Bug 9164

Summary:	Only allow kohaadmin login under special conditions
Product:	Koha	Reporter:	Marcel de Rooy <m.de.rooy>
Component:	Architecture, internals, and plumbing	Assignee:	Galen Charlton <gmcharlt>
Status:	CLOSED FIXED	QA Contact:
Severity:	enhancement
Priority:	P5 - low	CC:	jonathan.druart, kyle, mjr
Version:	Main
Hardware:	All
OS:	All
See Also:	http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11590 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20489
Change sponsored?:	---	Patch complexity:	---
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:

Description Marcel de Rooy 2012-11-28 13:55:14 UTC

Would it be an idea to separate the Koha password of kohaadmin [or whatever you name it during installation] from the database password (in terms of security)? 
Furthermore, is it necessary that kohaadmin can login via opac? 
And even, could we disable staff client login via kohaadmin under normal circumstances, only allowing login under special conditions (installer, maintenance mode, or so). We could define these conditions and provide a way for system administrators to "force these conditions" without compromising security again. 

Will ask for some ideas in this regard on the dev list.

Comment 1 MJ Ray (software.coop) 2012-11-30 11:10:11 UTC

I don't think it's necessary that kohaadmin can login via opac, but I would like to keep the other two features because they make it much easier to support libraries that lose their real superlibrarian passwords.  If they are disabled, there should be a way to enable them again quickly from the configuration files, without needing to login to the staff client and change system preferences.

Comment 2 Kyle M Hall (khall) 2012-12-11 19:12:02 UTC

I agree, this should be a choice set in the koha conf file. Another possibility that could work with this would be to add a command line script to create/update users.

Comment 3 Katrin Fischer 2018-10-11 06:06:19 UTC

It's no longer possible to login with the db account into staff and OPAC - I think this can be closed.