Koha-US The Terrific Every-Other-Thursday Training Videos, 11 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: All About Passwords | S3E18

Description

It's no secret! We're sharing our passwords. Er...we're sharing everything we know about how passwords work in Koha, that is. So, if you are looking for ways to tighten up security, and help your forgetful patrons, this video is a must-see.

Contents:
0:00 - Title
0:27 - Intros
2:58 - Intro to Passwords
4:23 - Password Expiration in the Patron Account
6:03 - OpacPasswordChange
7:16 - OpacResetPassword
8:28 - EnableExpiredPasswordReset
8:54 - minPasswordLength
10:20 - RequireStrongPassword
10:55 - Password Notices
12:35 - Patron Category Specific Settings
20:55 - How this All Works
22:40 - OPAC - How a Patron Changes Their Password
25:48 - OPAC - Forgot My Password
29:07 - Resetting a Patron's Password or Changing the Password
38:49 - When a Password Expires
46:36 - Upcoming Feature in 22.11 - Password Changed Notification
48:43 - Koha Still Needs a Forced Reset for First Time Logins
53:53 - Koha Still Needs to Force Different Passwords

Additional Resources:
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33462

Music: https://bensound.com/
Text -to-speech: https://wideo.co/text-to-speech/
Audio Effects: https://zapsplat.com/
Visual Effects: https://flexclip.com/

A

A

My name is George Williams and I'm. The next search catalog coordinator at Northeast, Kansas library system, I'm.

B

Christopher Brandon with the Quarter Lane public library and the Cooperative Information Network.

A

And today we're going to talk about that. You know there's a new feature, fairly new feature in koha that allows you to set an expiration date on passwords, and so we thought we would uh talk about that a little bit and then talk about a whole bunch of other password related things.

A

um The way they relate to the staff client yeah. So it's a lot of stuff to cover, and uh but first before we get into all this. Let's uh uh talk about koha us and uh uh you know we're part of the koha U.S education committee. So let's talk about that for just a minute. This.

C

Video is sponsored by koha us your place to look for all things Cohan, whether you're, just starting out with poha or you've, been with koha for a while koha us is a great place to find resources, learn new tips and techniques or connect with other users and libraries. Koha us provides excellent information, both original and curated from around the internet, including the terrific every other day training. Videos you'll also find several special interest groups to connect with, as well as our general monthly meeting Where We Gather. To talk about the latest Kohan news.

C

You should also check out the koha U.S annual conference held at various locations around the U.S. This is a great opportunity to meet with other users face to face and build your Kohan Network, as well as new friendships and, of course, don't forget about the great presentations koha. Us is also actively involved in the koha community by contributing towards new developments.

C

If you are interested in contributing towards koha U.S funded developments join the koha U.S membership. Your annual membership builds the funds to sponsor new developments in the community and, as a member, you also help shape koha us with your membership votes and receive a discount on the annual conference.

C

You can also contribute towards developments through a direct donation or by purchasing some great koha us merchandise, through our threadless accounts visit us at kohaus.org to find out more.

A

Okay, so Christopher is going to lead most of this because he's got the good notes and he's using a lot of this stuff. So take it away.

B

Yeah so we're going to cover several aspects of passwords um I. You know we're in the midst of looking at passwords ourselves. We've we've left passwords pretty much alone, since we got into uh koha back in 2012, and a lot of features have been added with the passwords yeah since then, and they've made a lot of progress. There's still some work that I I feel like you know, needs to happen, but there's a lot of good progress uh with it.

B

That is allowing us to take another look at it and see what we can do to enhance security, not just for for staff, but for for patrons and uh and so we're going to look at several aspects of that plus, you know we're approaching uh 22 11, which also uh includes uh patrons, gives you the patrons uh or gives us the ability to notify patrons when a password has been changed.

B

So that's going to be a new feature in 2211, but there's a lot to cover with with passwords and so we're going to see what we can accomplish with today's video.

B

So, let's take a look at uh one of our test patrons here in our demo site: uh Brenda Frosty we're going to take a look at just the basics of uh passwords, real quick. So if we scroll down in the account settings I'm under the OPAC staff interface, you know you, the the patron has a username and password section, and so we've always been able to add a password.

B

um What has been uh added fairly recently, it's been around for a little bit is password expiration, so we can expire a patron uh password uh at any point now by putting in a date um so, for example, um well: okay, let's: let's leave it at that for for just a moment before you do anything with passwords. uh Let's look at preferences and let's look at notices because we need to see all the different things that are involved that are available with passwords and right.

B

You also need to look at make sure that our notices are set up as well, so I did a scan for uh the word password and the ones that come to uh mind. First of all, there is an OPAC password change.

B

And so to my understanding, OPAC password change is a preference that allows uh patrons to be able to change their password at will. So if they log into the OPAC they should be able to, uh this will give them the ability to change their password uh whenever they want yeah.

A

I think it's one of the tabs on uh the patrons you know, there's your summary. Your checkouts I think it affects one of those tabs there, whether you see that tab or not, that has the password information in.

B

There right and I don't know a lot about ldap, but um if you have ldap, if you have something external that is managing Patron accounts, you don't want them changing those passwords because they would not sync up or match. So. This is something that you would want to turn off if you're using ldap authentication.

A

Yeah and for the most part, public libraries do not do ldap, authentication, that's more of a School library or College academic, Library, Thing or institutional.

B

Library, so this one should be on for sure just give patrons the the sound mind to be able to change their password when they want um another. Setting, here of note, is the OPAC reset password the library patrons are not allowed or allowed to recover their password via email in OPEC.

B

Now this is uh a little confusing, because it doesn't mean that this is something that is initiated by the OPAC. This has to be turned on if you're going to be able to reset a patreon password in any way, because they need to be able to get to the page that allows them to to reset so.

A

Right if this is said, if this is set to not allowed, then the patrons don't see that forgot your password message again the OPAC, but it also means that staff don't see that that in the more drop down on a Patron's record, they don't see that thing that says, send the patron a password reset email.

B

So I'm going to turn that one on and then let me look at my notes: Here uh enable expired uh password reset, so this is another one we want to turn on. We want to give the ability for patrons to directly reset their password when it is expired. So if this is not enabled, um they'll have to either use the forgot.

B

Your password feature or they'll have to reset they'll have to have staff reset the password so I'm going to enable this one as well, and then there's a couple other settings here uh that you should look at whether or not you should have a minimum length.

B

um I think by default. It's set we'll see. Is it set to three by default? Yeah.

A

I believe it's set to three by default, which is a pretty low barrier, yeah.

B

So I'm going to say eight, so you know this is a good one to look at. You know you know, depending on a library systems, if you know, if you have to have your passwords fulfill, you know a um some sort of uh basic default.

B

um If you're matching you know password last names or first names or something that could possibly be fairly small, then this might uh kind of shackle your hands and how much you can set it. But if you don't have those restrictions, then I would say: hey give it something a little bit more reasonable. You know at least eight characters uh is, is a good start um so.

A

This is um this one and the next one are two that you can change based on the patron category. Yeah.

B

And we'll take a.

A

Look at that! Oh just a second! Yes,.

B

Mostly, you know the global overall uh setting for everybody uh yeah the next one requires strong password. You can uh not, or you can require a strong password uh for staff and patrons must contain at least one digit, one lowercase and one uppercase.

B

um So if you, if you once strong passwords in your system, then this is definitely one to turn on so yeah actually set that so we've got those settings all set I'm going to turn those on.

B

And we should be good on that end. The other thing that we should take a look at is the uh the notices. There are a couple of notices that you should take. A look at one is for the general password reset and the other is the staff password reset both are uh set with default messages.

B

uh You may just leave them the way they are, but if you want to customize these messages, uh you probably should go in there and take a look and and reword things as needed. The two things, the one thing that I noticed the difference of why there are two messages uh is uh that it looks like uh just the password reset in general is limited to two days so when it sends the link that link only works for two days but on the staff, one.

B

That one uh defaults to it looks like five days so so those are pieces that you probably should leave in the messages, uh but otherwise you can customize this as much as you want I mean you don't have to have. You know how long the the link is valid for, but it's always helpful because otherwise you're going to be answering the question. Why doesn't this link work this? This will make it right.

B

You know fairly evident so staff is five days, patreon's only good for two days so important to note all right, so I'm not going to customize anything so I'll just leave. Those ads is.

B

um As George mentioned uh these uh piece, some of these elements can be customized per Patron category.

B

um One thing to note in the patron categories is you can set how long uh before a password expires automatically, so you don't have to set this, but um it's a good idea if you're trying to keep strong security, how long before these passwords expire um standard is 365 days, you know a year, some systems do it every I've had some systems do it half year. I would not do anything less than half a year. In my opinion, you don't want to bug the heck out of your patrons and make them mad.

B

uh We, you know we haven't set this yet we expire Patron accounts every two years so that we have updated information and that's something to to keep in mind too you. You know if you're implementing paid uh account expirations and passwords expirations. How is that going to uh go with with patrons, and is that going to confuse them because you've, you know if you're expiring, a patron account and expiring passwords.

B

That might add a little bit of confusion, because if they just renewed their accounts uh and then they get a a password expiration uh later, that might be a little confusing. That's.

A

Going to be confusing yeah.

D

B

A

What I'll do for my staff is that the staff fix passwords will expire every day.

A

Oh, my you're gonna make they're already mad.

B

At me, because.

A

I make them do like a 12 character password so.

B

So you know, keep keep the password expiration time in mind um and you know it might be because you know password expiration and account. Expirations are handled differently.

B

um Your account expirations generally, their staff involved with renewing those accounts and making sure that information is up to date, at least with our libraries. We we have the patron contact Library, we update, we verify the information, that's in their account, that's important, and then we renew the account and with passwords.

B

You don't have to do that and it can be more in the patrons hands if you set it up right, and so you may want to clarify uh when you're renewing a patron account that you know this is independent of you know password accounts and it may help you figure out. Okay, how often are we expiring passwords versus Patron accounts?

B

um Like I said we we expire, our patreon accounts every two years, simply because we want to make. We don't want to bug the heck out of the patrons with this stuff, but we do want to make sure that the information that we have on the patreon account is updated because patrons, don't always you know when they change their last name or address or whatever they don't always notify every entity that has that information. So you know we have to decide.

B

You know how often we want to make sure that it that it's up to date.

A

I, don't know how many times I've been at the circulation desk and I've said to a patron or your account. We need to update your account. It's been a year since you know whatever or however long since we last checked things and the patreon said: nothing's changed, nothing's changed, nothing's changed and then I'll have them. Look at the screen. They'll go! Oh that's completely wrong!

A

B

A

It's you know it's not necessarily that they that their address hasn't changed. It's just that the person that typed it in the first place got it all wrong. Yeah, it's full of typos, their names, misspelled yep. The address is wrong. The phone number's wrong. You know it's, it's not a bad idea to have patrons re-verify their contact information every now and then exactly.

B

um You know one of the things that I would see beneficial down the road is you know whether or not passwords expire when the account is renewed? You know that that would be a good option, so you know you're you're kind of building it into to be working together. If you want, rather than bugging them separately and having it independent. If you have your accounts expire every two years or every one year, and you think that's a good range, you want to have them reset their password at that time too, um you could.

B

It would be nice if you know, okay, the account's been renewed. It's going to send that you know password expired uh message and have them reset the password at the same time, um and then you could, you could clarify in the reset or maybe have another uh reset message. Your account was recently renewed. We require you to reset your password at this time as well just for security. You know that would be nice if that was kind of automated, so I could see.

B

You know that being beneficial down the road, if they added a feature like that.

D

B

um So moving on there's a couple more settings, a password reset and the OPAC you could have it follow the system preference which we talked about earlier um or you could override whatever that is set at and say it's allowed or not allowed.

B

So this allows them to reset or not not that you know they not that they can do this on the OPAC side, it's whether they can reset at all the other setting is the password change in the OPAC, whether or not they're allowed to change their own password in the OPEC, and so you could uh again set this to follow whatever the system preferences or you can overwrite it and say aloud or not allowed right.

B

You can also uh set what the minimum password length is or whether or not they require a strong password in this in the category as well. Yeah.

A

And that's what we have set at Knuckles is we have the minimum password length for the borrower category staff is set at a higher level than it is for patrons, because patrons just want to be able to easily you know have for most of our libraries. The the patrons password is the last four digit is their phone number, but for staff I wanted something much higher. So that's why our staff has a 12 character. Password, that's complex.

B

So you know so keep in mind. You can set the the default system settings over in the um system preferences, but you can uh refine that down to Patron category in the patreon categories. uh But remember then you know beyond that you do have the ability to change uh the expiration dates at at least the expiration date for the the password in the patron account.

B

um You don't have you don't have all of those settings uh down to the individual Patron, but at least the expiration date. You do have the ability to override that uh at the patron level and keep in mind. You know don't confuse that password expiration with the expiry date for the account itself.

A

B

So all right, let's take a look now that we've we've looked at where you know those three different areas to look at those setups. So we had the system preferences, the uh the patron categories and the notices uh We've looked at those. Let's look at how this works in general. So I, don't know this patrons. Let's see here, there's their username I, don't know what their password is so I'm going to just give it to a general password.

B

um And I did set that one setting. So let's see here.

D

B

Oh, my gosh I can't type today.

A

My advice is to put your uh is to use your Visa card number and let us all know what that is there. We.

B

Go yeah I won't be following your advice. That's.

A

Probably wise, okay.

B

So now I want to go to the OPAC and take a look at it from that aspect.

B

So we're going to go to.

B

Oh I did not want to change that. Let me go back and open a new tab.

A

Now it's demoed, .cohaus.org I, think yeah there. It is I.

B

Don't like to remember urls, okay, so we're going to log into the account see if I can type.

B

Hey on the first try: okay, so we have the one system: preference that allows us to um change the password in the patron account. So with that set I should be able to go to change your.

A

B

That tab's there, because of that setting and I, am allowed to change the password. So let me put in the current password.

B

Something else let me let me put in something you know: I said that you had to do a minimum length. Password of eight and I did a strong password. So let me try breaking real quick.

A

Yeah, if you notice there's a a bar right under where it says, change your password. It says what your password requirements are there.

D

A

So, let's see here.

B

Oh that that'll work- let's see here.

B

Oh I completely ignored, and so it just doesn't do anything. It would be nice if it if it uh change that to Red. If it was wrong. uh Yeah or you know a reminder somewhere, um it doesn't tell me which rule I broke. So it's you know, that's that's a little frustrating normally. If somebody doesn't enter something right, you know with requirements or whatever we we generally have something that pop-ups say required or you know highlights you know.

B

What's what is the reason we do have this here as well as what's up here, but let me go ahead and do it right now.

B

There we go so it has been.

A

Updated I think uh when you get it wrong that text underneath the first tasks appeared, I wasn't paying attention the first time you typed it, but right. Okay,.

B

All right, so you know the P. The patron has successfully uh changed their password, so I'm going to uh log out for a moment, and hopefully I can remember that password and the next thing. The next thing that we're going to to look at. Let me let me um all right, I want to look at now.

B

Let's look at the forgot. The password, so I noticed that I don't have a link here. Is it turned on yeah? So let's look at.

A

I think you need to go back to the system preferences and make sure that it's on.

B

I, don't see anything to specify.

A

I thought um I saw it there, it looked like it was turned on.

B

I have the enable password reset, but here's the forgot, your password.

A

I think you had that system preference up there and I thought it said it was allowed.

A

um I think it's it's a little lower.

B

Pave Trends are not allowed okay, so this is the oh.

A

B

Never said this, so let's say that I thought I had turned that on, but okay, so that is set. Let's refresh the screen. Okay,.

B

So I I am a patron that forgot my password so I'm going to click on this link, and so this is going to require me to enter uh my login, which is that or your email address I'm going to submit it says: you'll receive an email shortly now on our test system, we're not receiving emails. So let me take a look at notices.

A

Yeah, if you go to the notice history, you should see the email there. Okay, so.

B

There's my notices and this link is valid for two days: okay, so I'm going to click on. Let me close this, so I don't get confused there I'm going to click on this link.

B

Good, let's see here, let's open link a new all right. So this is what it looks like so now, I'm I'm, going to put in a new password, see here.

B

And yeah you're right um when I didn't recall the password it put this exact same phrase underneath here and what might be a good idea is if I took some jQuery and made that red, so it stood out yeah, so um so I I'm changing the password. Let's make sure I.

B

Did it right excellent and it doesn't just put me in my account I now have to log in with that password, which is a little different when you change the password when you change it, you've already logged into the account now I have to I have to do it.

B

There we go, I have successfully changed it and logged in all right.

A

So that is well here's a question: okay, yeah! Here's a question! So what? If your library, staff, member and a patron phones in and says, I've forgotten, my password is there a way that you can just send them an email there.

B

Is yeah log out of this go back to the patreon account and you know, if you have the settings turned on. If you go up to more on their account, you can send a password reset, there's a couple ways you can handle this: um the the clunky way in the way I I I- don't like this um I've, never liked this, but you can change the password, but then a staff. Member knows what the password is and if the patron doesn't change it, a staff member continues to know what that password is.

A

You might I, don't know how many times yeah I, don't know how many times I've said to a patreon on the phone. I can change it for you, it's going to be one two, three four five and you should go there right now, log in and change the password to something other than one, two, three, four five, and they never do um so. I, like the the automatic email thing so much, because that way you can put it all in their hands right.

B

And you know this is another thing that that I would like to see uh changed in this aspect. You know, because we have the change uh password button. It would be nice that either there's a you know an act, it's an action button with choices, um or you know you have the password reset within this area. You know it seems like it makes sense to have that all together, rather than here's change password here and the password resets over here that that was a little odd to me. I'd also like to see in the future.

B

You know the preference to either change the password or set a reset or both you know. So we have the the ability to not allow staff to change the password to whatever they can.

A

I think the one thing I can see in our situation at least where the change the password would still be required. Is we still have a lot of patrons that don't have email addresses.

B

Right there is that too, and you.

A

B

I've opened a bug on that one, because um I think that that could be improved down the road because uh with password reset, you have to have an email address right now. It only sends an email. To my knowledge, it.

D

Would be nice if.

B

You had the preference to send it in a link or send a link in a text, or you know to create a code and be able to you know if you have a phone system, maybe to call that their phone number and give them that code, and you know there there might be some issues around the phone aspect of it, but at least give us the option with text would would be helpful because, again, like you said not, everybody has uh email.

B

So you know so there's some things that that can still be improved on there. But yes, having that reset, we uh we can manually reset the or tell the patron to reset their password I'm going to do that now.

B

So I've done that and the one thing that's a little unusual for something like this is when I do hit the reset. It pops me over into the notices, which uh is unexpected, but it's showing me that it sense that notice to them so I think that's why they they pop me over there.

B

um So um now, I can see. There's that notice that went to them- and you can see that it's almost it's identical to the forgot- well not forget, forgot password yeah yeah, the uh the no, not the okay, now I'm confusing myself. uh It's identical to this the past message. It's just a different topic on this. This one says cohab password recovery. So this is the forgot password. This one is a forced, yeah, a password reset, so we can see in the subject the difference and.

A

Right and you can set the subject in the template to, however, you want it and.

B

Let me let me check something here: um I mean we we did see when I typed in password. We have the the password reset.

B

Here's that, on the subject there, okay yeah.

A

Password recovery.

B

um So that goes that goes in line with.

A

B

Password recovery, so that's for, if you forgot the password so did I get I'm wondering if I got this wrong, cancel.

B

So here, oh okay, so I guess that's what it is password reset! Okay, so this doesn't have to do with if it's a patron or a staff member getting reset. If staff member is resetting it for the patron, uh then it goes through this notice. So my confusion there right for confusing everybody on that, but it is interesting that if the staff member, so if you, if you did a forgot password, if you, if the patron did it themselves, they only get two days if the staff resets it they get five days, which is unusual.

A

It's it's weird, yeah I, don't know who I don't know why the development was written that way or the antsman was written that way, but uh so I think in my situation, I have both of those emails set up with a similar name, and you can use template toolkit to put the library into the subject line yeah, because my experience as a patron getting one of these emails doesn't know what Cohan is so I. Have it actually sent an email but says you know, Atchison Public, Library, reset password reset or.

B

Right, yeah and that's that's helpful, so you can tell you at least know who who sent it? Who uh who? What library did it I, don't know if you can, if you can or if you'd want to specify the exact person that reset it, but.

A

um I think that the when you use template toolkit with these, it's gonna send uh based the library name and the template toolkit drags out of the database is going to be the patrons Home Library, regardless of which Library you're at when you send a message.

A

Okay, but it does help patrons a lot to know that it's coming from their Library rather than saying you know, Quahog, because most patrons uh patrons are more likely in my experience, to put that email to call that email, spam yeah. But if it comes from the library where they have their account, they're less likely to put that in the spam. Folder.

B

They're less likely to identify with cohort self, but they are more likely to identify with the with the library yeah um you know, and so you know whether you identify the library and the subject or not um it. You know if I would at least recommend you know they they've they've made distinctive uh differences in the notice subjects, but you know I would probably recommend, at least in the staff reset subject saying a staff member has reset your password so that you can discern the differences a little bit better. That would be my recommendation.

A

Yeah and I think that's what I did on my system. I think the messages are are different: uh I don't have them pulled up right off the top of my head here. Yeah I know that I did make. I did distinguish the two messages. Yeah.

B

Because, right now out of the box, there's they're so similar that it it can get, it can be a little confusing, but between what's what so so. Okay, so I've I've sent that. Let me go ahead and hit that reset and take care of that.

B

So now I've got to come up with to get another.

B

All right and again I'm, not logged in I'll, have to log in after that point, but I have successfully reset that all right. So now we've gone through the aspect of um Patron, changing their password Patron, forgetting their password and a staff member resetting the the password.

B

The last aspect we want to look at is password expiration and I'm, going to look at uh the patron accounts, real quick, so we can't expire. Anything from here we have to expire from within the uh Patron account, which is another thing I think, would be beneficial if it were added uh to change password. You know a couple things. You know this button says change password and I noticed that you can change the username as well, and so the button doesn't really explain that.

B

Well, so um I think that if staff were to think I need to change the the username, they don't know to go to change password. So you can change the the username in here, but it might be beneficial to have that expiration field within this area as well. You know Encompass, all the password you know um possibility. That's.

A

That's a really good idea.

B

So I can go to the patreon account and it's buried in here, and you know I think that would be smart as well, because again somebody May confuse the account expiration with the password expiration date, and you know one does not have anything to do with the other. So I'm, going to put in an expiration date of yesterday.

B

So now the now it's got an expired uh password. Now. One thing to note- and it didn't really note this uh on the reset, because it's not really I mean staff are involved with the reset patrons involved with a forgot, your password, but if we're expiring, the password, it's not noted on checkout screen and on the details. It's only noted by the the password expiration date. It doesn't show that it's expired, which would be.

A

Nice, if it changed colors or something yeah.

B

You know if, if I'm in a patreon account they're standing in front of me, it would be helpful to the patron if I said. Oh just a reminder, your password is expired, um so the next time you log into your account online. Please make sure that you're updating your your password or remember to do that. It's I think that's common courtesy and good customer service. If we were to be able to note that um I think that should be.

B

You know one of those reminders up here on the checkout screen and uh you know, turned red on the details screen I, think that would just be helpful and the library decides whether or not they say anything to the patron. But I think that would be consistent with you know uh whether you know accounts are expired or there's a block on the account. You know we want to. Let them know, there's an issue that will need to be dealt with and right. So now I'm going to go to reset the screen here.

B

I'm going to log into the account.

B

Now again, the difference between a reset and an expiration. The reset sends an email with the link. uh An expired password does not an expired. Password allows the patron to log in with their password as usual, but it will notify you on login, so um I mean I, don't know if I build that in completely. Let's see here, yes, okay, so I've logged in. Oh no I didn't sorry.

D

B

I logged in correctly this time. Okay, now this is a little.

B

This is a little strange and I'd probably make some jQuery changes to this because I don't like this screen um this screams, oh there's something wrong with your account and if you're not look reading it carefully, they don't know. Oh it's just a password reset. This looks like there is an error on the page or something um it says, error your password is expired and then there's a really there there's a link here to reset your password and it's not very.

A

It's a tiny little unobtrusive link.

B

Yes, I think that's what I'm the words I'm looking for. uh It's not very noticeable so I see.

D

A

For the past, for the your password is expired message for the your password is expired message and for the reset your password link it'd be nice to embigen both of those.

B

Yeah and I, wouldn't I, wouldn't say error. You know this looks like something has malfunctioned and I, don't like that at all um you know. I I would want this to be hey it's time, just reset your password or change your password. It's been around for x amount of days, and we require you to change this, uh to keep security tight on your account and then I would make the reset your password a button to make it more yeah.

B

So those are things that I would do on this page, but I have logged in it's telling me it's time to reset my password. So I'll click that, and so it is going to give me more, which is a little different I have to provide the login. You know normally, when I, when I go to accounts and my password has expired, I have to change it. I don't usually have to give a login.

B

This is kind of unusual, usually I, the the more the more um the average reset will ask for the old password and then ask for new passwords. This is a little bit more than usual, odd to me, but I will put in the current password.

B

And then let's do.

B

Go so now I've changed that, and that is one that's not going to send a message again. So there is no template. There is no there's nothing in the notices to show that oh, their password has expired. There's really not a lot of evidence on the staff end that their password is expired and it's time for them to to change it.

B

um It's between the system and the patron only.

A

Here's a crazy question: what if somebody changes my password and I don't know about it,.

B

A

Have a way to send me an email, maybe that says my password was changed.

B

So in 2211 there is going to be a new feature and uh you can refer to bug 25 936.

B

That will add a new feature uh to notify users if their password has changed. This is a a nice courtesy to let uh the patron know that that has been changed um so I would assume that if a staff member has changed it or if somebody has changed it within the account uh either one will trigger it.

B

um I have not read through this bug, but this all this allows uh allows that notification. Let me look at what their their test plans, so you enable the new feature change user's password. So this looks like at least from the staff and check that the notice appears in the patreon.

C

B

Doesn't I don't see multiple tests, for you know if you've changed it on the staff end or the patron side? So that's that's a question for you know when we get into uh 2211 whether that works on all aspects of password, changing or just certain aspects, but this is another step forward in the right direction.

B

But a good question, so you know. For the most part, a lot of progress has been made on on passwords for the patron a lot of good security features. You know some things that I've been pushing for in some bugs. You might find those bugs out there and I. Don't have them uh immediately. I'll, maybe I'll pop up the the bug members here, uh but uh some things that I'm pushing for is, you know we you'll have you'll have to play around with the system a little bit. I would like there to be.

B

A way to you know, create a password initially, but you know for for new accounts uh created on the staff side. Not necessarily you know if you're self-registered, if you're self-registered you are creating a password, you have the ability to create a password right then, and there that's important, but for our system, especially prior to all these changes, we were we're using a default password uh on the staff side of thing. When we, when we create an account, we create a default password so that staff aren't having to do that.

B

So they don't make mistakes on that and you know so. They don't create some complex password that they have to pass on to the the patron somehow so there's a default password.

B

Unfortunately, a lot of patrons may end up, leaving that default password and never changing it, and that's something that we want to get away from, but I would like to be able to get away from those default passwords as soon as possible, but it would be nice if a patron that was created on the staff side if the system realized okay, this is not self-registered. This is a new account that it would automatically uh expire the password right away.

B

So we could have that default password and we would let the patron know what that is, but the first time that they log in it would force them to reset that and there's no way, there's no easy way in koha to do that unless you were to create a new Patron account category and expire that automatically and then move them over to another another Patron category immediately after that, and there's no mechanism for that, another way is Staff would have to create the account and then go and manually change that which I don't want staff to have to do right.

B

I did look to see if I could do something with jQuery on you know on the patreon creation, but unfortunately, when you're creating a patron account for the first time it looks like the patron exploration field doesn't even exist on a new account and I can show that here. So um if I, which is kind of odd, if you ask me um so, if I create a new account and it's not even hidden um if I go down to the patron section, that that's.

A

B

Even there, no it's not, it would have been nice because I could have I could have hacked a way for it to expire. Automatically. I could have detected that this is a new uh setup and I could have forced that. So I don't even have that option at this point, so um that would be helpful down the road if at least the expiration field showed, but if Cohan knew that this was a new account that we would have some sort of setting to say, first-time users uh need to reset their password.

B

It could set that date to today or yesterday or whatever and force the user to change your password. The first time that they've logged in right. So a lot of good, a lot of good features and.

A

I think that there is a bug that somebody else has suggested that it would be nice uh and and I believe there are a lot of other people that would like to see a password that you could set, and then it expires after one day, yeah am I yeah.

D

A

Have the bug number for that right now, though,.

B

Yeah and I'll I'll, you know, if not in the video itself, if I don't show them on on the screen. I'll uh have the additional resources or additional links uh in the koha US page um I'll, see if I can include some of those in there as well. So people can chime in on that.

B

But uh yeah we've made a huge uh Leap Forward in password security for koha, but there are still a few things that would be nice after we got in place that would kind of complete that package, putting all of our password uh resets and expirations in one section, rather than scattered all over the place on the patreon, uh and you know having passwords expire uh if they're created on the staff side for the first time that that would be helpful. So.

A

um The other thing that I would like to see is right now the password expiration, the way I've seen it work. Is you uh you log into koha your passwords expired.

A

You change your password to something new and then two minutes later you can go in and change your password back to what it was before so I'd like there to be wait for it so hard to remember, like the previous four or five passwords and to be able to say you can't use a password that you've used uh in the previous year or in the previous. You know, but you can't use any of the previous five passwords you've already used, I'd like to see something like that. Yeah.

B

That's fairly common, too and I'm glad you mentioned that because yeah, that that is something that came to mind as we were talking. I would like to see that um yeah, you know um we're getting closer to some standards with with uh passwords and security on accounts. You know, I think that it's important that patrons are notified when things have changed in their accounts and we're starting to incorporate some of that which is really good.

A

I think we've covered pretty much everything and every time it's like every uh two minutes, I I seem to freeze up. So all right, so we're about due for another freeze up so.

B

All right: well, we will call it a day and call it a video, and we will see everybody again in two weeks. Yeah.

A

See everybody later.

D