Attachment 83991 Details for Bug 22132 – Bug 22132: Add Basic authentication to the API

[patch] Bug 22132: Add Basic authentication to the API

Bug-22132-Add-Basic-authentication-to-the-API.patch (text/plain), 2.93 KB, created by Tomás Cohen Arazi (tcohen) on 2019-01-15 16:28:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomás Cohen Arazi (tcohen)

Created: 2019-01-15 16:28:05 UTC

Size: 2.93 KB

patch

obsolete

>From 4e009a053f053174166d54d4cd5c8c4f7094ad98 Mon Sep 17 00:00:00 2001
>From: Tomas Cohen Arazi <tomascohen@theke.io>
>Date: Tue, 15 Jan 2019 13:23:23 -0300
>Subject: [PATCH] Bug 22132: Add Basic authentication to the API
>
>This patch implements Basic authentication for the API to aid testers
>and developers with tools like Postman.
>
>To test:
>- Apply this patches
>- Run:
>  $ kshell
> k$ prove t/db_dependent/api/v1/auth_basic.t
>=> SUCCESS: Tests pass!
>- Open Postman or your favourite tool
>- In Authorization, choose Basic auth.
>- Enter the username and password of a known privileged user.
>- Hit an endpoint with Postman, for example:
>  ] GET http://kohadev-intra.myDNSname.org:8081/api/v1/patrons
>=> SUCCESS: Basic authentication is great!
>- Sign off :-D
>---
> Koha/REST/V1/Auth.pm | 39 ++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 38 insertions(+), 1 deletion(-)
>
>diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
>index cf64a25828..66db3bc5cc 100644
>--- a/Koha/REST/V1/Auth.pm
>+++ b/Koha/REST/V1/Auth.pm
>@@ -21,7 +21,7 @@ use Modern::Perl;
> 
> use Mojo::Base 'Mojolicious::Controller';
> 
>-use C4::Auth qw( check_cookie_auth get_session haspermission );
>+use C4::Auth qw( check_cookie_auth checkpw_internal get_session haspermission );
> use C4::Context;
> 
> use Koha::ApiKeys;
>@@ -37,6 +37,7 @@ use Koha::Exceptions;
> use Koha::Exceptions::Authentication;
> use Koha::Exceptions::Authorization;
> 
>+use MIME::Base64;
> use Module::Load::Conditional;
> use Scalar::Util qw( blessed );
> use Try::Tiny;
>@@ -151,6 +152,16 @@ sub authenticate_api_request {
>             );
>         }
>     }
>+    elsif ($authorization_header and $authorization_header =~ /^Basic / ) {
>+        $user = $c->_basic_auth( $authorization_header );
>+        unless ( $user ) {
>+            # If we have "Authorization: Basic" header and authentication
>+            # failed, do not try other authentication means
>+            Koha::Exceptions::Authentication::Required->throw(
>+                error => 'Authentication failure.'
>+            );
>+        }
>+    }
>     else {
> 
>         my $cookie = $c->cookie('CGISESSID');
>@@ -390,4 +401,30 @@ sub _object_ownership_by_reserve_id {
>     return $reserve && $user->borrowernumber == $reserve->borrowernumber;
> }
> 
>+=head3 _basic_auth
>+
>+Internal method that performs Basic authentication.
>+
>+=cut
>+
>+sub _basic_auth {
>+    my ( $c, $authorization_header ) = @_;
>+
>+    my ( $type, $credentials ) = split / /, $authorization_header;
>+
>+    unless ($credentials) {
>+        Koha::Exceptions::Authentication::Required->throw( error => 'Authentication failure.' );
>+    }
>+
>+    my $decoded_credentials = decode_base64( $credentials );
>+    my ( $user_id, $password ) = split( /:/, $decoded_credentials, 2 );
>+
>+    my $dbh = C4::Context->dbh;
>+    unless ( checkpw_internal($dbh, $user_id, $password ) ) {
>+        Koha::Exceptions::Authorization::Unauthorized->throw("Invalid password");
>+    }
>+
>+    return Koha::Patrons->find({ userid => $user_id });
>+}
>+
> 1;
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 22132: 83989 | 83990 | 83991 | 83993 | 83994 | 83995 | 84353 | 84354 | 84355 | 84361 | 84362 | 84363 | 84364 | 84365 | 84368 | 84369 | 84371 | 84535 | 84536 | 84537 | 84538 | 84539 | 85024