Bug 39601 - Add passkey support to Koha as an authentication mechanism
Summary: Add passkey support to Koha as an authentication mechanism
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-04-10 10:16 UTC by David Nind
Modified: 2025-04-11 02:48 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Nind 2025-04-10 10:16:59 UTC
Consider adding passkey support to Koha as an authentication mechanism.

I have seen this method as an option more frequently now with all the various online services I use.

Some articles:
1. Bitwarden article - What are passkeys? https://bitwarden.com/blog/what-are-passkeys-and-passkey-login/
2. tom's guide - What are passkeys? Everything you need to know about the death of passwords https://www.tomsguide.com/news/what-are-passkeys
Comment 1 David Nind 2025-04-10 10:19:10 UTC
See Koha Community Chat thread https://chat.koha-community.org/koha-community/pl/4irec4ocjtyy8pgezeaz9c9nwo

Includes "It could also be a gateway to finally moving "password" out of the borrowers table and into a "credentials" table...".
Comment 2 Paul Derscheid 2025-04-10 10:22:43 UTC
This is properly the best guidance on how to incorporate it:
https://www.passkeys.com/guide

What we also should do beforehand is to decide on how we'd like to do JSON-RPC in Koha :)
See bugs:
- 30652: RPC style action endpoint for choosing matches
- 34784: Add ability to populate empty item call numbers for a record based on the itemcallnumber system preference
- 38224: Move populate_empty_callnumbers logic into Koha::Biblio for reusability
- 38226: Add RPC endpoint for batch filling empty callnumbers
- 38745: Add a proof of concept JSON-RPC driven endpoint for RPC style calls that don't fit REST ideals

Can't yet declare one of them as a dependency for this one.