Bug 9936 - SIP2 should work with LDAP and CAS
Summary: SIP2 should work with LDAP and CAS
Status: CLOSED WONTFIX
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Bugs List
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-03-27 10:05 UTC by Katrin Fischer
Modified: 2023-06-08 22:26 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2013-03-27 10:05:54 UTC
SIP2 checks the password directly against the database instead of using C4/Auth.pm. This means that it won't work with LDAP and possibly CAS.

Also, we should do authentication the same everywhere in Koha to ensure consistency.
Comment 1 Colin Campbell 2015-01-06 16:31:21 UTC
For login authentication it calls C4/Auth check_api_auth
( so the fact it checks the password in the config file is a bit redundant)

For patron status it checks against the db if a password is sent or will accept ''.

For patron information the password is not a required field.

The sip logic is that the borrower barcode is the patron's token allowing them to request to borrow books.

A quick look at the checkpw routines in Auth suggests that they are doing more than testing the validity of the password as they are setting up parameters for a user session and I think we'd need a simpler 'is_this_password_valid' interface to Auth, but that could easily replace the call currently in ILS/Patron.pm
Comment 2 Colin Campbell 2015-08-05 13:42:48 UTC
Patch for 9611 switches to callingC4::Auth for password validation but still bypasses ldap & CAS
Comment 3 David Cook 2022-08-22 02:20:44 UTC
Is this still valid?

Looking at "C4/SIP/ILS/Patron.pm" and it looks like it uses "checkpw()" which looks like it will check LDAP. 

I'm not familiar with CAS but it looks like its more SSO rather than directory lookup like LDAP so don't know that it would ever work in this context.
Comment 4 Katrin Fischer 2022-08-22 06:27:55 UTC
(In reply to David Cook from comment #3)
> Is this still valid?
> 
> Looking at "C4/SIP/ILS/Patron.pm" and it looks like it uses "checkpw()"
> which looks like it will check LDAP. 
> 
> I'm not familiar with CAS but it looks like its more SSO rather than
> directory lookup like LDAP so don't know that it would ever work in this
> context.

CAS is for authentication, like LDAP or Shibboleth. Some libraries ask for the password at the self checks to avoid abuse of lost cards.
Comment 5 David Cook 2022-08-22 06:37:38 UTC
(In reply to Katrin Fischer from comment #4)
> (In reply to David Cook from comment #3)
> > Is this still valid?
> > 
> > Looking at "C4/SIP/ILS/Patron.pm" and it looks like it uses "checkpw()"
> > which looks like it will check LDAP. 
> > 
> > I'm not familiar with CAS but it looks like its more SSO rather than
> > directory lookup like LDAP so don't know that it would ever work in this
> > context.
> 
> CAS is for authentication, like LDAP or Shibboleth. Some libraries ask for
> the password at the self checks to avoid abuse of lost cards.

LDAP and Shibboleth/SAML are totally different though. I'm not familiar with CAS, but I imagine it probably works similar to SAML and OIDC in that it requires browser redirection, which needs to happen client-side.

LDAP, on the other hand, happens all server-side. So LDAP is easy to do on a SIP server, but you couldn't do SAML/OIDC (and maybe CAS) on the SIP server.

Alex and I have been talking about SAML for the self checkout at bug 30444. It gets complicated...
Comment 6 David Cook 2022-08-22 06:38:51 UTC
Looking at this spring implementation of CAS, it looks like it works similar to SAML and OIDC as I said in regard to the browser redirection: https://docs.spring.io/spring-security/site/docs/3.1.4.RELEASE/reference/cas.html
Comment 7 David Cook 2022-08-22 06:39:49 UTC
(In reply to David Cook from comment #6)
> Looking at this spring implementation of CAS, it looks like it works similar
> to SAML and OIDC as I said in regard to the browser redirection:
> https://docs.spring.io/spring-security/site/docs/3.1.4.RELEASE/reference/cas.
> html

So technically I think it's impossible for the SIP server to use CAS. But adding CAS auth to self-checkout interface could be interesting.
Comment 8 Katrin Fischer 2022-08-22 07:40:57 UTC
You have a good point, it does require redirection. So for libraries using CAS at the moment it won't be possible to require login at the self check, unless the self check provider implements this in their software.