View | Details | Raw Unified | Return to bug 18506
Collapse All | Expand All

(-)a/C4/Auth.pm (+24 lines)
Lines 1100-1105 sub checkauth { Link Here
1100
                }
1100
                }
1101
            }
1101
            }
1102
1102
1103
            # If shib configured and shibOnly enabled, we should ignore anything other than a shibboleth type login.
1104
            if (
1105
                   $shib
1106
                && !$shibSuccess
1107
                && (
1108
                    (
1109
                        ( $type eq 'opac' )
1110
                        && C4::Context->preference('opacShibOnly')
1111
                    )
1112
                    || ( ( $type ne 'opac' )
1113
                        && C4::Context->preference('staffShibOnly') )
1114
                )
1115
              )
1116
            {
1117
                $return = 0;
1118
            }
1119
1103
            # $return: 1 = valid user
1120
            # $return: 1 = valid user
1104
            if ($return) {
1121
            if ($return) {
1105
1122
Lines 1393-1398 sub checkauth { Link Here
1393
    }
1410
    }
1394
1411
1395
    if ($shib) {
1412
    if ($shib) {
1413
        #If shibOnly is enabled just go ahead and redirect directly
1414
        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
1415
            my $redirect_url = login_shib_url( $query );
1416
            print $query->redirect( -uri => "$redirect_url", -status => 303 );
1417
            safe_exit;
1418
        }
1419
1396
        $template->param(
1420
        $template->param(
1397
            shibbolethAuthentication => $shib,
1421
            shibbolethAuthentication => $shib,
1398
            shibbolethLoginUrl       => login_shib_url($query),
1422
            shibbolethLoginUrl       => login_shib_url($query),
(-)a/installer/data/mysql/atomicupdate/shibOnly.perl (+6 lines)
Line 0 Link Here
1
$DBversion = 'XXX';  # will be replaced by the RM
2
if( CheckVersion( $DBversion ) ) {
3
    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
4
    SetVersion( $DBversion );
5
    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
6
}
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref (+7 lines)
Lines 932-934 OPAC: Link Here
932
                  BaseURL: "OPACBaseURL"
932
                  BaseURL: "OPACBaseURL"
933
                  OPACAlias: "configured return URL"
933
                  OPACAlias: "configured return URL"
934
            - "."
934
            - "."
935
    Authentication:
936
        -
937
            - pref: opacShibOnly
938
              choices:
939
                  yes: "Don't allow"
940
                  no: Allow
941
            - patrons to login by means other than Shibboleth.
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref (+7 lines)
Lines 181-183 Staff interface: Link Here
181
                  yes: Show
181
                  yes: Show
182
                  no: "Don't show"
182
                  no: "Don't show"
183
            - a search field pulldown for 'Search the catalog' boxes.
183
            - a search field pulldown for 'Search the catalog' boxes.
184
    Authentication:
185
        -
186
            - pref: staffShibOnly
187
              choices:
188
                  yes: "Don't allow"
189
                  no: Allow
190
            - staff to login by means other than shibboleth.
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-1 / +8 lines)
Lines 79-84 Link Here
79
                                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
79
                                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
80
                                    <div class="alert alert-info">
80
                                    <div class="alert alert-info">
81
                                        <p>Sorry, your Shibboleth identity does not match a valid library identity.</p>
81
                                        <p>Sorry, your Shibboleth identity does not match a valid library identity.</p>
82
                                        [% UNLESS ( Koha.Preference('opacShibOnly') ) %]
82
                                        [% IF ( casAuthentication ) %]
83
                                        [% IF ( casAuthentication ) %]
83
                                            [% IF ( invalidCasLogin ) %]
84
                                            [% IF ( invalidCasLogin ) %]
84
                                                <!-- This is what is displayed if cas login has failed -->
85
                                                <!-- This is what is displayed if cas login has failed -->
Lines 89-99 Link Here
89
                                        [% ELSE %]
90
                                        [% ELSE %]
90
                                            <p>If you have a local account, you may use that below.</p>
91
                                            <p>If you have a local account, you may use that below.</p>
91
                                        [% END %]
92
                                        [% END %]
93
                                        [% END %]
92
                                    </div>
94
                                    </div>
93
                                [% ELSE %]
95
                                [% ELSE %]
94
                                    <h3>Shibboleth Login</h3>
96
                                    <h3>Shibboleth Login</h3>
95
                                    <p><a href="[% shibbolethLoginUrl | $raw %]">Log in using a Shibboleth account.</a></p>
97
                                    <p><a href="[% shibbolethLoginUrl | $raw %]">Log in using a Shibboleth account.</a></p>
96
                                [% END # /IF invalidShibLogin %]
98
                                [% END # /IF invalidShibLogin %]
99
                                [% UNLESS ( Koha.Preference('opacShibOnly') ) %]
97
                                [% IF ( casAuthentication ) %]
100
                                [% IF ( casAuthentication ) %]
98
                                    <h3>CAS login</h3>
101
                                    <h3>CAS login</h3>
99
                                    <p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
102
                                    <p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
Lines 101-108 Link Here
101
                                    <h3>Local login</h3>
104
                                    <h3>Local login</h3>
102
                                    <p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>
105
                                    <p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>
103
                                [% END %]
106
                                [% END %]
107
                                [% END %]
104
                            [% END # /IF shibbolethAuthentication %]
108
                            [% END # /IF shibbolethAuthentication %]
105
109
110
                        [% UNLESS ( Koha.Preference('opacShibOnly') ) %]
106
                        [% IF ( casAuthentication ) %]
111
                        [% IF ( casAuthentication ) %]
107
                            [% IF ( shibbolethAuthentication ) %]
112
                            [% IF ( shibbolethAuthentication ) %]
108
                                [% IF ( casServerUrl ) %]
113
                                [% IF ( casServerUrl ) %]
Lines 158-164 Link Here
158
                            <a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>
163
                            <a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>
159
                            <p>If you do not have a Google account, but do have a local account, you can still log in: </p>
164
                            <p>If you do not have a Google account, but do have a local account, you can still log in: </p>
160
                        [% END # /IF GoogleOpenIDConnect %]
165
                        [% END # /IF GoogleOpenIDConnect %]
166
                        [% END # /UNLESS opacShibOnly %]
161
167
168
                        [% IF !Koha.Preference('opacShibOnly') or SCO_login or SCI_login %]
162
                        [% IF SCO_login %]
169
                        [% IF SCO_login %]
163
                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">
170
                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">
164
                        [% ELSIF SCI_login %]
171
                        [% ELSIF SCI_login %]
Lines 208-213 Link Here
208
                                [% END %]
215
                                [% END %]
209
                            </div>
216
                            </div>
210
                        </form>
217
                        </form>
218
                        [% END # / IF !opacShibOnly or SCO_login or SCI_login %]
211
                    [% END # / IF loginprompt %]
219
                    [% END # / IF loginprompt %]
212
220
213
                    [% ELSE %]
221
                    [% ELSE %]
214
- 

Return to bug 18506