Bug 32404 - Two-factor authentication for staff client doesn't work for all staff accounts
Summary: Two-factor authentication for staff client doesn't work for all staff accounts
Status: RESOLVED DUPLICATE of bug 30588
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 28786
Blocks:
  Show dependency treegraph
 
Reported: 2022-12-05 14:56 UTC by Kelly McElligott
Modified: 2023-03-09 19:40 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kelly McElligott 2022-12-05 14:56:14 UTC
With the new feature, Two-factor authentication for staff client - TOTP, staff permissions seem to be needed to activate this:

my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
    {
        template_name => 'members/two_factor_auth.tt',
        query         => $cgi,
        type          => 'intranet',
        flagsrequired => { editcatalogue => '*' },
    }
);

which means that only staff with top-level catalogue permissions can activate their two-factor authentication.

However, I believe this should be allowed by all staff accounts which would change this feature to allow staff to have just the "Staff access, allows viewing of catalogue in staff interface (catalogue) " permission.
Comment 1 Jonathan Druart 2022-12-05 16:06:56 UTC
Correct, it should be
  { catalogue => 1 }
Comment 2 Nick Clemens 2022-12-07 17:00:46 UTC
This is correct in master - we may have been testing an earlier version

*** This bug has been marked as a duplicate of bug 30588 ***
Comment 3 Laura O'Neil 2023-03-09 19:40:02 UTC
Workaround: superlibrarians can give cataloging permissions to staff in order for staff to activate 2FA. Cataloging permissions can then be removed after the staff person has completed 2FA setup.