Bug 40705

Summary: Password expiry date blocks SSO authentication
Product: Koha Reporter: Koha collecto <koha>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: dcook, dpavlin
Version: 24.05   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: --- Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
Circulation function:

Description Koha collecto 2025-08-26 15:22:30 UTC
Iam only able to test on our Koha, which is not a "vanilla" environment, so I don't know if it's only us o not.

We've added an identity provider to be able to login with Microsoft on the OPAC. And to "force" people to use that login method instead of the manual one, we added an expiry date on everybody's password in Koha. The idea was that, with their password expired, the patrons would need to use the Microsoft auth. 

But the issue is, when the password is expired in Koha, the Microsoft authentication doesn't work. We are redirected to the Microsoft login page, but then when we are returned in Koha, we have the expired password alert. 

We are able to connect to the OPAC using Microsoft only after deleting the password expiry date or renewing the password from the staff interface or the OPAC. So it seems like the password expiry date applies to the entire ability to connect to the OPAC and not just on the password provided by Koha...

To test :
1. Add an identity provider with OIDC protocol.
2. Make sure both the Microsoft authentication and the manual one work as it should.
3. Add a password expiry date to the current date or before.
4. Try either one of the authentication method, you will receive the alert about the password being expired.