Koha-community/Koha - Koha - Koha: The world's first free and open source library system

Author	SHA1	Message	Date
Tomás Cohen Arazi	3816a57abc	Bug 28772: Make secret validation use the new method This patch makes the Koha::OAuth library use the new validation method To test: 1. In master, enable RESTOAuth2ClientCredentials and have your superlibrarian patron a client_id/secret pair generated 2. Use Postman to gain an access token with the client_id/secret pair => SUCCESS: This works in Koha 3. Use the access token to GET /api/v1/patrons => SUCCESS: It works 4. Apply this patchset up to the regression tests 5. Run: $ updatedatabase $ koha-plack --restart kohadev => SUCCESS: All good 6. Repeat 2 => FAIL: You get an error trying to acquire an access token. Boo 7. Run: $ kshell k$ prove t/db_dependent/api/v1/oauth.t => FAIL: Tests fail! 8. Apply this patch 9. Run: $ koha-plack --restart kohadev $ kshell k$ prove t/db_dependent/api/v1/oauth.t => SUCCESS: Tests pass! 10. Repeat 2 => SUCCESS: Your original client_id/secret pair works! 11. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	3 years ago
Jonathan Druart	7d8b96803f	Bug 24545: Fix license statements Bug 9978 should have fixed them all, but some were missing. We want all the license statements part of Koha to be identical, and using the GPLv3 statement. Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>	4 years ago
Tomás Cohen Arazi	0d96a9080d	Bug 20612: (QA follow-up) Fix typo in method POD As Martin correctly highlighted, the method name is not correctly spelled in POD. This patch fixes it. To test: - Look carefully => FAIL: Method name is _verify_client_cb but POD says _verify_client_db - Apply this patch - Look carefully => SUCCESS: Notice the POD is fixed! Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Tomás Cohen Arazi	5bf71bb837	Bug 20612: Make OAuth2 use patron's client_id/secret pairs This patch wires the OAuth related code so it leverages on the new Koha::ApiKey(s) classes and tools introduced by bug 20568 instead of the hardcoded entries in koha-conf.xml originally proposed by bug 20402. To test revisit the test plan for bug 20402, and verify that it works. But create API key pairs instead of writing them down in koha-conf.xml. Also: - Run: $ prove t/db_dependent/api/v1/oauth.t => SUCCESS: Tests pass! - Sign off :-D Sponsored-by: ByWater Solutions Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Signed-off-by: Benjamin Rokseth <benjamin.rokseth@deichman.no> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Tomás Cohen Arazi	3ada121431	Bug 20402: Add missing POD Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago
Julian Maurice	43a4b3c22c	Bug 20402: Implement OAuth2 authentication for REST API It implements only the "client credentials" flow with no scopes support. API clients are tied to an existing patron and have the same permissions as the patron they are tied to. API Clients are defined in $KOHA_CONF. Test plan: 0. Install Net::OAuth2::AuthorizationServer 0.16 1. In $KOHA_CONF, add an <api_client> element under <config>: <api_client> <client_id>$CLIENT_ID</client_id> <client_secret>$CLIENT_SECRET</client_secret> <patron_id>X</patron_id> <!-- X is an existing borrowernumber --> </api_client> 2. Apply patch, run updatedatabase.pl and reload starman 3. Install Firefox extension RESTer [1] 4. In RESTer, go to "Authorization" tab and create a new OAuth2 configuration: - OAuth flow: Client credentials - Access Token Request Method: POST - Access Token Request Endpoint: http://$KOHA_URL/api/v1/oauth/token - Access Token Request Client Authentication: Credentials in request body - Client ID: $CLIENT_ID - Client Secret: $CLIENT_SECRET 5. Click on the newly created configuration to generate a new token (which will be valid only for an hour) 6. In RESTer, set HTTP method to GET and url to http://$KOHA_URL/api/v1/patrons then click on SEND If patron X has permission 'borrowers', it should return 200 OK with the list of patrons Otherwise it should return 403 with the list of required permissions (Please test both cases) 7. Wait an hour (or run the following SQL query: UPDATE oauth_access_tokens SET expires = 0) and repeat step 6. You should have a 403 Forbidden status, and the token must have been removed from the database. 8. Create a bunch of tokens using RESTer, make some of them expires using the previous SQL query, and run the following command: misc/cronjobs/cleanup_database.pl --oauth-tokens Verify that expired tokens were removed, and that the others are still there 9. prove t/db_dependent/api/v1/oauth.t [1] https://addons.mozilla.org/en-US/firefox/addon/rester/ Signed-off-by: Josef Moravec <josef.moravec@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>	6 years ago