Define main goals of this app #1

New issue

Open

opened 2021-12-01 20:42:44 +01:00 by hansegucker · 8 comments

hansegucker commented

2021-12-01 20:42:44 +01:00

(Migrated from edugit.org)

This app should ...

manage analog student ID cards with either RFID or barcode identification, so with a unique number
track the status of student ID cards (activated/deactivated, valid until)
generate PDF files for printing new cards (with custom layouts)
provide a process for reviewing photos for cards (students upload photos, school administration checks them) (related to AlekSIS/official/AlekSIS-Core#560)
manage card printers (status, sending print jobs)
provide API methods for other apps to get a person from an ID
provide an interface for getting to a person/card by "scanning" the ID

Additionally, we need to implement a workflow like this:

A person triggers the print of a new card in the AlekSIS frontend.
A dedicated print server/script on a client machine fetches the print job.
The client communicates with the card printer to transport the card over the RFID reader.
The RFID number is read by the client and send to the AlekSIS instance.
The AlekSIS instance saves the number together with the new card instance.
AlekSIS also generates the PDF file with the print layout and returns a access URL.
The client downloads the file from the access URL and send it to the printer.

This should be used as a discussion base, but should be completed within a next week. So, everyone who wants to contribute ideas should do this until 2021-12-07.

**This app should ...** - manage analog student ID cards with either RFID or barcode identification, so with a unique number - track the status of student ID cards (activated/deactivated, valid until) - generate PDF files for printing new cards (with custom layouts) - provide a process for reviewing photos for cards (students upload photos, school administration checks them) (related to AlekSIS/official/AlekSIS-Core#560) - manage card printers (status, sending print jobs) - provide API methods for other apps to get a person from an ID - provide an interface for getting to a person/card by "scanning" the ID Additionally, we need to implement a workflow like this: 1. A person triggers the print of a new card in the AlekSIS frontend. 2. A dedicated print server/script on a client machine fetches the print job. 3. The client communicates with the card printer to transport the card over the RFID reader. 4. The RFID number is read by the client and send to the AlekSIS instance. 5. The AlekSIS instance saves the number together with the new card instance. 6. AlekSIS also generates the PDF file with the print layout and returns a access URL. 7. The client downloads the file from the access URL and send it to the printer. **This should be used as a discussion base, but should be completed within a next week. So, everyone who wants to contribute ideas should do this until 2021-12-07.**

ZugBahnHof commented

2021-12-01 21:27:40 +01:00

(Migrated from edugit.org)

I think it would be a possibility to just take the users profile picture (the idea of validation is important there as well I think)

hansegucker commented

2021-12-01 21:34:45 +01:00

(Migrated from edugit.org)

That was the way I actual meant it.

nik commented

2021-12-09 13:52:24 +01:00

(Migrated from edugit.org)

changed the description

nik commented

2021-12-09 13:52:53 +01:00

(Migrated from edugit.org)

marked this issue as related to AlekSIS/official/AlekSIS-Core#560

nik commented

2021-12-09 13:56:57 +01:00

(Migrated from edugit.org)

In any case, both barcodes and RFIDs should also work via smartphone, so the students can use the AlekSIS PWA on their phone to present in the exact same way as a physical ID card.

If going for TOTP-secured RFID cards, they should probably be integrated as an MFA provider in AlekSIS.

What I do not get is how and why printers are managed in this app. We don't do this for substitution plan printing, do we? Managing printers is clearly out of scope for this app I suppose.

I am not sure whether a plain number will suffice. We should consider security features – if using a barcode, it should contain a signature that at least prevents guessing valid ID cards for other users (stealing and copying their real IDs cannot be protected against). For RFID, a TOTP-like mechanism would probably work, but I am not sure what types of cards are available. In any case, both barcodes and RFIDs should also work via smartphone, so the students can use the AlekSIS PWA on their phone to present in the exact same way as a physical ID card. If going for TOTP-secured RFID cards, they should probably be integrated as an MFA provider in AlekSIS. What I do not get is how and why printers are managed in this app. We don't do this for substitution plan printing, do we? Managing printers is clearly out of scope for this app I suppose.

hansegucker commented

2021-12-09 15:47:44 +01:00

(Migrated from edugit.org)

I am not sure whether a plain number will suffice. We should consider security features – if using a barcode, it should contain a signature that at least prevents guessing valid ID cards for other users (stealing and copying their real IDs cannot be protected against). For RFID, a TOTP-like mechanism would probably work, but I am not sure what types of cards are available.

The Katharineum wants to make use of MIFARE cards with fixed IDs. The same ID then would be printed as barcode on to the card.

What I do not get is how and why printers are managed in this app. We don't do this for substitution plan printing, do we? Managing printers is clearly out of scope for this app I suppose.

It might be correct that managing printers is out of scope for this app, but then we have to implement an extra app for this at least, because printing cards is a completely different thing than printing substitution plans. Substitution plans can be printed on A4 paper directly from the browser, while the process of printing cards will be much more difficult in most cases (one possible scenario is described above).

> I am not sure whether a plain number will suffice. We should consider security features – if using a barcode, it should contain a signature that at least prevents guessing valid ID cards for other users (stealing and copying their real IDs cannot be protected against). For RFID, a TOTP-like mechanism would probably work, but I am not sure what types of cards are available. The Katharineum wants to make use of MIFARE cards with fixed IDs. The same ID then would be printed as barcode on to the card. > What I do not get is how and why printers are managed in this app. We don't do this for substitution plan printing, do we? Managing printers is clearly out of scope for this app I suppose. It might be correct that managing printers is out of scope for this app, but then we have to implement an extra app for this at least, because printing cards is a completely different thing than printing substitution plans. Substitution plans can be printed on A4 paper directly from the browser, while the process of printing cards will be much more difficult in most cases (one possible scenario is described above).

nik commented

2021-12-09 16:38:02 +01:00

(Migrated from edugit.org)

The Katharineum wants to make use of MIFARE cards with fixed IDs. The same ID then would be printed as barcode on to the card.

That sounds like a big gaping security abyss. I would not support such a design anywhere near an official AlekSIS distribution.

It might be correct that managing printers is out of scope for this app, but then we have to implement an extra app for this at least, because printing cards is a completely different thing than printing substitution plans. Substitution plans can be printed on A4 paper directly from the browser, while the process of printing cards will be much more difficult in most cases (one possible scenario is described above).

So the print process requires a dedicated/proprietary technology stack besides the AlekSIS app?

> The Katharineum wants to make use of MIFARE cards with fixed IDs. The same ID then would be printed as barcode on to the card. That sounds like a big gaping security abyss. I would not support such a design anywhere near an official AlekSIS distribution. > It might be correct that managing printers is out of scope for this app, but then we have to implement an extra app for this at least, because printing cards is a completely different thing than printing substitution plans. Substitution plans can be printed on A4 paper directly from the browser, while the process of printing cards will be much more difficult in most cases (one possible scenario is described above). So the print process requires a dedicated/proprietary technology stack besides the AlekSIS app?

hansegucker commented

2022-03-11 12:11:53 +01:00

(Migrated from edugit.org)

added 2h of time spent