Bug 39601

Summary: Add passkey support to Koha as an authentication mechanism
Product: Koha Reporter: David Nind <david>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low CC: dcook, dpavlin, paul.derscheid
Version: Main   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description David Nind 2025-04-10 10:16:59 UTC
Consider adding passkey support to Koha as an authentication mechanism.

I have seen this method as an option more frequently now with all the various online services I use.

Some articles:
1. Bitwarden article - What are passkeys? https://bitwarden.com/blog/what-are-passkeys-and-passkey-login/
2. tom's guide - What are passkeys? Everything you need to know about the death of passwords https://www.tomsguide.com/news/what-are-passkeys
Comment 1 David Nind 2025-04-10 10:19:10 UTC
See Koha Community Chat thread https://chat.koha-community.org/koha-community/pl/4irec4ocjtyy8pgezeaz9c9nwo

Includes "It could also be a gateway to finally moving "password" out of the borrowers table and into a "credentials" table...".
Comment 2 Paul Derscheid 2025-04-10 10:22:43 UTC
This is properly the best guidance on how to incorporate it:
https://www.passkeys.com/guide

What we also should do beforehand is to decide on how we'd like to do JSON-RPC in Koha :)
See bugs:
- 30652: RPC style action endpoint for choosing matches
- 34784: Add ability to populate empty item call numbers for a record based on the itemcallnumber system preference
- 38224: Move populate_empty_callnumbers logic into Koha::Biblio for reusability
- 38226: Add RPC endpoint for batch filling empty callnumbers
- 38745: Add a proof of concept JSON-RPC driven endpoint for RPC style calls that don't fit REST ideals

Can't yet declare one of them as a dependency for this one.
Comment 3 David Nind 2025-05-11 17:44:51 UTC
An article from Troy Hunt attempting to explain passkeys and why they are needed: Passkeys for Normal People (5 May 2025), https://www.troyhunt.com/passkeys-for-normal-people/