Summary: | Add plugin hooks for capturing raw passwords (NNPDB) | ||
---|---|---|---|
Product: | Koha | Reporter: | Magnus Enger <magnus> |
Component: | Plugin architecture | Assignee: | Magnus Enger <magnus> |
Status: | Failed QA --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook, lucas, mathsabypro |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22706 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=27311 |
||
Change sponsored?: | --- | Patch complexity: | Small patch |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Attachments: | Bug 27309 - Add plugin hooks for capturing passwords |
Description
Magnus Enger
2020-12-28 13:21:42 UTC
Created attachment 114719 [details] [review] Bug 27309 - Add plugin hooks for capturing passwords This might sound like a stupid idea, but it is necessary in order to implement support for the Norwegian National Patron Database as a plugin in Koha. The plugin hook captures the borrowernumber and raw password of a user and sends it to a plugin. I created a tiny plugin to be able to test the functionality: https://github.com/Libriotech/koha-plugin-capturepw This plugin will capture borrowernumbers and raw passwords when a user is added or updated. The borrowernumber and a md5-hashed version of the password is stored in a tiny database table (koha_plugin_no_libriotech_capturepw_capturepw) created by the plugin. To test: - Enable plugins - Install the CapturePW plugin - Add and edit users in all possible ways, including -- Setting a password for a new user -- Changing a password in the staff client -- Changing a password in the OPAC -- Creating a disabled user account Check the database table for updates after each operation. If a new line is added to the database for each operation, and the md5 hash changes when a password is changed, everything should be ok. Added capture_raw_password to https://wiki.koha-community.org/wiki/Koha_Plugin_Hooks#Implemented_or_under_development_hooks Could you elaborate more on your use case for this? I don't understand why you'd need to capture and store the password. (In reply to David Cook from comment #3) > Could you elaborate more on your use case for this? I don't understand why > you'd need to capture and store the password. In Norway we have a national patron database, that among other things holds patron's PIN codes. These are encrypted using a key that only vendors have access to. To be able to store and transmit the encypted PIN in the correct format, we need to be able to capture it, and encrypt it in the way the national patron database expects, so we can sync it to other ILSes. This was not my idea, and it might change in the future, but for now it is something we have to implement, in order to be able to answer RFPs etc. (In reply to Magnus Enger from comment #4) > (In reply to David Cook from comment #3) > > Could you elaborate more on your use case for this? I don't understand why > > you'd need to capture and store the password. > > In Norway we have a national patron database, that among other things holds > patron's PIN codes. These are encrypted using a key that only vendors have > access to. To be able to store and transmit the encypted PIN in the correct > format, we need to be able to capture it, and encrypt it in the way the > national patron database expects, so we can sync it to other ILSes. > > This was not my idea, and it might change in the future, but for now it is > something we have to implement, in order to be able to answer RFPs etc. Thanks for explaining. I think that I understand more now. I just took a peek at bug 11401 and https://lanekortet.no/ (thanks Google Translate). I wonder why they don't use something like LDAP or use SSO. Inertia maybe. I still think how the NNPDB works is bizarre but I understand the rationale. Do we need unit tests for this change? Also, the commit title needs amended: Processing additional checks * Commit title does not start with 'Bug XXXXX: ' - 82ca5ad8aef |