Bug 33461 - Password reset should act like patron expiration when there are no notices available
Summary: Password reset should act like patron expiration when there are no notices av...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Patrons (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-04-08 22:29 UTC by Christopher Brannon
Modified: 2023-04-08 23:45 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Brannon 2023-04-08 22:29:06 UTC
A password reset sends an email to a patron when executed.  The following should be considered:

1)  We should allow other delivery methods
2)  If a patron doesn't have a delivery method, we should be able to use a method like password expiration, but Koha should generate a code that is put in place of the password.  The patron has to put in the code in order to change the password.
Comment 1 Katrin Fischer 2023-04-08 22:36:18 UTC
The email verification acts as a "second factor". By proving they have access to the email account, the user is verified. Same could be used for SMS/text messages when they need to have access to the phone. 

I am not sure where a code would come in and how would it be communicated to the user?
Comment 2 Christopher Brannon 2023-04-08 23:45:43 UTC
(In reply to Katrin Fischer from comment #1)
 
> I am not sure where a code would come in and how would it be communicated to
> the user?

If staff set the reset for a patron, we are usually confirming the patron through other means (via photo id or questions via phone).  If the system sees that there is no email or text, it could generate the code and put it in place of the password, and the staff can tell the patron what that code is.

This guarantees that only the person they verified with can reset the password, not just someone that might have access to the link.