Bug 26792 - Create simple is_authenticated and is_authorized methods for AuthN/AuthZ
Summary: Create simple is_authenticated and is_authorized methods for AuthN/AuthZ
Status: RESOLVED DUPLICATE of bug 26791
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-10-23 00:38 UTC by David Cook
Modified: 2020-12-22 06:20 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2020-10-23 00:38:38 UTC
There should be simple methods for checking if a web user is authenticated and authorized.

Basically, you check a cookie value for a session ID, check if that session ID maps to an authentic user account, and then check if that user account has authorizations.
Comment 1 David Cook 2020-10-23 00:40:00 UTC
Of course, is_authenticated should probably also trigger session timeouts.
Comment 2 David Cook 2020-10-28 13:10:21 UTC
I'm making some good progress here.

I've created some methods like Koha::Auth->is_authenticated and Koha::Auth->is_authorized, and then implemented those in a Mojolicious application mounted in plack.psgi at 'intranet/staff'.

(The Koha::Auth->is_authenticated is used to cover all routes in the Mojo startup() function, while Koha::Auth->is_authorized is implemented in a "helper", which allows it to be easily and cleanly used in Mojo controller actions.)

I need to refactor C4::Auth to create a "is_timed_out" function and add that to Koha::Auth->is_authenticated, but otherwise these should be nearly ready.

I should probably rename "is_authorized" to "authorize" as it actually authorizes the user.

The "is_authenticated" is just a check though. If it fails, the plan is to redirect the user to a login page or internally use a Mojo login controller. I need to put some more thought into that.
Comment 3 David Cook 2020-11-11 22:34:02 UTC
Actually, I might just merge this into Bug 26791 to help testers...
Comment 4 David Cook 2020-12-22 06:20:27 UTC

*** This bug has been marked as a duplicate of bug 26791 ***