Bug 25797 - REST API using OAuth doesn't actually authorize
Summary: REST API using OAuth doesn't actually authorize
Status: RESOLVED INVALID
Alias: None
Product: Koha
Classification: Unclassified
Component: REST API (show other bugs)
Version: 20.05
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-06-18 07:20 UTC by Nicholas van Oudtshoorn
Modified: 2023-12-10 20:32 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Authorise on the x-koha-authorization header, not the authorization header (548 bytes, patch)
2020-06-18 07:20 UTC, Nicholas van Oudtshoorn
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nicholas van Oudtshoorn 2020-06-18 07:20:29 UTC
Created attachment 105997 [details] [review]
Authorise on the x-koha-authorization header, not the authorization header

Just spent a whole bunch of time on this - and think I have a solution. The rest api, is looking for the authorization header - but for some reason, koha is rewriting this header to be "x-koha-authorization".

The attached patch fixes things for me here, finally allowing me to make API calls!
Comment 1 Magnus Enger 2020-08-19 07:48:16 UTC
Looks like this patch needs a commit messge? 
https://wiki.koha-community.org/wiki/Version_Control_Using_Git#Commit_message
Comment 2 David Cook 2020-08-20 02:41:36 UTC
This patch looks definitely incorrect.

(It also updates Auth.pm.old rather than Auth.pm)

But interesting bug report. I'm planning to use the OAuth setup in the near future so I'll keep an eye out.
Comment 3 Nicholas van Oudtshoorn 2020-08-21 09:30:33 UTC
Sorry about the bad patch! I'll take a look at it when I'm next at the job where I work on this stuff! :-)

(Having said that, with things manually patched, everything works great! We are able to use the API to create student accounts from our centralised student management system (creates google,local computer and koha accounts). The only thing that is missing from the API is the ability to upload patron photos. At some point, I should get around to adding a bug report about that!)
Comment 4 David Cook 2020-08-23 23:46:42 UTC
(In reply to Nicholas van Oudtshoorn from comment #0)
> Just spent a whole bunch of time on this - and think I have a solution. The
> rest api, is looking for the authorization header - but for some reason,
> koha is rewriting this header to be "x-koha-authorization".
> 

What do you mean by "koha is rewriting this header to be "x-koha-authorization". Your API client is sending the Authorization header. It sounds like your API client is putting the Authorization header into "x-koha-authorization" instead of "Authorization".

Sounds to me like a bug with your API client and not Koha.
Comment 5 David Cook 2020-08-23 23:47:34 UTC
(In reply to Nicholas van Oudtshoorn from comment #3)
> (Having said that, with things manually patched, everything works great! We
> are able to use the API to create student accounts from our centralised
> student management system (creates google,local computer and koha accounts).
> The only thing that is missing from the API is the ability to upload patron
> photos. At some point, I should get around to adding a bug report about
> that!)

I suspect that it might be working as expected but not working correctly. But would need more information.
Comment 6 Aleisha Amohia 2022-11-27 21:21:39 UTC
Is this still valid? Noting Bug 31378 has now been pushed upstream.
Comment 7 David Cook 2022-11-27 23:31:47 UTC
(In reply to Aleisha Amohia from comment #6)
> Is this still valid? Noting Bug 31378 has now been pushed upstream.

Bug 31378 is unrelated. This bug is about using OAuth tokens from the /api/v1/oauth/token endpoint. 

I don't think this bug was ever valid.

I've only used the Cookie auth and HTTP Basic auth for the REST API, so I can't really speak to the OAuth2 auth for the REST API, but the issue report and patch don't really make sense.
Comment 8 David Cook 2022-11-27 23:42:20 UTC
(In reply to David Cook from comment #7)
> (In reply to Aleisha Amohia from comment #6)
> > Is this still valid? Noting Bug 31378 has now been pushed upstream.
> 
> Bug 31378 is unrelated

That said, I have thought about how it would be cool to use tokens from an OIDC IdP to allow access to Koha's REST API.
Comment 9 Katrin Fischer 2023-12-10 09:15:21 UTC
I wonder if this could be closed?
Comment 10 Aleisha Amohia 2023-12-10 20:32:32 UTC
Let's close it for the sake of cleanup and if it turns out to still be valid a new one can be opened. :)