Bug 39370 - staff authentication (success or fail) should always be logged
Summary: staff authentication (success or fail) should always be logged
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Kyle M Hall (khall)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-03-18 16:25 UTC by Evelyn Hartline
Modified: 2025-03-19 22:11 UTC (History)
2 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Evelyn Hartline 2025-03-18 16:25:12 UTC
Regardless of the Authentication Logs being enabled in Koha, when a user of the category type "staff" attempts to authenticate, it should always be logged. Ideally the length of the session should also be stored, but that may add complexity (I'm happy to open a new bug for length of session if that's the preference, please just let me know). 

This would help for any future security questions for libraries that don't enable those authentication logs by default, and also assist in making audits more straightforward.