Bug 21309

Summary: Enforce password change on login
Product: Koha Reporter: Christopher Brannon <cbrannon>
Component: PatronsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: black23, bugzilla, costalc, david, gmcharlt, koha, kyle.m.hall, teleboom, wizzyrea
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6848
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=6847
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33462
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Christopher Brannon 2018-09-01 19:42:03 UTC
We should add a flag to patron accounts that, if checked, would require the patron to sign in to their account and change their password.  This option could incorporate the following functionality:

* Allow patron to sign in with old password then prompt for a new password.
* E-mail patron notifying them with the need to change.
* When active, it would block checkouts and sip authentication until done.
* Anytime a password is changed in the account, whether staff side or opac, the change would clear the flag in the patron account.
* Date of change should be time stamped.

Christopher
Comment 1 Katrin Fischer 2018-10-28 18:30:35 UTC
I really like the idea of having a way to enforce password change.

It would also be nice if the flag could be preset for new patrons in general and/or from the patron import tool.
Comment 2 Claudio Costales 2019-04-04 18:51:12 UTC
Sure, it's a must have...
Comment 3 Owen Leonard 2019-04-16 13:48:03 UTC
(In reply to Christopher Brannon from comment #0)

> * E-mail patron notifying them with the need to change.

I think this feature is sorely needed, but I think many users would think this kind of email was a phishing attempt.
Comment 4 Liz Rea 2019-08-19 16:57:40 UTC
I would add that I want all new patrons to have this flag set by default if a login is created.
Comment 5 Christopher Brannon 2019-08-19 20:14:14 UTC
(In reply to Liz Rea from comment #4)
> I would add that I want all new patrons to have this flag set by default if
> a login is created.

+1
Comment 6 Christopher Brannon 2019-08-19 20:14:30 UTC
(In reply to Katrin Fischer from comment #1)
> I really like the idea of having a way to enforce password change.
> 
> It would also be nice if the flag could be preset for new patrons in general
> and/or from the patron import tool.

+1
Comment 7 Christopher Brannon 2019-08-19 20:15:16 UTC
We should add a flag to patron accounts that, if checked, would require the patron to sign in to their account and change their password.  This option could incorporate the following functionality:

* Allow patron to sign in with old password then prompt for a new password.
* E-mail patron notifying them with the need to change.
* When active, it would block checkouts and sip authentication until done.
* Anytime a password is changed in the account, whether staff side or opac, the change would clear the flag in the patron account.
* Date of change should be time stamped.
* All new patrons shgould have this flag set by default if a login is created.
Comment 8 Christopher Brannon 2019-08-19 20:15:54 UTC
We should add a flag to patron accounts that, if checked, would require the patron to sign in to their account and change their password.  This option could incorporate the following functionality:

* Allow patron to sign in with old password then prompt for a new password.
* E-mail patron notifying them with the need to change.
* When active, it would block checkouts and sip authentication until done.
* Anytime a password is changed in the account, whether staff side or opac, the change would clear the flag in the patron account.
* Date of change should be time stamped.
* All new patrons should have this flag set by default if a login is created.
Comment 9 Owen Leonard 2019-08-19 23:06:38 UTC
(In reply to Liz Rea from comment #4)
> I would add that I want all new patrons to have this flag set by default if
> a login is created.

+1
Comment 10 Katrin Fischer 2020-04-05 13:32:13 UTC
*** Bug 24795 has been marked as a duplicate of this bug. ***
Comment 11 Christopher Brannon 2023-04-08 19:13:57 UTC
Noting that Koha now has the capability to send a reset notice.  However, this is limiting to patrons that have email.  Even if the notice were to send via text, this still limits capability to certain patrons.

It would be preferable if the reset tied into the same mechanism that password expiration uses.  Right now, they work independently from one another and the reset is exclusive to patrons that receive email.