Bug 33461

Summary:	Password reset should act like patron expiration when there are no notices available
Product:	Koha	Reporter:	Christopher Brannon <cbrannon>
Component:	Patrons	Assignee:	Bugs List <koha-bugs>
Status:	NEW ---	QA Contact:	Testopia <testopia>
Severity:	enhancement
Priority:	P5 - low	CC:	gmcharlt, kyle.m.hall
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:

Description Christopher Brannon 2023-04-08 22:29:06 UTC

A password reset sends an email to a patron when executed.  The following should be considered:

1)  We should allow other delivery methods
2)  If a patron doesn't have a delivery method, we should be able to use a method like password expiration, but Koha should generate a code that is put in place of the password.  The patron has to put in the code in order to change the password.

Comment 1 Katrin Fischer 2023-04-08 22:36:18 UTC

The email verification acts as a "second factor". By proving they have access to the email account, the user is verified. Same could be used for SMS/text messages when they need to have access to the phone. 

I am not sure where a code would come in and how would it be communicated to the user?

Comment 2 Christopher Brannon 2023-04-08 23:45:43 UTC

(In reply to Katrin Fischer from comment #1)
 
> I am not sure where a code would come in and how would it be communicated to
> the user?

If staff set the reset for a patron, we are usually confirming the patron through other means (via photo id or questions via phone).  If the system sees that there is no email or text, it could generate the code and put it in place of the password, and the staff can tell the patron what that code is.

This guarantees that only the person they verified with can reset the password, not just someone that might have access to the link.