I noticed when I turned on the 2FA for my staff account, I'm no longer able to log into the OPAC with that same account. I usually use the same account for both, so I find this a major drawback in using 2FA. To test: 1) With 2FA turned off, log into the staff interface with your staff account --> login is normal 2) With 2FA turned off, log into the OPAC with the same account --> login is normal 3) Turn on 2FA 3.1) In System preferences, enable TwoFactorAuthentication 3.2) Go to 'My account' (click your username in the top right and choose 'My account) 3.3) Click More > Manage two-factor authentication 3.4) Click Enable two-factor authentication 3.5) With an authenticator app (I used FreeOTP) scan the QR code 3.6) Enter the PIN provided by the app in the PIN code field 3.7) Click Register with two-factor app 4) Log out of the staff interface 5) Log into the staff interface --> Username, password and two-factor code is needed 6) Log out of the OPAC 7) Log into the OPAC (I used the login box on the right) --> It cycles back to the login page, you can never log in 8) In the staff interface, disable 2FA 8.1) In 'My account', click More > Manage two-factor authentication 8.2) Click Disable two-factor authentication 9) Log into the OPAC --> login is normal
Created attachment 138181 [details] [review] Bug 31247: Fix OPAC authentication when 2FA is enabled Silly mistake from bug 28786, the $type should be compared to "opac" instead of "OPAC", erk! Test plan: Turn 2FA on Set it up for an user Login at the OPAC => Without this patch you keep being redirected to the auth form screen => With this patch applied you are able to successfully login
Created attachment 138182 [details] [review] Bug 31247: Add tests
Created attachment 138183 [details] [review] Bug 31247: Fix OPAC authentication when 2FA is enabled Silly mistake from bug 28786, the $type should be compared to "opac" instead of "OPAC", erk! Test plan: Turn 2FA on Set it up for an user Login at the OPAC => Without this patch you keep being redirected to the auth form screen => With this patch applied you are able to successfully login Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Created attachment 138184 [details] [review] Bug 31247: Add tests Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Found issue 1. don't apply patch 2. setup 2FA 3. logout staff 4. login and use 2FA 5. go to OPAC 6. logout OPAC (in my setup, on localhost but on a different port, OPAC and staff share session) 7. try to log in the OPAC 8. it fails 9. apply patch and restart services 10. try to log in the OPAC 11. it still fails (nothing in the logs), this is not expected 12. go to staff 13. you are prompted for 2FA 14. cancel (I guess putting the code would also unblock the situation) 15. go to opac and retry logging 16. it works!
BTW, step 8 on my test plan, going to the staff interface and hitting cancel to the 2FA doesn't make the OPAC logging work. So the patch is indeed needed. Also, on step 8 if one does the 2FA and retries the OPAC it works. So it seems to show that it's linked to this ticket and that it's incomplete.
You let the session in an unexpected state and change the code? Yes of course it is failing. If you want your steps to work you must truncate the sessions table after you applied the patches.
Created attachment 138219 [details] [review] Bug 31247: Add tests Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Created attachment 138220 [details] [review] Bug 31247: Fix OPAC authentication when 2FA is enabled Silly mistake from bug 28786, the $type should be compared to "opac" instead of "OPAC", erk! Test plan: Turn 2FA on Set it up for an user Login at the OPAC => Without this patch you keep being redirected to the auth form screen => With this patch applied you are able to successfully login Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com> Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
> You let the session in an unexpected state and change the code? Ah ok the bad state comes from before the patch is applied! Thanks for clearing that up. Works, qa script happy, code looks good, passing QA :)
Pushed to master for 22.11. Nice work everyone, thanks!
Backported to 22.05.x for 22.05.06
Depends on 2FA feature, won't backport to 21.11!