Created attachment 105997 [details] [review] Authorise on the x-koha-authorization header, not the authorization header Just spent a whole bunch of time on this - and think I have a solution. The rest api, is looking for the authorization header - but for some reason, koha is rewriting this header to be "x-koha-authorization". The attached patch fixes things for me here, finally allowing me to make API calls!
Looks like this patch needs a commit messge? https://wiki.koha-community.org/wiki/Version_Control_Using_Git#Commit_message
This patch looks definitely incorrect. (It also updates Auth.pm.old rather than Auth.pm) But interesting bug report. I'm planning to use the OAuth setup in the near future so I'll keep an eye out.
Sorry about the bad patch! I'll take a look at it when I'm next at the job where I work on this stuff! :-) (Having said that, with things manually patched, everything works great! We are able to use the API to create student accounts from our centralised student management system (creates google,local computer and koha accounts). The only thing that is missing from the API is the ability to upload patron photos. At some point, I should get around to adding a bug report about that!)
(In reply to Nicholas van Oudtshoorn from comment #0) > Just spent a whole bunch of time on this - and think I have a solution. The > rest api, is looking for the authorization header - but for some reason, > koha is rewriting this header to be "x-koha-authorization". > What do you mean by "koha is rewriting this header to be "x-koha-authorization". Your API client is sending the Authorization header. It sounds like your API client is putting the Authorization header into "x-koha-authorization" instead of "Authorization". Sounds to me like a bug with your API client and not Koha.
(In reply to Nicholas van Oudtshoorn from comment #3) > (Having said that, with things manually patched, everything works great! We > are able to use the API to create student accounts from our centralised > student management system (creates google,local computer and koha accounts). > The only thing that is missing from the API is the ability to upload patron > photos. At some point, I should get around to adding a bug report about > that!) I suspect that it might be working as expected but not working correctly. But would need more information.
Is this still valid? Noting Bug 31378 has now been pushed upstream.
(In reply to Aleisha Amohia from comment #6) > Is this still valid? Noting Bug 31378 has now been pushed upstream. Bug 31378 is unrelated. This bug is about using OAuth tokens from the /api/v1/oauth/token endpoint. I don't think this bug was ever valid. I've only used the Cookie auth and HTTP Basic auth for the REST API, so I can't really speak to the OAuth2 auth for the REST API, but the issue report and patch don't really make sense.
(In reply to David Cook from comment #7) > (In reply to Aleisha Amohia from comment #6) > > Is this still valid? Noting Bug 31378 has now been pushed upstream. > > Bug 31378 is unrelated That said, I have thought about how it would be cool to use tokens from an OIDC IdP to allow access to Koha's REST API.
I wonder if this could be closed?
Let's close it for the sake of cleanup and if it turns out to still be valid a new one can be opened. :)