Bug 25794

Summary: Add PKI/x509/client SSL authentication to REST API
Product: Koha Reporter: David Cook <dcook>
Component: REST APIAssignee: Bugs List <koha-bugs>
Status: RESOLVED WISHLIST QA Contact:
Severity: enhancement    
Priority: P5 - low    
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description David Cook 2020-06-18 03:10:49 UTC
It could be useful to add PKI/x509/client SSL authentication to the REST API to ease machine-to-machine interactions.

A vendor could set up all their Koha instances to trust certificates signed by the a vendor's certificate authority public key. Then all new API consumers could just get certificates issued by the vendor's CA.

That said, I suppose authorization would still be a problem. With Bug 6296, they were still mapping the certificate to a Koha user.

And then there's the issue of how to handle revoked certificates. 

Maybe it is best just to rely on OAuth2 and Basic Auth.
Comment 1 David Cook 2020-06-18 03:19:05 UTC
"OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens" at https://tools.ietf.org/html/rfc8705 could be interesting... although it still has the per-implementation issue of certificate revocation management...
Comment 2 David Cook 2020-06-25 02:51:38 UTC
I was looking at FreeIPA (https://en.wikipedia.org/wiki/FreeIPA) and it got me on to DogTag (https://www.dogtagpki.org/wiki/PKI_Main_Page), which is an open source certificate authority that also supports OCSP for checking Certificate Revocation Lists.