Bug 40546 - Add access control layer using RBAC (Role-Based Access Control) + ABAC (Attribute-Based Access Control)
Summary: Add access control layer using RBAC (Role-Based Access Control) + ABAC (Attri...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-07-30 00:09 UTC by David Cook
Modified: 2025-07-30 00:15 UTC (History)
0 users

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2025-07-30 00:09:58 UTC
The idea here is that you have roles "LibraryAdmin", "CircDesk", "Cataloguing", etc. We would probably attach the roles to patron categories (ie groups) and patrons. 

Separately we'd have an attribute-based policy. 

Typically, you have a "subject" (ie Logged in user), "action" (RunReport), and "object" (Report 42). Sometimes you'll also have a "condition"/"context" (LoggedInBranch CPL). 

This attribute-based policy could then be assigned to a role or a patron. 

I expect broad policies would be applied at the role level, and then more specific policies would be applied at the patron level. We might find that we rarely or never use them at the patron-level, but probably good to allow for that level of specificity.
Comment 1 David Cook 2025-07-30 00:15:16 UTC
In the past, we've talked about replacing the current authorization/access control system all at once, but I think that this could be implemented in an incremental way. 

I think we'd want to consider a broad scope of actions to make sure we're designing it in a way that does accommodate the whole of Koha, but we could just do it a little bit at a time.