Bug 21309 - Enforce password change on login
Summary: Enforce password change on login
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement with 2 votes (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
: 24795 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-09-01 19:42 UTC by Christopher Brannon
Modified: 2023-04-12 16:04 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2018-09-01 19:42:03 UTC
We should add a flag to patron accounts that, if checked, would require the patron to sign in to their account and change their password.  This option could incorporate the following functionality:

* Allow patron to sign in with old password then prompt for a new password.
* E-mail patron notifying them with the need to change.
* When active, it would block checkouts and sip authentication until done.
* Anytime a password is changed in the account, whether staff side or opac, the change would clear the flag in the patron account.
* Date of change should be time stamped.

Christopher
Comment 1 Katrin Fischer 2018-10-28 18:30:35 UTC
I really like the idea of having a way to enforce password change.

It would also be nice if the flag could be preset for new patrons in general and/or from the patron import tool.
Comment 2 Claudio Costales 2019-04-04 18:51:12 UTC
Sure, it's a must have...
Comment 3 Owen Leonard 2019-04-16 13:48:03 UTC
(In reply to Christopher Brannon from comment #0)

> * E-mail patron notifying them with the need to change.

I think this feature is sorely needed, but I think many users would think this kind of email was a phishing attempt.
Comment 4 Liz Rea 2019-08-19 16:57:40 UTC
I would add that I want all new patrons to have this flag set by default if a login is created.
Comment 5 Christopher Brannon 2019-08-19 20:14:14 UTC
(In reply to Liz Rea from comment #4)
> I would add that I want all new patrons to have this flag set by default if
> a login is created.

+1
Comment 6 Christopher Brannon 2019-08-19 20:14:30 UTC
(In reply to Katrin Fischer from comment #1)
> I really like the idea of having a way to enforce password change.
> 
> It would also be nice if the flag could be preset for new patrons in general
> and/or from the patron import tool.

+1
Comment 7 Christopher Brannon 2019-08-19 20:15:16 UTC
We should add a flag to patron accounts that, if checked, would require the patron to sign in to their account and change their password.  This option could incorporate the following functionality:

* Allow patron to sign in with old password then prompt for a new password.
* E-mail patron notifying them with the need to change.
* When active, it would block checkouts and sip authentication until done.
* Anytime a password is changed in the account, whether staff side or opac, the change would clear the flag in the patron account.
* Date of change should be time stamped.
* All new patrons shgould have this flag set by default if a login is created.
Comment 8 Christopher Brannon 2019-08-19 20:15:54 UTC
We should add a flag to patron accounts that, if checked, would require the patron to sign in to their account and change their password.  This option could incorporate the following functionality:

* Allow patron to sign in with old password then prompt for a new password.
* E-mail patron notifying them with the need to change.
* When active, it would block checkouts and sip authentication until done.
* Anytime a password is changed in the account, whether staff side or opac, the change would clear the flag in the patron account.
* Date of change should be time stamped.
* All new patrons should have this flag set by default if a login is created.
Comment 9 Owen Leonard 2019-08-19 23:06:38 UTC
(In reply to Liz Rea from comment #4)
> I would add that I want all new patrons to have this flag set by default if
> a login is created.

+1
Comment 10 Katrin Fischer 2020-04-05 13:32:13 UTC
*** Bug 24795 has been marked as a duplicate of this bug. ***
Comment 11 Christopher Brannon 2023-04-08 19:13:57 UTC
Noting that Koha now has the capability to send a reset notice.  However, this is limiting to patrons that have email.  Even if the notice were to send via text, this still limits capability to certain patrons.

It would be preferable if the reset tied into the same mechanism that password expiration uses.  Right now, they work independently from one another and the reset is exclusive to patrons that receive email.