Summary: | SIP2 should work with LDAP and CAS | ||
---|---|---|---|
Product: | Koha | Reporter: | Katrin Fischer <katrin.fischer> |
Component: | SIP2 | Assignee: | Bugs List <koha-bugs> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | normal | ||
Priority: | P5 - low | CC: | boutrosboutrosboutros, colin.campbell, dcook, dpavlin, kohadevinim |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10372 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: |
Description
Katrin Fischer
2013-03-27 10:05:54 UTC
For login authentication it calls C4/Auth check_api_auth ( so the fact it checks the password in the config file is a bit redundant) For patron status it checks against the db if a password is sent or will accept ''. For patron information the password is not a required field. The sip logic is that the borrower barcode is the patron's token allowing them to request to borrow books. A quick look at the checkpw routines in Auth suggests that they are doing more than testing the validity of the password as they are setting up parameters for a user session and I think we'd need a simpler 'is_this_password_valid' interface to Auth, but that could easily replace the call currently in ILS/Patron.pm Patch for 9611 switches to callingC4::Auth for password validation but still bypasses ldap & CAS Is this still valid? Looking at "C4/SIP/ILS/Patron.pm" and it looks like it uses "checkpw()" which looks like it will check LDAP. I'm not familiar with CAS but it looks like its more SSO rather than directory lookup like LDAP so don't know that it would ever work in this context. (In reply to David Cook from comment #3) > Is this still valid? > > Looking at "C4/SIP/ILS/Patron.pm" and it looks like it uses "checkpw()" > which looks like it will check LDAP. > > I'm not familiar with CAS but it looks like its more SSO rather than > directory lookup like LDAP so don't know that it would ever work in this > context. CAS is for authentication, like LDAP or Shibboleth. Some libraries ask for the password at the self checks to avoid abuse of lost cards. (In reply to Katrin Fischer from comment #4) > (In reply to David Cook from comment #3) > > Is this still valid? > > > > Looking at "C4/SIP/ILS/Patron.pm" and it looks like it uses "checkpw()" > > which looks like it will check LDAP. > > > > I'm not familiar with CAS but it looks like its more SSO rather than > > directory lookup like LDAP so don't know that it would ever work in this > > context. > > CAS is for authentication, like LDAP or Shibboleth. Some libraries ask for > the password at the self checks to avoid abuse of lost cards. LDAP and Shibboleth/SAML are totally different though. I'm not familiar with CAS, but I imagine it probably works similar to SAML and OIDC in that it requires browser redirection, which needs to happen client-side. LDAP, on the other hand, happens all server-side. So LDAP is easy to do on a SIP server, but you couldn't do SAML/OIDC (and maybe CAS) on the SIP server. Alex and I have been talking about SAML for the self checkout at bug 30444. It gets complicated... Looking at this spring implementation of CAS, it looks like it works similar to SAML and OIDC as I said in regard to the browser redirection: https://docs.spring.io/spring-security/site/docs/3.1.4.RELEASE/reference/cas.html (In reply to David Cook from comment #6) > Looking at this spring implementation of CAS, it looks like it works similar > to SAML and OIDC as I said in regard to the browser redirection: > https://docs.spring.io/spring-security/site/docs/3.1.4.RELEASE/reference/cas. > html So technically I think it's impossible for the SIP server to use CAS. But adding CAS auth to self-checkout interface could be interesting. You have a good point, it does require redirection. So for libraries using CAS at the moment it won't be possible to require login at the self check, unless the self check provider implements this in their software. |