Enable password recovery when using ILS Authentication #3997

oharacj · 2024-10-08T20:30:25Z

Add handling to enable password recovery when using ILS Authentication method

…tion.

…tion. Updated based on the PHP 8.3 test failures.

…tion. Updated based on the PHP 8.3 test failures. When I ran php cbf it made changes to the if statements that caused this failure.

demiankatz

Thanks, @oharacj! See below for a few initial thoughts and questions.

module/VuFind/src/VuFind/Auth/ILSAuthenticator.php

module/VuFind/src/VuFind/Controller/MyResearchController.php

demiankatz · 2024-10-09T11:46:53Z

module/VuFind/src/VuFind/Controller/MyResearchController.php

@@ -2079,9 +2125,12 @@ public function newPasswordAction()
        }
        // Update hash to prevent reusing hash
        $this->getAuthManager()->updateUserVerifyHash($user);
-        // Login
+        if ($followUp = $this->followup()->retrieve('url')) {
+            $newUrl = strstr($followUp, 'Verify', true) . 'Home';


I'm not sure I understand the purpose of this; maybe a comment is in order.

added a comment. Happy to answer any other questions about this or taking ANY suggestions. Image is before this code block.

Thanks, that makes sense, though I'm not sure I understand exactly what $followUpUrl = strstr($followUp, 'Verify', true) . 'Home'; is trying to do. I wonder if it might be better to do something like $followUpUrl = str_contains($followUp, 'Verify') ? $this->url()->fromRoute('home') : $followUp; (so we're using the router instead of string manipulation to pick the destination URL... but maybe I'm misunderstanding which target route is actually desired).

EreMaijala

This should work without an existing VuFind account. My proposal would be to add another ILS driver method for looking up the patron with email address and card number. Since we already have a local implementation that works across ILS systems, our experience is that this allows recovery with any ILS that can do the lookup and update the password. See https://github.com/NatLibFi/NDL-VuFind2/blob/dev/module/Finna/src/Finna/ILS/Driver/KohaRest.php#L747 for our implementation with Koha.

The recovery token data and any other information needed (e.g. target ILS for MultiILS) from the lookup method can be stored in access_token table with a random hash as the id. This hash should be included in the recovery link in the email along.

Since this functionality is somewhat different from internal password recovery, it might make sense to separate the implementation. That's why we chose locally to use different method names etc.

EreMaijala · 2024-10-10T08:20:32Z

module/VuFind/src/VuFind/Auth/ILS.php

+     *
+     * @return bool
+     */
+    public function supportsPasswordRecovery()


This needs a counterpart in MultiILS that supports checking the selected target. For inspiration:

https://github.com/NatLibFi/NDL-VuFind2/blob/dev/themes/finna2/templates/Auth/MultiILS/login.phtml#L64

https://github.com/NatLibFi/NDL-VuFind2/blob/dev/themes/finna2/js/finna-layout.js#L372

https://github.com/NatLibFi/NDL-VuFind2/blob/dev/module/Finna/src/Finna/Auth/ILSFinna.php#L53

My initial work is only supposed to be for the ILS auth. MultiILS is something I'll look at in the future but I'm not sure it's part of the scope of this work. Is this piece a necessity? If so, I can start working on this and I'll resubmit when I have it done. I only have one ILS and I can't really test but I'm happy to look into it.

You could potentially use the Demo driver as a second ILS for testing purposes, if that helps! Let me know if you need more details/help to get that set up.

EreMaijala · 2024-10-10T08:24:20Z

module/VuFind/src/VuFind/Auth/ILS.php

+    {
+        $driver = $this->getCatalog()->getDriver();
+        if (
+            method_exists($driver, 'changePassword')


I'd suggest a new method for updating the password during recovery, since changePassword requires the patron from patronLogin method. Our custom code uses this:
https://github.com/NatLibFi/NDL-VuFind2/blob/dev/module/Finna/src/Finna/ILS/Driver/KohaRest.php#L792

I've updated the code to use a resetPassword method for this. I've added my resetPassword to the SierraRest Driver.

Updated comments, line endings, follow-up edits have been put in abstractbase, explained the redirect.

updated formatting.

added trailing comma to return array

Object-Oriented Programming is a thing.

oharacj · 2024-10-16T15:16:29Z

This should work without an existing VuFind account. My proposal would be to add another ILS driver method for looking up the patron with email address and card number. Since we already have a local implementation that works across ILS systems, our experience is that this allows recovery with any ILS that can do the lookup and update the password. See https://github.com/NatLibFi/NDL-VuFind2/blob/dev/module/Finna/src/Finna/ILS/Driver/KohaRest.php#L747 for our implementation with Koha.

I have an ILS method called getPatronFromUsername which provides this function exactly. It has been added to the SierraRest driver.

The recovery token data and any other information needed (e.g. target ILS for MultiILS) from the lookup method can be stored in access_token table with a random hash as the id. This hash should be included in the recovery link in the email along.

Since this functionality is somewhat different from internal password recovery, it might make sense to separate the implementation. That's why we chose locally to use different method names etc.

I am partially utilising the internal password recovery methods in order to keep from duplicating functionality

demiankatz

Thanks for the progress, @oharacj -- see below for a few more tips, questions and ideas. :-)

demiankatz · 2024-10-17T15:42:36Z

config/vufind/SierraRest.ini

@@ -59,6 +59,9 @@ use_prefixed_ids = false
 ; used (redirect_uri above is not set).
 username_field = "code"
 password_field = "pin"
+; Some library systems use a four digit access pin. Others prefer to have alpha numeric
+; passwords. set digits_only to true for pin functionality. Default is false (alpha-num).
+digits_only = true


There are higher-level password rules defined in config.ini. I wonder if it would be beneficial to make this setting more parallel with those (especially if we could refactor code to make the password validation logic reusable -- I haven't inspected to see how feasible this is, but it seems likely to be an option).

Alternatively, if there are really only two different options in Sierra, maybe it would be more clear to call this setting four_digit_pin (to account for both the length restriction and the content restriction), or to have a setting like password_mode = pin|password (if we want to allow for more possibilities in the future than a binary setting can provide.

Just checking to see if you have any thoughts on this point, since there hasn't been further discussion on it since October. (Also happy to hear @EreMaijala's thoughts, if any).

I think we should use the same rules as when changing a password, i.e. the [changePassword] section in ILS driver's ini:

; Uncomment the following lines to enable password (PIN) change ;[changePassword] ; PIN change parameters. The default limits are taken from the interface documentation. ;minLength = 4 ;maxLength = 4 ; See the password_pattern/password_hint settings in the [Authentication] section ; of config.ini for notes on these settings. When set here, these will override the ; config.ini defaults when Sierra is used for authentication. ;pattern = "numeric" ;hint = "Your optional custom hint can go here."

I'm still not sure how I've managed to miss this section of the ini so many times. I had to have looked over it hundreds of times without seeing that there was a [changePassword] section. I'll remove the custom stuff I did but I'll also have to make a change to the changePassword function in the SierraRest driver in order to remove the hard-coded digits only section of password change.

demiankatz · 2024-10-17T15:43:25Z

module/VuFind/src/VuFind/Auth/ILS.php

+     *
+     * @return bool
+     */
+    public function supportsPasswordRecovery()


You could potentially use the Demo driver as a second ILS for testing purposes, if that helps! Let me know if you need more details/help to get that set up.

module/VuFind/src/VuFind/ILS/Driver/SierraRest.php

module/VuFind/src/VuFind/Controller/MyResearchController.php

demiankatz · 2024-10-17T15:49:31Z

module/VuFind/src/VuFind/Auth/ILSAuthenticator.php

@@ -309,11 +309,12 @@ public function getStoredCatalogCredentials()
     * fails, clear the user's stored credentials so they can enter new, corrected
     * ones.
     *
-     * Returns associative array of patron data on success, false on failure.
+     * @param $user_name - the username/barcode for ILS password reset


Minor points of style: I'd suggest $username or $userName instead of $user_name -- we rarely use snake_case in our code, so the other options would be more consistent. Also, you don't need the "-" separator in this comment.

demiankatz · 2024-10-17T16:00:56Z

module/VuFind/src/VuFind/Controller/MyResearchController.php

@@ -2079,9 +2125,12 @@ public function newPasswordAction()
        }
        // Update hash to prevent reusing hash
        $this->getAuthManager()->updateUserVerifyHash($user);
-        // Login
+        if ($followUp = $this->followup()->retrieve('url')) {
+            $newUrl = strstr($followUp, 'Verify', true) . 'Home';


Thanks, that makes sense, though I'm not sure I understand exactly what $followUpUrl = strstr($followUp, 'Verify', true) . 'Home'; is trying to do. I wonder if it might be better to do something like $followUpUrl = str_contains($followUp, 'Verify') ? $this->url()->fromRoute('home') : $followUp; (so we're using the router instead of string manipulation to pick the destination URL... but maybe I'm misunderstanding which target route is actually desired).

demiankatz

Thanks for the ongoing work, @oharacj -- I started my review this morning but ran into some questions that I think will be resolved by merging the dev branch into this PR, so I decided to stop until that's done to be sure I'm reviewing everything in an up-to-date and working state. Please let me know if you run into any trouble with this!

demiankatz · 2024-12-13T13:51:50Z

config/vufind/SierraRest.ini

@@ -59,6 +59,9 @@ use_prefixed_ids = false
 ; used (redirect_uri above is not set).
 username_field = "code"
 password_field = "pin"
+; Some library systems use a four digit access pin. Others prefer to have alpha numeric
+; passwords. set digits_only to true for pin functionality. Default is false (alpha-num).
+digits_only = true


Just checking to see if you have any thoughts on this point, since there hasn't been further discussion on it since October. (Also happy to hear @EreMaijala's thoughts, if any).

module/VuFind/src/VuFind/Auth/ILSAuthenticator.php

demiankatz

I didn't have time for a full review yet, but I noticed one thing that looks like a problem and had a couple of very minor style suggestions that you can apply by just committing my suggestions from within the comments below. :-)

demiankatz · 2025-01-02T12:33:09Z

module/VuFind/src/VuFind/Controller/MyResearchController.php

        if (!empty($method)) {
-            $this->getAuthManager()->setAuthMethod($method);
-        }
+        }    $this->getAuthManager()->setAuthMethod($method);


There seems to be a formatting problem here -- did this brace get moved up a line somehow?

demiankatz · 2025-01-02T12:33:43Z

module/VuFind/src/VuFind/Controller/MyResearchController.php

+            //This exists because the followupURL gets set to Verify which returns
+            //an error message due to trying to check the hash a second time


Minor style suggestion -- add spaces after //:

Suggested change

//This exists because the followupURL gets set to Verify which returns

//an error message due to trying to check the hash a second time

// This exists because the followupURL gets set to Verify which returns

// an error message due to trying to check the hash a second time

demiankatz · 2025-01-02T12:37:49Z

themes/bootstrap5/templates/myresearch/newpassword.phtml

+        <?php if (!empty($this->target)): ?>
+            <input type="hidden" value="<?=$this->escapeHtmlAttr($this->target) ?>" name="target">
+        <?php endif; ?>


This seems to have some extra indentation:

Suggested change

<?php if (!empty($this->target)): ?>

<input type="hidden" value="<?=$this->escapeHtmlAttr($this->target) ?>" name="target">

<?php endif; ?>

<?php if (!empty($this->target)): ?>

<input type="hidden" value="<?=$this->escapeHtmlAttr($this->target) ?>" name="target">

<?php endif; ?>

oharacj added 4 commits October 8, 2024 14:24

Initial changes to enable password recovery when using ILS Authentica…

fa64c72

…tion.

Initial changes to enable password recovery when using ILS Authentica…

e80e27b

…tion. Updated based on the PHP 8.3 test failures.

Initial changes to enable password recovery when using ILS Authentica…

a06804d

…tion. Updated based on the PHP 8.3 test failures. When I ran php cbf it made changes to the if statements that caused this failure.

Remove the return clause in setFollowupUrlToReferer method.

6afdc74

demiankatz requested changes Oct 9, 2024

View reviewed changes

EreMaijala requested changes Oct 10, 2024

View reviewed changes

oharacj added 5 commits October 15, 2024 13:52

Updated based on Demian's comments

e61daf3

Updated comments, line endings, follow-up edits have been put in abstractbase, explained the redirect.

Add getPatronFromUsername to SierraRest driver.

95926c5

Add getPatronFromUsername to SierraRest driver.

f4e32f2

updated formatting.

Add getPatronFromUsername to SierraRest driver.

e977b33

added trailing comma to return array

Add getPatronFromUsername to SierraRest driver.

03bff51

Object-Oriented Programming is a thing.

demiankatz requested changes Oct 17, 2024

View reviewed changes

oharacj added 8 commits December 11, 2024 12:57

Multi-ILS Driver work and bug fixes

58a2f2f

Fixed some encoding and comment issues

9a8defa

removed comment block in .js file

f731cde

added displayILSPasswordRecoveryLink to the top exported comment

a85a525

PHP 8.3 updates and space fixes

fd7d5a7

PHP 8.3 updates and space fixes

44d8456

PHP 8.3 double quotes in template

9800f5b

PHP 8.3 double quotes in template

4183693

oharacj requested review from demiankatz and EreMaijala December 12, 2024 15:58

demiankatz requested changes Dec 13, 2024

View reviewed changes

oharacj added 3 commits December 23, 2024 12:15

Merge branch 'dev' into ilsPasswordRecovery

072d3fb

Remove hard-coded pin length in changePassword function

11e26a4

Update settings file to remove redundant setting.

475f222

oharacj requested a review from demiankatz December 30, 2024 15:43

demiankatz requested changes Jan 2, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable password recovery when using ILS Authentication #3997

Enable password recovery when using ILS Authentication #3997

oharacj commented Oct 8, 2024

demiankatz left a comment

demiankatz Oct 9, 2024

oharacj Oct 15, 2024

demiankatz Oct 17, 2024

EreMaijala left a comment

EreMaijala Oct 10, 2024

oharacj Oct 16, 2024

demiankatz Oct 17, 2024

EreMaijala Oct 10, 2024

oharacj Oct 16, 2024

oharacj commented Oct 16, 2024

demiankatz left a comment

demiankatz Oct 17, 2024

demiankatz Dec 13, 2024

EreMaijala Dec 16, 2024 •

edited

Loading

oharacj Dec 23, 2024

demiankatz Oct 17, 2024

demiankatz Oct 17, 2024

demiankatz Oct 17, 2024

demiankatz left a comment

demiankatz Dec 13, 2024

demiankatz left a comment

demiankatz Jan 2, 2025

demiankatz Jan 2, 2025

demiankatz Jan 2, 2025

		//This exists because the followupURL gets set to Verify which returns
		//an error message due to trying to check the hash a second time

Enable password recovery when using ILS Authentication #3997

Are you sure you want to change the base?

Enable password recovery when using ILS Authentication #3997

Conversation

oharacj commented Oct 8, 2024

demiankatz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

EreMaijala left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oharacj commented Oct 16, 2024

demiankatz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

EreMaijala Dec 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

demiankatz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

demiankatz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

EreMaijala Dec 16, 2024 •

edited

Loading