Logins not honoring all org unit timeout settings

[Michele Morgan]

Evergreen 2.11, 2.12

We're seeing that all staff logins appear to be using the auth.staff_timeout ou setting at the top of the org tree, rather than the timeouts set further down the tree. I suspect this is also true for other login types.

For example, CONS has an auth.staff_timeout set at 14400 (4 hrs), BR1 has the timeout set at 28800 (8 hrs).

When a user with home library BR1 logs in at BR1, they are getting a timeout of 4 hours when they should be getting 8 hours.

Here are some log entries from a test system:

User 238 has home library of BR1.

open-ils.auth_internal 2017-05-22 12:43:21 [INFO:22563:osrf_application.c:1070:149501670853645] CALL: open-ils.auth_internal open-ils.auth_internal.session.create {"user_id":238,"org_unit":0,"login_type":"staff","workstation":"BR1-MIchele"}
open-ils.auth_internal 2017-05-22 13:02:53 [INFO:22563:osrf_application.c:1070:1495016708537019] CALL: open-ils.auth_internal open-ils.auth_internal.session.create {"user_id":238,"org_unit":0,"login_type":"staff","workstation":"BR1-MIchele"}

No matter what user logs in, staff, opac, etc., log entries always report: "org_unit":0. I have not verified that login types other than staff get the setting at the top of the tree, but we are definitely seeing it for staff logins on our production system (2.11).

[Bill Erickson (berick)]

Fix pushed:

http://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/berick/lp1693035-auth-org-settings-global

This patch solidifies the precedence order for OUS lookups during login like so:

1. Workstation org unit.
2. API org unit value.
3. Users' home org unit.

Note that this does not affect which org unit is used for permissions or for applying a ws_ou value to the user when no workstation is provided. Those are consistent w/ previous behavior.

[Galen Charlton (gmc)]

Tested and signed off with a minor tweak. Branch is user/gmcharlt/lp1724915_signoff

[Galen Charlton (gmc)]

^ Whoops, ignore that. Wrong bug.

[Michele Morgan (mmorgan)]

Thanks Bill! This works for me! Tested this fix as follows:

Set auth.staff_timeout for CONS at 30 seconds

Logged in at BR1 - login timed out at 30 seconds

Set auth.staff_timeout for BR1 at 15 seconds

Logged in at BR1 - login timed out at 15 seconds

Set auth.staff_timeout for CONS at 15 seconds and auth.staff_timeout for BR1 at 30 seconds

Logged in at BR1 - login timed out at 30 seconds

Also did similar testing for auth.opac_timeout and those timeouts also obeyed the timeouts according to the org unit hierarchy.

My signoff branch is at:

http://git.evergreen-ils.org/?p=working/Evergreen.git;a=shortlog;h=refs/heads/user/mmorgan/lp1693035-auth-org-settings-global-signoff

[Galen Charlton (gmc)]

Pushed to master, rel_3_1, and rel_3_0. Thanks, Bill and Michele!