 9 David Cook 2023-10-19 01:07:24 UTC
(In reply to David Cook from comment #8)
> I also wrote a Keycloak extension that uses the REST API endpoint from bug
> 30962 which allows you to use Keycloak as the Identity Provider with the
> Koha user database as the underlying user datastore. 
> 
> I haven't made this extension public yet, as I'm not that keen on supporting
> it solo. But I suppose I should just do it one of these days...

I've uploaded the Keycloak extension at https://gitlab.com/minusdavid/keycloak-user-storage-koha

Hopefully there is enough information there for people to build, deploy, and use it. If not, raise an issue there or email me or something.

But that extension allows you to use Keycloak as a SAML/Shibboleth Identity Provider using Koha's user database for authentication.

So you can setup Koha to authenticate against Keycloak, and you'll be logging into Keycloak's interface using your Koha username and password. You can then have other systems authenticating against Keycloak using a Koha username and password.

This is a way of achieving the goal of bug 21577 without re-inventing the wheel. Keycloak is a great open source identity management system backed by Red Hat, and it's great that we can use it to build up Koha functionality. 

--

That being said... I should add a warning that this Keycloak extension relies on a deprecated SPI. At some stage, it will go away, although it will be replaced with a new system. At that point, I'll do a new Keycloak extension that uses that. But good to know what's coming down the pipes...