Bug 20627

Summary: Prevent leakages of user permissions to api access tokens
Product: Koha Reporter: Martin Renvoize <martin.renvoize>
Component: AuthenticationAssignee: Martin Renvoize <martin.renvoize>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: julian.maurice, m.de.rooy, tomascohen
Version: master   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25795
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 20568, 20612    
Bug Blocks:    

Description Martin Renvoize 2018-04-20 12:48:23 UTC
Bug #20568 allow users to create API access tokens, but it always associates all a users permissions with that access token and additionally if that user comes to have more permissions down the line those additional permissions are automagically added to the access token as well. This is generally bad practice for access tokens as in general, they should be of a definite scope and any time additional privileges are required the client application should have to ask for them and receive a new token with the additional privileges assigned to it.
Comment 1 Marcel de Rooy 2020-01-31 09:55:19 UTC
Any developments on this front since almost two years passed? :)
Comment 2 Martin Renvoize 2020-02-01 08:21:18 UTC
I still hope to get to it at some point.. likely when rebasing Kyle's work on permissions which is on my list for later this month.

I envisage an OAuth2 style scopes system from the API perspective.. but th foundations for that are not yet available in Koha permissions code.