https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43334
Bug ID: 43334
Summary: Implement OIDC Third-Party Initiated Login endpoint
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: enhancement
Priority: P5 - low
Component: Authentication
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected]
Depends on: 42719
Target Milestone: ---
Bug 42719 fixes the immediate 500 crash when an IdP initiates login without an
existing session. However, the current approach silently creates a session and
proceeds, which is susceptible to login CSRF (an attacker could craft a link
that initiates login on behalf of the user).
The OIDC spec defines a proper Third-Party Initiated Login flow:
https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin
Proposed implementation:
1. New endpoint: GET /api/v1/public/oauth/initiate-login
Parameters (per spec):
- iss (required): issuer identifier, must match a configured provider
- login_hint (optional): hint about which user to authenticate
- target_link_uri (optional): where to redirect after login
2. The endpoint:
- Validates iss against configured OAuth providers in koha-conf.xml
- Returns 400 if iss does not match any known provider
- Renders a confirmation page: 'Provider X is requesting login. Proceed?'
- On confirmation, redirects to the existing
/api/v1/public/oauth/login/{provider}/{interface} flow
3. This defeats login CSRF because:
- User interaction is required before the OAuth dance begins
- The session and CSRF state are only created after user consent
The existing Mojolicious::Plugin::OAuth2 flow remains unchanged. This endpoint
sits in front of it, resolving iss to a provider name and gating on user
confirmation.
The session-creation logic from bug 42719 remains useful: after user confirms,
the login endpoint may still need to create a session if none exists.
Libraries using Okta (or similar IdPs) would configure the initiate_login_uri
in their IdP app settings to point to this endpoint.
Referenced Bugs:
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42719
[Bug 42719] OAuth/OIDC login crashes with 500 when no CGISESSID cookie exists
(IdP-initiated flow)
--
You are receiving this mail because:
You are the assignee for the bug.
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
