Bug 15720 - OCLC Connexion daemon does not verify username or password
Summary: OCLC Connexion daemon does not verify username or password
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Nick Clemens
QA Contact: Kyle M Hall
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-02-02 00:10 UTC by Jesse Weaver
Modified: 2021-05-26 07:52 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:
21.05.00,20.11.06,20.05.12,19.11.18


Attachments
Bug 15720: Add connexion user and password options to connexion daemon (4.10 KB, patch)
2020-09-17 18:45 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 15720: Add connexion user and password options to connexion daemon (4.59 KB, patch)
2020-09-25 14:00 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 15720: Add connexion user and password options to connexion daemon (4.65 KB, patch)
2021-03-12 20:24 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 15720: Add connexion user and password options to connexion daemon (4.72 KB, patch)
2021-05-07 14:29 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 15720: Add connexion user and password options to connexion daemon (4.72 KB, patch)
2021-05-07 14:42 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jesse Weaver 2016-02-02 00:10:38 UTC
Following the chain of data from read_request in misc/bin/connexion_import_daemon.pl to the authentication code in handle_request, the username and password sent by the OCLC Connexion client are silently ignored. The user/password in connexion.cnf are used to connect to Koha.

This means that, with knowledge of the Connexion protocol and a known host/port with a running Koha Connexion daemon, records can be created/modified (depending on the settings in connexion.cnf) without any valid Koha login on the target system.

To reproduce, start connexion_import_daemon.pl, then run:

echo -en 'U8fakeuserA9localuserP8fakepass00024    a2200024   4500\000' | nc -v HOST PORT
Comment 1 Jesse Weaver 2016-02-02 00:24:32 UTC
There are three possible ways to solve this:

  1) Remove the user/password in connexion.cnf, and use the user/password sent by the Connexion client to log into Koha.
  2) Require that the user/password sent by the Connexion client match the user/password in connexion.cnf.
  3) Add new connexion_user/connexion_password options to connexion.cnf, and require that the user/password sent by the Connexion client match them.

1) has the advantage of matching what is currently documented (http://manual.koha-community.org/3.22/en/oclcdesktopsetup.html) and being very straightforward. However, both 1) and 2) mean that valid Koha staff logins are transmitted in plaintext.

Thoughts?
Comment 2 Katrin Fischer 2016-02-02 08:18:39 UTC
Not an OCLC connexion user... but the plaintext problem seems like killer for 1) and 2) to me.
Comment 3 Jesse Weaver 2016-02-18 21:13:21 UTC
Srdjan, as the original author, I'd like your input.

I prefer 3, personally, but it does mean that we'll have to roll out a bit of a jarring upgrade if we don't want to wait for 3.24.
Comment 4 Srdjan Jankovic 2016-02-19 00:12:30 UTC
Yes, that logic is flawed and does not authenticate with username/password sent by the Connexion client. The intention was to either have username/password in the config, or if missing force authenticaion sent by the Connexion client.
Unfortunately I was not able to test it myself (I could not get a Connexion client) so I had to hand it out half baked, username/password in config worked, so no user/pass in config situation was not put to test.

A quick idea what should be there:

    if ($self->{user}) {
        $user = $self->{user};
        $password = $self->{password};
        $ua = $self->{ua};
    }
    else {
        $ua  = _ua(); # fresh one, needs to authenticate
        $resp = $ua->post( $base_url.AUTH_URI, { userid => $user, password => $password } ); # XXX this was missing
        return $self->error_response("Invalid auth response") unless $resp->is_success;
    }
...
    if ($self->{user} && ($status == HTTP_UNAUTHORIZED || $status == HTTP_FORBIDDEN)) { # XXX only reauthenticate if cached ua
        # no need my $user = $self->{user};
        # no need my $password = $self->{password};

This fix caters for option 1.
2/3 would give benefit in case all the Connexion clients use the same credentials. Then we have a persistent session cookie.

Re plain text - well, short of using https, it is either authenticate in plain text, or let everyone connect. In case of http, 3 would probably be preferred over 2 obecause it is protects the Koha credentials.
Comment 5 Nick Clemens 2020-09-17 18:45:39 UTC
Created attachment 110288 [details] [review]
Bug 15720: Add connexion user and password options to connexion daemon

Currently the connexion daemon does not utilize the user and password passed in the requests, it expects a
user and password to be defined in the config file and for that user to be a valid Koha user with
cataloging permissions.

With that user in place all requests to the daemon are authorized.

As the connections are over TCP we allow defining a new connexion user and password to protect Koha account information.

If not defined current behaviour is preserved. Connexion user and password must both be set it either is set.

Sample config file:
host:
port: 8888
koha:http://localhost:8081
log:/var/log/koha/kohadev/connexion.log
match:ISBN
user:kohauser
password:kohapass
overlay_action:replace
nomatch_action:create_new
item_action:always_add
import_mode:redirect
debug:1

To test:
 1 - Create connexion file and save on the Koha serve
 2 - perl misc/bin/connexion_import_daemon.pl -c /kohadevbox/koha/connexion.cnf
 3 - Ensure the user specified above (connexuser) exists and has edit catalogue permissions
 4 - In another terminal make a request to the server:
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
 5 - The request should succeed and record added to batch (probably the import fails, but not important)
 6 - Add to config file
        connexion_user:conuser
 7 - Stop and restart the daemon - it should fail on missing connexion_password
 8 - Comment out connexion_user and add
        connexion_password:conpass
 9 - Stop and restart daemon, it fails on missing connexion_user
10 - Uncomment the user and restart
11 - Make another request
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
12 - It fails 'Unauthorized request'
13 - Make another request
        echo -en 'U7conuserA9connexionP7conpass00024    a62clear00024   4500' | nc -v localhost 8888
14 - It succeeds!
Comment 6 Nick Clemens 2020-09-25 14:00:05 UTC
Created attachment 110762 [details] [review]
Bug 15720: Add connexion user and password options to connexion daemon

Currently the connexion daemon does not utilize the user and password passed in the requests, it expects a
user and password to be defined in the config file and for that user to be a valid Koha user with
cataloging permissions.

With that user in place all requests to the daemon are authorized.

As the connections are over TCP we allow defining a new connexion user and password to protect Koha account information.

If not defined current behaviour is preserved. Connexion user and password must both be set it either is set.

Sample config file:
host:
port: 8888
koha:http://localhost:8081
log:/var/log/koha/kohadev/connexion.log
match:ISBN
user:kohauser
password:kohapass
overlay_action:replace
nomatch_action:create_new
item_action:always_add
import_mode:redirect
debug:1

To test:
 1 - Create connexion file and save on the Koha serve
 2 - perl misc/bin/connexion_import_daemon.pl -c /kohadevbox/koha/connexion.cnf
 3 - Ensure the user specified above (connexuser) exists and has edit catalogue permissions
 4 - In another terminal make a request to the server:
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
 5 - The request should succeed and record added to batch (probably the import fails, but not important)
 6 - Add to config file
        connexion_user:conuser
 7 - Stop and restart the daemon - it should fail on missing connexion_password
 8 - Comment out connexion_user and add
        connexion_password:conpass
 9 - Stop and restart daemon, it fails on missing connexion_user
10 - Uncomment the user and restart
11 - Make another request
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
12 - It fails 'Unauthorized request'
13 - Make another request
        echo -en 'U7conuserA9connexionP7conpass00024    a62clear00024   4500' | nc -v localhost 8888
14 - It succeeds!
Comment 7 Nick Clemens 2020-09-25 17:53:06 UTC
Testing tips:
Get windows (if you don't have it) https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/
Get connexion: https://help.oclc.org/Librarian_Toolbox/Software_downloads/Cataloging_software_downloads

Boot up the vm, install connexion
Add a new local export
Your host is your local ip
The port is 8888 by default
local user and pass should match your connexion user and pass in config

To make port 8888 accessible in kohatesting docker add it to docker-compose.yml
in the ports section:
- "8888:8888"

Launch server as below

In connexion you create a new record, press Shift+F5 to get it verified and saved to local  - in options set allow export of workforms, then you should be bale to press F5 to export the record to Koha

There are some more fiddly bits I forgot I bet, but it's at least possible to do this without an OCLC connection
Comment 8 Nick Clemens 2021-03-12 20:24:37 UTC
Created attachment 118215 [details] [review]
Bug 15720: Add connexion user and password options to connexion daemon

Currently the connexion daemon does not utilize the user and password passed in the requests, it expects a
user and password to be defined in the config file and for that user to be a valid Koha user with
cataloging permissions.

With that user in place all requests to the daemon are authorized.

As the connections are over TCP we allow defining a new connexion user and password to protect Koha account information.

If not defined current behaviour is preserved. Connexion user and password must both be set it either is set.

Sample config file:
host:
port: 8888
koha:http://localhost:8081
log:/var/log/koha/kohadev/connexion.log
match:ISBN
user:kohauser
password:kohapass
overlay_action:replace
nomatch_action:create_new
item_action:always_add
import_mode:redirect
debug:1

To test:
 1 - Create connexion file and save on the Koha serve
 2 - perl misc/bin/connexion_import_daemon.pl -c /kohadevbox/koha/connexion.cnf
 3 - Ensure the user specified above (connexuser) exists and has edit catalogue permissions
 4 - In another terminal make a request to the server:
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
 5 - The request should succeed and record added to batch (probably the import fails, but not important)
 6 - Add to config file
        connexion_user:conuser
 7 - Stop and restart the daemon - it should fail on missing connexion_password
 8 - Comment out connexion_user and add
        connexion_password:conpass
 9 - Stop and restart daemon, it fails on missing connexion_user
10 - Uncomment the user and restart
11 - Make another request
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
12 - It fails 'Unauthorized request'
13 - Make another request
        echo -en 'U7conuserA9connexionP7conpass00024    a62clear00024   4500' | nc -v localhost 8888
14 - It succeeds!

Signed-off-by: Allison Blanning <ablanning@hotchkiss.org>
Comment 9 Katrin Fischer 2021-03-13 15:50:06 UTC
I believe this is probably not testable without a connexion user (WorldCat)?

Maybe we could get a second sign-off to help this along?
Comment 10 Nick Clemens 2021-03-13 16:06:30 UTC
(In reply to Katrin Fischer from comment #9)
> I believe this is probably not testable without a connexion user (WorldCat)?
> 
> Maybe we could get a second sign-off to help this along?

See comment 7

It requires some setup but is possible
Comment 11 Kyle M Hall 2021-05-07 14:29:25 UTC
Created attachment 120696 [details] [review]
Bug 15720: Add connexion user and password options to connexion daemon

Currently the connexion daemon does not utilize the user and password passed in the requests, it expects a
user and password to be defined in the config file and for that user to be a valid Koha user with
cataloging permissions.

With that user in place all requests to the daemon are authorized.

As the connections are over TCP we allow defining a new connexion user and password to protect Koha account information.

If not defined current behaviour is preserved. Connexion user and password must both be set it either is set.

Sample config file:
host:
port: 8888
koha:http://localhost:8081
log:/var/log/koha/kohadev/connexion.log
match:ISBN
user:kohauser
password:kohapass
overlay_action:replace
nomatch_action:create_new
item_action:always_add
import_mode:redirect
debug:1

To test:
 1 - Create connexion file and save on the Koha serve
 2 - perl misc/bin/connexion_import_daemon.pl -c /kohadevbox/koha/connexion.cnf
 3 - Ensure the user specified above (connexuser) exists and has edit catalogue permissions
 4 - In another terminal make a request to the server:
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
 5 - The request should succeed and record added to batch (probably the import fails, but not important)
 6 - Add to config file
        connexion_user:conuser
 7 - Stop and restart the daemon - it should fail on missing connexion_password
 8 - Comment out connexion_user and add
        connexion_password:conpass
 9 - Stop and restart daemon, it fails on missing connexion_user
10 - Uncomment the user and restart
11 - Make another request
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
12 - It fails 'Unauthorized request'
13 - Make another request
        echo -en 'U7conuserA9connexionP7conpass00024    a62clear00024   4500' | nc -v localhost 8888
14 - It succeeds!

Signed-off-by: Allison Blanning <ablanning@hotchkiss.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 12 Kyle M Hall 2021-05-07 14:42:39 UTC
Created attachment 120697 [details] [review]
Bug 15720: Add connexion user and password options to connexion daemon

Currently the connexion daemon does not utilize the user and password passed in the requests, it expects a
user and password to be defined in the config file and for that user to be a valid Koha user with
cataloging permissions.

With that user in place all requests to the daemon are authorized.

As the connections are over TCP we allow defining a new connexion user and password to protect Koha account information.

If not defined current behaviour is preserved. Connexion user and password must both be set it either is set.

Sample config file:
host:
port: 8888
koha:http://localhost:8081
log:/var/log/koha/kohadev/connexion.log
match:ISBN
user:kohauser
password:kohapass
overlay_action:replace
nomatch_action:create_new
item_action:always_add
import_mode:redirect
debug:1

To test:
 1 - Create connexion file and save on the Koha serve
 2 - perl misc/bin/connexion_import_daemon.pl -c /kohadevbox/koha/connexion.cnf
 3 - Ensure the user specified above (connexuser) exists and has edit catalogue permissions
 4 - In another terminal make a request to the server:
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
 5 - The request should succeed and record added to batch (probably the import fails, but not important)
 6 - Add to config file
        connexion_user:conuser
 7 - Stop and restart the daemon - it should fail on missing connexion_password
 8 - Comment out connexion_user and add
        connexion_password:conpass
 9 - Stop and restart daemon, it fails on missing connexion_user
10 - Uncomment the user and restart
11 - Make another request
        echo -en 'U6turtleA9connexionP5shell00024    a62clear00024   4500' | nc -v localhost 8888
12 - It fails 'Unauthorized request'
13 - Make another request
        echo -en 'U7conuserA9connexionP7conpass00024    a62clear00024   4500' | nc -v localhost 8888
14 - It succeeds!

Signed-off-by: Allison Blanning <ablanning@hotchkiss.org>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 13 Victor Grousset/tuxayo 2021-05-22 14:20:19 UTC
Applies on 19.11.x. if deemed to be worth the time, I can try to test it >_<
Comment 14 Jonathan Druart 2021-05-26 07:50:27 UTC
Pushed to master for 21.05, thanks to everybody involved!