Bug 40546

Summary: Add access control layer using RBAC (Role-Based Access Control) + ABAC (Attribute-Based Access Control)
Product: Koha Reporter: David Cook <dcook>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P5 - low    
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38696
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=30724
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16631
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37052
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28005
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34614
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39374
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39372
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description David Cook 2025-07-30 00:09:58 UTC
The idea here is that you have roles "LibraryAdmin", "CircDesk", "Cataloguing", etc. We would probably attach the roles to patron categories (ie groups) and patrons. 

Separately we'd have an attribute-based policy. 

Typically, you have a "subject" (ie Logged in user), "action" (RunReport), and "object" (Report 42). Sometimes you'll also have a "condition"/"context" (LoggedInBranch CPL). 

This attribute-based policy could then be assigned to a role or a patron. 

I expect broad policies would be applied at the role level, and then more specific policies would be applied at the patron level. We might find that we rarely or never use them at the patron-level, but probably good to allow for that level of specificity.
Comment 1 David Cook 2025-07-30 00:15:16 UTC
In the past, we've talked about replacing the current authorization/access control system all at once, but I think that this could be implemented in an incremental way. 

I think we'd want to consider a broad scope of actions to make sure we're designing it in a way that does accommodate the whole of Koha, but we could just do it a little bit at a time.