Bug 22925 - AuthenticatePatron should fail if patron has lost card
Summary: AuthenticatePatron should fail if patron has lost card
Status: In Discussion
Alias: None
Product: Koha
Classification: Unclassified
Component: Web services (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Arthur Suzuki
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-05-16 12:40 UTC by Arthur Suzuki
Modified: 2019-05-27 12:24 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 22925 : Disable ILS-DI AuthenticatePatron if patron has lost card. (1.32 KB, patch)
2019-05-16 12:47 UTC, Arthur Suzuki
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Arthur Suzuki 2019-05-16 12:40:11 UTC
If Patron is declared as lost card it might be better not to allow an authentication, so that no renewal of holds can be made.
Comment 1 Arthur Suzuki 2019-05-16 12:47:32 UTC
Created attachment 89830 [details] [review]
Bug 22925 : Disable ILS-DI AuthenticatePatron if patron has lost card.

test plan:
1 / set a patron as card lost in the intranet
2 / query ILS-DI with login and password -> should respond with
borrowernumber
3 / apply patch
4 / Repeat 2, should respond code "PatronLostCard"
Comment 2 Liz Rea 2019-05-24 17:34:20 UTC
Hi Arthur,

Can you explain a bit more about the use case here? Since this is ILS-DI only, and not across all of the Koha OPAC, I assume your use case has to do with connectivity to a service like Overdrive or Bolinda (or your local eBook vendor). Is that right? 

The reason I ask is because not every library uses the cardnumber as the login username. A person who loses their card may still have a legitimate reason to log into Koha (or an attached 3rd party service) - why should they be additionally punished for losing their card by not being able to access library resources? People lose things all the time and it's really annoying to replace all those lost things. Let's not make it harder for people.

The information on the majority of library cards is basically considered public - things like your name, and your card number. They aren't secret. The password though, is. And since (I sure hope...) normally the password isn't on the library card, even if someone bad has the card, they still don't have the password and so can't get in anyway. 

Taking it a step further, even if the bad person went to the OPAC to change the password (presuming the library has that enabled), they would still need the username (that could be the card number, yes, but it often isn't) and/or the e-mail address associated with the account, and access to that email account, to change the password.  Yes, they could then get in to the 3rd party service, but they have worked really hard to get there and compromised much more than just Koha, and likely broken a few laws in the mean time.

If we are going to implement this feature, I feel like it must be optional, and definitely should be off by default. 

Please, if anybody thinks any of this is wrong, I'm happy to consider that point of view - I am sure I haven't thought through to every possibility and there could be a very good use case for this feature.

Cheers,
Liz
Comment 3 Arthur Suzuki 2019-05-27 12:24:29 UTC
Hi Liz,
I get your point :)

Maybe yet another syspref similar to what "BlockExpiredPatronOpacActions" does but for "lost card" flag instead of "expired" flag?

But then that would touch also the Web interface and not only the WebService.
Probably need to create a new bug and close that one in that case.

What would you think about this?
Arthur

PS : I've also translated and forwarded your arguments to our partner see if they can find a workaround...