Every other part of Koha supports logging in either a userid or cardnumber. The REST API should support this for basic auth as well.
Created attachment 163984 [details] [review] Bug 36420: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 163985 [details] [review] Bug 36420: Allow Basic authentication using `cardnumber` This patch makes the API Basic authentication work with cardnumbers. The used `checkpw_internal` method already does the fallback check. To test: 1. Apply the unit tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/auth_basic.t => FAIL: Tests explode! [1] 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D [1] This highlights an underlying bug! Instead of getting 403, etc we get a 500. This is because of the internal fallback mechanism allowing the cardnumber+password combination, but then the Koha::Patron->find... not finding :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Created attachment 163991 [details] [review] Bug 36420: Allow Basic authentication using `cardnumber` This patch makes the API Basic authentication work with cardnumbers. The used `checkpw_internal` method already does the fallback check. To test: 1. Apply the unit tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/auth_basic.t => FAIL: Tests explode! [1] 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D [1] This highlights an underlying bug! Instead of getting 403, etc we get a 500. This is because of the internal fallback mechanism allowing the cardnumber+password combination, but then the Koha::Patron->find... not finding :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 163992 [details] [review] Bug 36420: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 163993 [details] [review] Bug 36420: Allow Basic authentication using `cardnumber` This patch makes the API Basic authentication work with cardnumbers. The used `checkpw_internal` method already does the fallback check. To test: 1. Apply the unit tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/auth_basic.t => FAIL: Tests explode! [1] 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D [1] This highlights an underlying bug! Instead of getting 403, etc we get a 500. This is because of the internal fallback mechanism allowing the cardnumber+password combination, but then the Koha::Patron->find... not finding :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Created attachment 164256 [details] [review] Bug 36420: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 164257 [details] [review] Bug 36420: Allow Basic authentication using `cardnumber` This patch makes the API Basic authentication work with cardnumbers. The used `checkpw_internal` method already does the fallback check. To test: 1. Apply the unit tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/auth_basic.t => FAIL: Tests explode! [1] 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D [1] This highlights an underlying bug! Instead of getting 403, etc we get a 500. This is because of the internal fallback mechanism allowing the cardnumber+password combination, but then the Koha::Patron->find... not finding :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 165006 [details] [review] Bug 36420: Unit tests Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 165007 [details] [review] Bug 36420: Allow Basic authentication using `cardnumber` This patch makes the API Basic authentication work with cardnumbers. The used `checkpw_internal` method already does the fallback check. To test: 1. Apply the unit tests patch 2. Run: $ ktd --shell k$ prove t/db_dependent/api/v1/auth_basic.t => FAIL: Tests explode! [1] 3. Apply this patch 4. Repeat 2 => SUCCESS: Tests pass! 5. Sign off :-D [1] This highlights an underlying bug! Instead of getting 403, etc we get a 500. This is because of the internal fallback mechanism allowing the cardnumber+password combination, but then the Koha::Patron->find... not finding :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
This works in the same way our other auth fallbacks work. QA scripts are happy, we have unit tests. Passing QA
Pushed for 24.05! Well done everyone, thank you!
Maybe we should create a central method Koha::Patrons->find_by_identifier, managing userid/cadnumber. Would make it easier to disable.
Pushed to 23.11.x for 23.11.06
Backported to 23.05.x for upcoming 23.05.12