I've ran several tests with basic http authentication in koha, and here's what I found: When using basic http authentication at OPAC, if the loggedin username does not match a valid koha user, that leads to a session with borrowernumber 0. When using basic http authentication at Intranet, if the loggedin username does not match a valid koha user, that also leads to a session with borrowernumber 0. At the top-right of the screen, I can see "insecure" in bold black. However, my "insecure" syspref is set to 0. Is this behavior normal? Steps to reproduce: To use basic http authentication at OPAC, create a .htaccess and a .htpasswd file in the 'opac' directory. To use basic http authentication at Intranet, create a .htaccess and a .htpasswd file at the root of the source directory (don't forget to backup the existing .htaccess) In order to easily generate .htaccess and .htpasswd, you can use the following tools: http://www.htaccesstools.com/htaccess-authentication/ http://www.htaccesstools.com/htpasswd-generator/
Is anyone using http basic auth with koha in the wild I wonder? I'm trying to go through old auth bugs and work out if they're still relevant... Matthias, any comments regarding the current state of this?
(In reply to Martin Renvoize from comment #1) > Is anyone using http basic auth with koha in the wild I wonder? > > I'm trying to go through old auth bugs and work out if they're still > relevant... Matthias, any comments regarding the current state of this? I remember someone asking about it a while back on IRC, but it certainly lacks documentation.
(In reply to Martin Renvoize from comment #1) > Is anyone using http basic auth with koha in the wild I wonder? > > I'm trying to go through old auth bugs and work out if they're still > relevant... Matthias, any comments regarding the current state of this? I'm also curious about this. Do people really use this anymore?
This doesn't sound like a bug, more like a documentation request. Do we have any idea about this one?