Bug 8039 - Self Checkout/SIP: Allow authentication with userid and password
Summary: Self Checkout/SIP: Allow authentication with userid and password
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: SIP2 (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Srdjan Jankovic
QA Contact: Paul Poulain
URL:
Keywords:
: 9109 (view as bug list)
Depends on:
Blocks:
 
Reported: 2012-05-02 08:09 UTC by Katrin Fischer
Modified: 2013-05-23 06:24 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
patch (864 bytes, patch)
2012-05-25 02:43 UTC, Srdjan Jankovic
Details | Diff | Splinter Review
bug_8039: Try userid if cardnumber borrower search fails in SIP (1.20 KB, patch)
2012-05-30 01:51 UTC, Srdjan Jankovic
Details | Diff | Splinter Review
bug_8039: Try userid if cardnumber borrower search fails in SIP (1.20 KB, patch)
2012-07-23 08:05 UTC, Chris Cormack
Details | Diff | Splinter Review
bug_8039: Try userid if cardnumber borrower search fails in SIP (1.29 KB, patch)
2012-11-09 16:14 UTC, Kyle M Hall
Details | Diff | Splinter Review
bug_8039: Try userid if cardnumber borrower search fails in SIP (1.30 KB, patch)
2012-12-10 20:21 UTC, Paul Poulain
Details | Diff | Splinter Review
Bug 8039 follow-up replace tabs by 4 spaces (QA process) (12.38 KB, patch)
2012-12-10 20:21 UTC, Paul Poulain
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2012-05-02 08:09:47 UTC
Currently only cardnumber + password can be used to authenticate via SIP.

This is ok for self check stations where you scan the patron card, but can be a problem if you want to use SIP2 for authentication with other services.

If the username does not exist as cardnumber in the system, the userid field should be checked next.
Comment 1 Srdjan Jankovic 2012-05-25 02:43:58 UTC Comment hidden (obsolete)
Comment 2 Srdjan Jankovic 2012-05-25 02:54:24 UTC
This is a quick fix, it is not terribly efficient, uses 2 database lookups instead of 1. If that's a problem it can be dealt with later.
Also there is a potential issue with overlapping card number/user id for different users, but that should be highly unlikely.
Comment 3 Srdjan Jankovic 2012-05-30 01:51:03 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2012-07-23 08:05:18 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2012-07-23 08:05:52 UTC
Patch rebased, it is a catalyst patch so I dont want to sign off.
Comment 6 Kyle M Hall 2012-11-09 16:14:36 UTC Comment hidden (obsolete)
Comment 7 Kyle M Hall 2012-11-09 16:24:53 UTC
I signed off on this patch because if works. However, I'm wondering if this should be configurable ( username, barcode, or both ).

Here is my specific example, and a shameless plug. I'm the author of Libki, a kiosk management system. It supports SIP2 for user authentication. When a patron attempts to log in, Libki makes a SIP request for the user, if it comes back positive, it creates the account in Libki ( if it didn't already exists ). Each patron has an allotment of minutes they can use per day.

With this patch, a clever person may realize he or she can login twice, once with his or her cardnumber, and once with his or her user id ( assuming they are not one and the same ).

I think it would be good to make this a setting in SIPconfig.xml. That way, a library could run multiple instances of the SIP server with different settings. One could be for cardnumber/userid ( for sip2 SCO ) and another could be for userid only ( perhaps for Libki ).
Comment 8 Chris Cormack 2012-11-10 05:34:41 UTC
SIP2 will return the unique identifier (borrowernumber), so you could make Libki not make 2 users if the user already exists.

Since they can't actually login to Koha twice, it might be better to fix it on the Libki side, since other systems may well allow this too, and I assume Libki is designed to work with multiple ILSes?
Comment 9 Kyle M Hall 2012-11-12 13:06:09 UTC
I hadn't thought of that. That is a good solution, and I hereby withdraw my caveat!

(In reply to comment #8)
> SIP2 will return the unique identifier (borrowernumber), so you could make
> Libki not make 2 users if the user already exists.
> 
> Since they can't actually login to Koha twice, it might be better to fix it
> on the Libki side, since other systems may well allow this too, and I assume
> Libki is designed to work with multiple ILSes?
Comment 10 Katrin Fischer 2012-11-20 10:03:50 UTC
*** Bug 9109 has been marked as a duplicate of this bug. ***
Comment 11 Paul Poulain 2012-12-10 20:21:17 UTC
Created attachment 13981 [details] [review]
bug_8039: Try userid if cardnumber borrower search fails in SIP

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Paul Poulain <paul.poulain@biblibre.com>
Comment 12 Paul Poulain 2012-12-10 20:21:57 UTC
Created attachment 13982 [details] [review]
Bug 8039 follow-up replace tabs by 4 spaces (QA process)
Comment 13 Paul Poulain 2012-12-10 20:22:16 UTC
QA comment:
 * not an enhancement I think, but a normal bugfix I think
 * tiny patch, nothing specific to say about it
 * passes koha-qa.pl, except for tab as indent marker, but this file has many, I add a follow-up with s/tab/4spaces/g

passed QA
Comment 14 Jared Camins-Esakov 2012-12-13 15:41:37 UTC
This patch has been pushed to master. I do not have an actual self-check machine, so I would be grateful if someone who does have one would test now that these patches have been pushed.