Bug 8785 - Basic authentication troubleshootings
Summary: Basic authentication troubleshootings
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Galen Charlton
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-18 13:26 UTC by Matthias Meusburger
Modified: 2023-07-29 13:00 UTC (History)
4 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Meusburger 2012-09-18 13:26:28 UTC
I've ran several tests with basic http authentication in koha, and here's what I found:

When using basic http authentication at OPAC, if the loggedin username does not match a valid koha user, that leads to a session with borrowernumber 0.

When using basic http authentication at Intranet, if the loggedin username does not match a valid koha user, that also leads to a session with borrowernumber 0. 
At the top-right of the screen, I can see "insecure" in bold black. However, my "insecure" syspref is set to 0.

Is this behavior normal?

Steps to reproduce:

To use basic http authentication at OPAC, create a .htaccess and a .htpasswd file in the 'opac' directory.

To use basic http authentication at Intranet, create a .htaccess and a .htpasswd file at the root of the source directory (don't forget to backup the existing .htaccess)

In order to easily generate .htaccess and .htpasswd, you can use the following tools:

http://www.htaccesstools.com/htaccess-authentication/
http://www.htaccesstools.com/htpasswd-generator/
Comment 1 Martin Renvoize (ashimema) 2014-12-30 18:44:41 UTC
Is anyone using http basic auth with koha in the wild I wonder?

I'm trying to go through old auth bugs and work out if they're still relevant... Matthias, any comments regarding the current state of this?
Comment 2 Katrin Fischer 2019-04-28 11:51:02 UTC
(In reply to Martin Renvoize from comment #1)
> Is anyone using http basic auth with koha in the wild I wonder?
> 
> I'm trying to go through old auth bugs and work out if they're still
> relevant... Matthias, any comments regarding the current state of this?

I remember someone asking about it a while back on IRC, but it certainly lacks documentation.
Comment 3 David Cook 2022-08-22 01:33:48 UTC
(In reply to Martin Renvoize from comment #1)
> Is anyone using http basic auth with koha in the wild I wonder?
> 
> I'm trying to go through old auth bugs and work out if they're still
> relevant... Matthias, any comments regarding the current state of this?

I'm also curious about this. Do people really use this anymore?
Comment 4 Katrin Fischer 2023-07-29 13:00:33 UTC
This doesn't sound like a bug, more like a documentation request. Do we have any idea about this one?