| Summary: | CAS/Shib Authentication can fail when multiple users with no userid/cardnumber defined and one of them is locked | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
| Component: | Authentication | Assignee: | Nick Clemens (kidclamp) <nick> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | dpavlin, fridolin.somers, martin.renvoize, matthias.meusburger, tomascohen, wizzyrea |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
19.11.00,19.05.05
|
|
| Circulation function: | |||
| Attachments: |
Bug 23771: Don't look for patrons if we don't have a userid
Bug 23771: Don't look for patrons if we don't have a userid Bug 23771: Don't look for patrons if we don't have a userid Bug 23771: Don't look for patrons if we don't have a userid |
||
|
Description
Nick Clemens (kidclamp)
2019-10-07 20:08:56 UTC
Created attachment 93847 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Created attachment 93860 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Created attachment 93951 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu> Created attachment 94018 [details] [review] Bug 23771: Don't look for patrons if we don't have a userid While the code requires external auth to test, the change is simple enough I think a good read would suffice To test: 1 - You either need Shib or CAS enabled and setup 2 - Add two users with blank.null cardnumbers 3 - Lock those user accounts Set failedloginattempts to 1 Try a bad login with the userid Or set via the DB 4 - Try a good login via the external auth 5 - Note it fails 6 - Apply patch 7 - Login now succeeds Signed-off-by: Mike Somers - Bridgewater State University <msomers@bridgew.edu> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Works well, Passing QA Nice work! Pushed to master for 19.11.00 Pushed to 19.05.x for 19.05.05 |