From 9fa84ac2220438e6b1be0e275a70ad315f68d318 Mon Sep 17 00:00:00 2001 From: Benjamin Rokseth Date: Fri, 26 Aug 2016 10:19:36 +0000 Subject: [PATCH] Bug 16694 - Limit SIP2 auth by patron attribute The main use case of this bug is to use patron attributes to grant special privileges, e.g. to open a door to an unmanned library. This patch adds an extra check against patron attributes if login account in SIPconfig.xml has a key validate_patron_attribute set to some patron attribute. If a patron information request is sent (63), and patron has proper rights in the given attribute: (a value of 1/true or some authorised value mapping to 1) The user will be allowed access (in SIP: charge and/or renewal ok). Otherwise denied. Please note that this is specific to the SIP login account, so self checkout machines can be handled differently than e.g. a door card terminal. To test: 0) you need to debug using telnet or the koha provided sip_client 1) add validate_patron_attribute="testattribute" to some login account in SIPconfig.xml 2) add a patron attribute "testattribute" 3) edit some patron and set "testattribute" to "1" 4) do a sip login with the given login account from SIPconfig.xml 5) do a patron information request (63) on the patron 6) observe that no charge or renewal denied is given in the response (64 ) 7) try all or any of the following: - set patron attribute to anything but "1" - delete the patron attribute - map the patron attribute to an authorized list, e.g. (YES_NO) and set it to a value that doesn't map to "1", e.g. "No". 8) do a patron information request (63) again 9) observe that charge and renewal is now denied in the SIP response (64YY) 10) thank yourself if noone else does and grab a coffee Signed-off-by: Magnus Enger Took me a while to remember I was on a gitified setup and needed to do sudo cp C4/SIP/Sip/MsgType.pm /usr/share/koha/lib/C4/SIP/Sip/MsgType.pm before I could test properly. Works as expected. I have a Swedish customer running a similar hack in production, so looking forward to getting this into Koha proper. --- C4/SIP/Sip/MsgType.pm | 15 ++++++++++++++- etc/SIPconfig.xml | 1 + 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/C4/SIP/Sip/MsgType.pm b/C4/SIP/Sip/MsgType.pm index dded51e..8ca72be 100644 --- a/C4/SIP/Sip/MsgType.pm +++ b/C4/SIP/Sip/MsgType.pm @@ -932,6 +932,20 @@ sub handle_patron_info { $resp = (PATRON_INFO_RESP); if ($patron) { + # Bug 16694 - Limit SIP2 auth by patron attribute + # If login account has validate_patron_attribute set, it will check if patron has this attribute set + # If set to 1 or authorized value mapped to 1, allow access (charge and renewal privileges ok) + if ($server->{account}->{validate_patron_attribute}) { + my $attr = C4::Members::Attributes::GetBorrowerAttributeValue($patron->{borrowernumber}, $server->{account}->{validate_patron_attribute}); + if ($attr && $attr == "1") { + $patron->{charge_ok} = "1"; + $patron->{renew_ok} = "1"; + } else { + $patron->{charge_ok} = 0; + $patron->{renew_ok} = 0; + } + } + $resp .= patron_status_string($patron); $resp .= ( defined($lang) and length($lang) == 3 ) ? $lang : $patron->language; $resp .= timestamp(); @@ -1606,4 +1620,3 @@ sub api_auth { 1; __END__ - diff --git a/etc/SIPconfig.xml b/etc/SIPconfig.xml index f51f093..7a36cf4 100644 --- a/etc/SIPconfig.xml +++ b/etc/SIPconfig.xml @@ -46,6 +46,7 @@ +