Bug 41270

Summary: Two-factor authentication does not create entry in action_logs
Product: Koha Reporter: David Liddle <david.liddle>
Component: Transaction logsAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low    
Version: 24.11   
Hardware: All   
OS: Linux   
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description David Liddle 2025-11-19 14:41:49 UTC
In advance of updating our production server from 22.11 LTS to 24.11 LTS, we are testing the use of the system preferences TwoFactorAuthentication (Enable) and TrackLastPatronActivityTriggers (Logging in) on the test server that has undergone this upgrade.

I have enabled two-factor authentication on my own account.

While examining the relationship between borrowers.lastseen and action_logs.timestamp, I noticed that the value for my lastseen in borrowers could not be correlated to an entry in action_logs. The last SUCCESS action for the AUTH module in action_logs appears to correlate only with the submission of the correct username and password. The timestamp for lastseen is newer and seems to correlate with the submission of the correct OTP code.

There ought to be an entry in action_logs that reflects the success or failure of the 2FA challenge.

Thanks!