Bug 31965 - Put OpenID discovery doc URL in a system preference
Summary: Put OpenID discovery doc URL in a system preference
Status: RESOLVED DUPLICATE of bug 31378
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Aleisha Amohia
QA Contact: David Cook
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-25 00:20 UTC by Aleisha Amohia
Modified: 2022-10-25 03:07 UTC (History)
2 users (show)

See Also:
Change sponsored?: Sponsored
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Aleisha Amohia 2022-10-25 00:20:42 UTC
Theoretically we could authenticate with OpenID Connect and any other identity provider than Google using the existing googleopenidconnect script, this would be helped if the discovery doc URL could be provided with a system preference.
Comment 1 David Cook 2022-10-25 00:36:24 UTC
I think that the community are planning to replace this functionality soon with Bug 31378.

I'm not a fan of the googleopenidconnect script myself (for lots of reasons), but I suppose there is no harm in updating it. 

You'd need to add a system preference for the "issuer" as well, and to rewrite with a patch or with JS anything in the OPAC that says Google I suppose...
Comment 2 Aleisha Amohia 2022-10-25 00:44:42 UTC
Thanks David, I wasn't aware of Bug 31378.

I do know that $issuer needs a system preference too, I was going to do that separately.

We have a partner library that needs to use OpenID Connect with Azure so perhaps this could be the interim fix while Bug 31378 gets over the line?
Comment 3 David Cook 2022-10-25 01:30:04 UTC
(In reply to Aleisha Amohia from comment #2)
> Thanks David, I wasn't aware of Bug 31378.
> 
> I do know that $issuer needs a system preference too, I was going to do that
> separately.
> 
> We have a partner library that needs to use OpenID Connect with Azure so
> perhaps this could be the interim fix while Bug 31378 gets over the line?

I suppose that's up to the RM, so best to send him an email.

If he's OK with it, I could QA it.
Comment 4 Aleisha Amohia 2022-10-25 01:44:03 UTC
If Bug 31378 isn't far away I will wait for that and help you on that ticket.

If we can't get that into Koha 22.11 then I'll revisit this.

*** This bug has been marked as a duplicate of bug 31378 ***
Comment 5 David Cook 2022-10-25 02:15:42 UTC
(In reply to Aleisha Amohia from comment #4)
> If Bug 31378 isn't far away I will wait for that and help you on that ticket.
> 
> If we can't get that into Koha 22.11 then I'll revisit this.
> 

Sounds like a plan to me.

At the moment, I'm waiting on updated patches from Agustin. Hoping that he provides something ASAP, as I'm keen to see this get in. 

(I wrote a local generic OIDC client back in 2014 which I've carried all these years. If Bug 31378 doesn't get in, I'll just keep using it. That said, I have been thinking about implementing it as a Koha plugin. I wasn't planning on working on that until Feb/March 2023, but perhaps I could move up my schedule on that...)
Comment 6 David Cook 2022-10-25 03:07:37 UTC
(In reply to David Cook from comment #5)
> (I wrote a local generic OIDC client back in 2014 which I've carried all
> these years. If Bug 31378 doesn't get in, I'll just keep using it. That
> said, I have been thinking about implementing it as a Koha plugin. I wasn't
> planning on working on that until Feb/March 2023, but perhaps I could move
> up my schedule on that...)

The one thing a Koha plugin can't do is an OIDC logout, but I don't think the googleopenidconnect can handle that either anyway.