Summary: | authentication and authorization refactoring | ||
---|---|---|---|
Product: | Koha | Reporter: | Francesco Rivetti <oha> |
Component: | Authentication | Assignee: | Francesco Rivetti <oha> |
Status: | In Discussion --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook, dpavlin, jonathan.druart, m.de.rooy, martin.renvoize, oha, olli-antti.kivilahti, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
URL: | https://github.com/digibib/Koha/commits/auth_session_refactor | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7174 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36098 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: |
Description
Francesco Rivetti
2017-03-22 14:31:30 UTC
regarding the web installer, C4::Auth has few places where it returns "maintenance" which i believe happens during the web installer or immediately after. I clean up that part and I must reintroduce it back. so far, things that does NOT work: - redirects are probably broken - Koha::Auth::Simple tries to authenticate you when you send userid/passwd even when those are sent to create a new user - logout.x fights with login - permissions are there (and with the fixed JOIN) but only used for templates, not for authorization - CGI is mocked, and Session is new. So I expect few modules to land to not implemented methods there. should be easy to add those added few more fixes: - honor cgi->redirect() - trap exit() and instead returns what has been sent so far - added session->remote_addr() - added branchname in session and LoginBranchName in templates this is something i forgot to mention before: I replaced WrapCGI and CGIBin with Koha::Middleware::App It pretty much do the same thing as WrapCGI (fork and require the cgi script) but instead of having the script building the response, it uses a pipe and serialize the data back to the parent. It's the first step to move the logic from the scripts to proper functions. It handles script exit() properly, and should work properly with other forks, which make it relevant to Bug 15032 Hi! Check out https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/Koha/Auth/PermissionManager.pm https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/Koha/Auth.pm https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/Koha/Auth/Route/Password.pm https://github.com/KohaSuomi/kohasuomi/blob/kohasuomi3.16/C4/Auth.pm#L1713 I rewrote the permission system and authentication system some time ago. Nobody is interested about it, even thought the horrible way of managing permissions is a blocker for writing smooth user interface tests (or REST API tests). Not a lot of people care about user interface tests either. We have been indecisive should we drop my authentication rewrite and revert to the community system, but it is so stale and in a need of a rewrite that we couldn't get back into it. I hope you can work on top of my solution and improve it, instead of reinventing the wheel. It would be great to get best of both worlds. My solution has a compatibility layer between CGI and Mojolicious, normalizing the way HTTP request headers/cookies/parameters are fetched. It would be bestest to get rid of CGI completely and just rewrite everything as a Mojolicious application. Also ashimema and tcohen are working with OAuth2.0 and replacing CGISESSID with JWT. Not sure how they can do it with the current C4::Auth. Maybe they will provide a third and a fourth rewrite :) (I hope not) BTW: Where is your code? I see no attachments? My work in Bugzilla: Bug 7174 - Authentication rewriting (In reply to Olli-Antti Kivilahti from comment #5) > BTW: Where is your code? I see no attachments? But I found the URL to github. Hi Olli-Antti Kivilahti, I didn't know you were working on it, will have a look immediately. You are right: I haven't submitted any patch here. But you can see what i did so far here: https://github.com/digibib/Koha/commits/auth_session_refactor there are lots of changes on my side, but I might be able to combine what you did so far and integrate it. I just wish there were more hours in a day! I am relieved to hear that. This auth work just nudged forward in our dev pipeline and Lari is working with it atm. I hope you can work together to bring together the best of both worlds. I have a feeling that a lot of people are thinking about this and maybe working on it separately. It's too bad that we don't have more coordination across distant developers... |