Bug 31247

Summary:	Staff interface 2FA blocks logging into the OPAC
Product:	Koha	Reporter:	Caroline Cyr La Rose <caroline.cyr-la-rose>
Component:	Authentication	Assignee:	Jonathan Druart <jonathan.druart>
Status:	CLOSED FIXED	QA Contact:	Victor Grousset/tuxayo <victor>
Severity:	critical
Priority:	P5 - low	CC:	arthur.suzuki, dpavlin, jonathan.druart, lucas, m.de.rooy, victor
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	22.11.00, 22.05.06
Circulation function:
Bug Depends on:	28786
Bug Blocks:	20476
Attachments:	Bug 31247: Fix OPAC authentication when 2FA is enabled Bug 31247: Add tests Bug 31247: Fix OPAC authentication when 2FA is enabled Bug 31247: Add tests Bug 31247: Add tests Bug 31247: Fix OPAC authentication when 2FA is enabled

Description Caroline Cyr La Rose 2022-07-27 14:30:52 UTC

I noticed when I turned on the 2FA for my staff account, I'm no longer able to log into the OPAC with that same account. I usually use the same account for both, so I find this a major drawback in using 2FA.

To test:
1) With 2FA turned off, log into the staff interface with your staff account
--> login is normal
2) With 2FA turned off, log into the OPAC with the same account
--> login is normal
3) Turn on 2FA
3.1) In System preferences, enable TwoFactorAuthentication
3.2) Go to 'My account' (click your username in the top right and choose 'My account)
3.3) Click More > Manage two-factor authentication
3.4) Click Enable two-factor authentication
3.5) With an authenticator app (I used FreeOTP) scan the QR code
3.6) Enter the PIN provided by the app in the PIN code field
3.7) Click Register with two-factor app
4) Log out of the staff interface
5) Log into the staff interface
--> Username, password and two-factor code is needed
6) Log out of the OPAC
7) Log into the OPAC (I used the login box on the right)
--> It cycles back to the login page, you can never log in
8) In the staff interface, disable 2FA
8.1) In 'My account', click More > Manage two-factor authentication
8.2) Click Disable two-factor authentication
9) Log into the OPAC
--> login is normal

Comment 1 Jonathan Druart 2022-07-27 15:49:05 UTC

Created attachment 138181 [details] [review]
Bug 31247: Fix OPAC authentication when 2FA is enabled

Silly mistake from bug 28786, the $type should be compared to "opac"
instead of "OPAC", erk!

Test plan:
Turn 2FA on
Set it up for an user
Login at the OPAC
=> Without this patch you keep being redirected to the auth form screen
=> With this patch applied you are able to successfully login

Comment 2 Jonathan Druart 2022-07-27 15:52:56 UTC

Created attachment 138182 [details] [review]
Bug 31247: Add tests

Comment 3 Caroline Cyr La Rose 2022-07-27 16:04:01 UTC

Created attachment 138183 [details] [review]
Bug 31247: Fix OPAC authentication when 2FA is enabled

Silly mistake from bug 28786, the $type should be compared to "opac"
instead of "OPAC", erk!

Test plan:
Turn 2FA on
Set it up for an user
Login at the OPAC
=> Without this patch you keep being redirected to the auth form screen
=> With this patch applied you are able to successfully login

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Comment 4 Caroline Cyr La Rose 2022-07-27 16:04:05 UTC

Created attachment 138184 [details] [review]
Bug 31247: Add tests

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>

Comment 5 Victor Grousset/tuxayo 2022-07-28 04:45:01 UTC

Found issue

1. don't apply patch
2. setup 2FA
3. logout staff
4. login and use 2FA
5. go to OPAC
6. logout OPAC (in my setup, on localhost but on a different port, OPAC and staff share session)
7. try to log in the OPAC
8. it fails
9. apply patch and restart services
10. try to log in the OPAC
11. it still fails (nothing in the logs), this is not expected
12. go to staff
13. you are prompted for 2FA
14. cancel (I guess putting the code would also unblock the situation)
15. go to opac and retry logging
16. it works!

Comment 6 Victor Grousset/tuxayo 2022-07-28 05:03:51 UTC

BTW, step 8 on my test plan, going to the staff interface and hitting cancel to the 2FA doesn't make the OPAC logging work. So the patch is indeed needed.

Also, on step 8 if one does the 2FA and retries the OPAC it works. So it seems to show that it's linked to this ticket and that it's incomplete.

Comment 7 Jonathan Druart 2022-07-28 06:52:17 UTC

You let the session in an unexpected state and change the code? Yes of course it is failing.
If you want your steps to work you must truncate the sessions table after you applied the patches.

Comment 8 Victor Grousset/tuxayo 2022-07-28 17:52:58 UTC

Created attachment 138219 [details] [review]
Bug 31247: Add tests

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Comment 9 Victor Grousset/tuxayo 2022-07-28 17:53:07 UTC

Created attachment 138220 [details] [review]
Bug 31247: Fix OPAC authentication when 2FA is enabled

Silly mistake from bug 28786, the $type should be compared to "opac"
instead of "OPAC", erk!

Test plan:
Turn 2FA on
Set it up for an user
Login at the OPAC
=> Without this patch you keep being redirected to the auth form screen
=> With this patch applied you are able to successfully login

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>

Comment 10 Victor Grousset/tuxayo 2022-07-28 17:55:32 UTC

> You let the session in an unexpected state and change the code?

Ah ok the bad state comes from before the patch is applied! Thanks for clearing that up.

Works, qa script happy, code looks good, passing QA :)

Comment 11 Tomás Cohen Arazi (tcohen) 2022-07-29 18:51:40 UTC

Pushed to master for 22.11.

Nice work everyone, thanks!

Comment 12 Lucas Gass (lukeg) 2022-09-29 14:26:14 UTC

Backported to 22.05.x for 22.05.06

Comment 13 Arthur Suzuki 2022-10-12 08:51:22 UTC

Depends on 2FA feature, won't backport to 21.11!