Bug 31247 - Staff interface 2FA blocks logging into the OPAC
Summary: Staff interface 2FA blocks logging into the OPAC
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Assignee: Jonathan Druart
QA Contact: Victor Grousset/tuxayo
URL:
Keywords:
Depends on: 28786
Blocks: 20476
  Show dependency treegraph
 
Reported: 2022-07-27 14:30 UTC by Caroline Cyr La Rose
Modified: 2022-10-14 21:52 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.11.00, 22.05.06


Attachments
Bug 31247: Fix OPAC authentication when 2FA is enabled (1.14 KB, patch)
2022-07-27 15:49 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 31247: Add tests (1.10 KB, patch)
2022-07-27 15:52 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 31247: Fix OPAC authentication when 2FA is enabled (1.21 KB, patch)
2022-07-27 16:04 UTC, Caroline Cyr La Rose
Details | Diff | Splinter Review
Bug 31247: Add tests (1.17 KB, patch)
2022-07-27 16:04 UTC, Caroline Cyr La Rose
Details | Diff | Splinter Review
Bug 31247: Add tests (1.22 KB, patch)
2022-07-28 17:52 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 31247: Fix OPAC authentication when 2FA is enabled (1.27 KB, patch)
2022-07-28 17:53 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Caroline Cyr La Rose 2022-07-27 14:30:52 UTC
I noticed when I turned on the 2FA for my staff account, I'm no longer able to log into the OPAC with that same account. I usually use the same account for both, so I find this a major drawback in using 2FA.

To test:
1) With 2FA turned off, log into the staff interface with your staff account
--> login is normal
2) With 2FA turned off, log into the OPAC with the same account
--> login is normal
3) Turn on 2FA
3.1) In System preferences, enable TwoFactorAuthentication
3.2) Go to 'My account' (click your username in the top right and choose 'My account)
3.3) Click More > Manage two-factor authentication
3.4) Click Enable two-factor authentication
3.5) With an authenticator app (I used FreeOTP) scan the QR code
3.6) Enter the PIN provided by the app in the PIN code field
3.7) Click Register with two-factor app
4) Log out of the staff interface
5) Log into the staff interface
--> Username, password and two-factor code is needed
6) Log out of the OPAC
7) Log into the OPAC (I used the login box on the right)
--> It cycles back to the login page, you can never log in
8) In the staff interface, disable 2FA
8.1) In 'My account', click More > Manage two-factor authentication
8.2) Click Disable two-factor authentication
9) Log into the OPAC
--> login is normal
Comment 1 Jonathan Druart 2022-07-27 15:49:05 UTC
Created attachment 138181 [details] [review]
Bug 31247: Fix OPAC authentication when 2FA is enabled

Silly mistake from bug 28786, the $type should be compared to "opac"
instead of "OPAC", erk!

Test plan:
Turn 2FA on
Set it up for an user
Login at the OPAC
=> Without this patch you keep being redirected to the auth form screen
=> With this patch applied you are able to successfully login
Comment 2 Jonathan Druart 2022-07-27 15:52:56 UTC
Created attachment 138182 [details] [review]
Bug 31247: Add tests
Comment 3 Caroline Cyr La Rose 2022-07-27 16:04:01 UTC
Created attachment 138183 [details] [review]
Bug 31247: Fix OPAC authentication when 2FA is enabled

Silly mistake from bug 28786, the $type should be compared to "opac"
instead of "OPAC", erk!

Test plan:
Turn 2FA on
Set it up for an user
Login at the OPAC
=> Without this patch you keep being redirected to the auth form screen
=> With this patch applied you are able to successfully login

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Comment 4 Caroline Cyr La Rose 2022-07-27 16:04:05 UTC
Created attachment 138184 [details] [review]
Bug 31247: Add tests

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Comment 5 Victor Grousset/tuxayo 2022-07-28 04:45:01 UTC
Found issue

1. don't apply patch
2. setup 2FA
3. logout staff
4. login and use 2FA
5. go to OPAC
6. logout OPAC (in my setup, on localhost but on a different port, OPAC and staff share session)
7. try to log in the OPAC
8. it fails
9. apply patch and restart services
10. try to log in the OPAC
11. it still fails (nothing in the logs), this is not expected
12. go to staff
13. you are prompted for 2FA
14. cancel (I guess putting the code would also unblock the situation)
15. go to opac and retry logging
16. it works!
Comment 6 Victor Grousset/tuxayo 2022-07-28 05:03:51 UTC
BTW, step 8 on my test plan, going to the staff interface and hitting cancel to the 2FA doesn't make the OPAC logging work. So the patch is indeed needed.

Also, on step 8 if one does the 2FA and retries the OPAC it works. So it seems to show that it's linked to this ticket and that it's incomplete.
Comment 7 Jonathan Druart 2022-07-28 06:52:17 UTC
You let the session in an unexpected state and change the code? Yes of course it is failing.
If you want your steps to work you must truncate the sessions table after you applied the patches.
Comment 8 Victor Grousset/tuxayo 2022-07-28 17:52:58 UTC
Created attachment 138219 [details] [review]
Bug 31247: Add tests

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 9 Victor Grousset/tuxayo 2022-07-28 17:53:07 UTC
Created attachment 138220 [details] [review]
Bug 31247: Fix OPAC authentication when 2FA is enabled

Silly mistake from bug 28786, the $type should be compared to "opac"
instead of "OPAC", erk!

Test plan:
Turn 2FA on
Set it up for an user
Login at the OPAC
=> Without this patch you keep being redirected to the auth form screen
=> With this patch applied you are able to successfully login

Signed-off-by: Caroline Cyr La Rose <caroline.cyr-la-rose@inlibro.com>
Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 10 Victor Grousset/tuxayo 2022-07-28 17:55:32 UTC
> You let the session in an unexpected state and change the code?

Ah ok the bad state comes from before the patch is applied! Thanks for clearing that up.

Works, qa script happy, code looks good, passing QA :)
Comment 11 Tomás Cohen Arazi 2022-07-29 18:51:40 UTC
Pushed to master for 22.11.

Nice work everyone, thanks!
Comment 12 Lucas Gass 2022-09-29 14:26:14 UTC
Backported to 22.05.x for 22.05.06
Comment 13 Arthur Suzuki 2022-10-12 08:51:22 UTC
Depends on 2FA feature, won't backport to 21.11!