Bug 41750 - ForcePasswordResetWhenSetByStaff prohibits login via CAS
Summary: ForcePasswordResetWhenSetByStaff prohibits login via CAS
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-02-02 13:06 UTC by Katrin Fischer
Modified: 2026-02-02 13:07 UTC (History)
2 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2026-02-02 13:06:54 UTC
When ForcePasswordResetWhenSetByStaff is set to "enforce" and staff adds creates a new patron account, login by CAS is impossible.

It took us a while to figure this out, since it just "won't work" without any helpful error message.

I think there are different ways this could be handled.

We could not check the password expiration date if a user authenticates through another external system (LDAP, CAS, OAuth2), since they cannot change the password then.

The smallest solution might be warning on the pref, to not enable this for patron categories that use external authentication.

I think in general it would be nicer to allow external authentication and still enforce if local login is used - there might be cases where both are the same patron category now and this would keep things more flexible.