Bug 39370

Summary: staff authentication (success or fail) should always be logged
Product: Koha Reporter: Evelyn Hartline <evelyn>
Component: AuthenticationAssignee: Kyle M Hall (khall) <kyle>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: dpavlin, lucas
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Evelyn Hartline 2025-03-18 16:25:12 UTC
Regardless of the Authentication Logs being enabled in Koha, when a user of the category type "staff" attempts to authenticate, it should always be logged. Ideally the length of the session should also be stored, but that may add complexity (I'm happy to open a new bug for length of session if that's the preference, please just let me know). 

This would help for any future security questions for libraries that don't enable those authentication logs by default, and also assist in making audits more straightforward.