David Cook
a8a356404c
This patch adds an endpoint for /auth/password/validation This allows a third-party, using an authenticated and authorized Koha API user, to check if the username and password given by a user is correct in Koha. For example, a Keycloak extension can be created using its User Storage SPI to use Koha as the user database for Keycloak. This API allows us to authenticate the user as a particular Koha user - without creating a Koha user session for them. Test plan: 0. Apply patch and koha-plack --restart kohadev 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=RESTBasicAuth 2. Enable "RESTBasicAuth" 3. Run the following commands while substituting correct values for <koha_user> and <koha_password> 3. curl -XPOST -H "Content-Type: application/json" -u <koha_user>:<koha_password> http://localhost:8081/api/v1/auth/password/validation -d '{ "username": "<koha_username">, "password": "<koha_password>" }' -v 4. Note "204 No Content" response 5. curl -XPOST -H "Content-Type: application/json" -u <koha_user>:<koha_password> http://localhost:8081/api/v1/auth/password/validation -d '{ "username": "<koha_username">, "password": "this is definitely not the password" }' -v 6. Note "400 Bad Request" response and error message {"error":"Validation failed"} Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> |
||
|---|---|---|
| .. | ||
| acquisitions_baskets.yaml | ||
| acquisitions_funds.yaml | ||
| acquisitions_orders.yaml | ||
| acquisitions_vendors.yaml | ||
| advancededitormacros.yaml | ||
| article_requests.yaml | ||
| auth.yaml | ||
| biblios.yaml | ||
| biblios_item_groups.yaml | ||
| cash_registers.yaml | ||
| checkouts.yaml | ||
| circulation-rules.yaml | ||
| cities.yaml | ||
| clubs.yaml | ||
| config_smtp_servers.yaml | ||
| erm_agreements.yaml | ||
| erm_documents.yaml | ||
| erm_eholdings_packages.yaml | ||
| erm_eholdings_packages_resources.yaml | ||
| erm_eholdings_resources.yaml | ||
| erm_eholdings_titles.yaml | ||
| erm_eholdings_titles_resources.yaml | ||
| erm_licenses.yaml | ||
| erm_users.yaml | ||
| holds.yaml | ||
| ill_backends.yaml | ||
| illrequests.yaml | ||
| import_batch_profiles.yaml | ||
| import_batches.yaml | ||
| items.yaml | ||
| jobs.yaml | ||
| libraries.yaml | ||
| oauth.yaml | ||
| patrons.yaml | ||
| patrons_account.yaml | ||
| patrons_extended_attributes.yaml | ||
| patrons_holds.yaml | ||
| patrons_password.yaml | ||
| public_oauth.yaml | ||
| public_patrons.yaml | ||
| quotes.yaml | ||
| return_claims.yaml | ||
| rotas.yaml | ||
| search_filters.yaml | ||
| suggestions.yaml | ||
| transfer_limits.yaml | ||