View | Details | Raw Unified | Return to bug 28786
Collapse All | Expand All

(-)a/C4/Auth.pm (-18 / +20 lines)
Lines 827-832 sub checkauth { Link Here
827
827
828
    # state variables
828
    # state variables
829
    my $loggedin = 0;
829
    my $loggedin = 0;
830
    my $auth_state = 'failed';
830
    my %info;
831
    my %info;
831
    my ( $userid, $cookie, $sessionID, $flags );
832
    my ( $userid, $cookie, $sessionID, $flags );
832
    my $logout = $query->param('logout.x');
833
    my $logout = $query->param('logout.x');
Lines 841-847 sub checkauth { Link Here
841
    my $session;
842
    my $session;
842
    my $invalid_otp_token;
843
    my $invalid_otp_token;
843
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
844
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
844
    my $auth_challenge_complete;
845
845
846
    # Basic authentication is incompatible with the use of Shibboleth,
846
    # Basic authentication is incompatible with the use of Shibboleth,
847
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
847
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 877-888 sub checkauth { Link Here
877
            $userid = $session->param('id');
877
            $userid = $session->param('id');
878
        }
878
        }
879
879
880
        $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0;
880
        $auth_state =
881
            $return eq 'ok'                     ? 'completed'
882
          : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
883
          :                                       'failed';
881
884
882
        # We are at the second screen if the waiting-for-2FA is set in session
885
        # We are at the second screen if the waiting-for-2FA is set in session
883
        # and otp_token param has been passed
886
        # and otp_token param has been passed
884
        if (   $require_2FA
887
        if (   $require_2FA
885
            && $additional_auth_needed
888
            && $auth_state eq 'additional-auth-needed'
886
            && ( my $otp_token = $query->param('otp_token') ) )
889
            && ( my $otp_token = $query->param('otp_token') ) )
887
        {
890
        {
888
            my $patron    = Koha::Patrons->find( { userid => $userid } );
891
            my $patron    = Koha::Patrons->find( { userid => $userid } );
Lines 891-900 sub checkauth { Link Here
891
            $auth->clear;
894
            $auth->clear;
892
            if ( $verified ) {
895
            if ( $verified ) {
893
                # The token is correct, the user is fully logged in!
896
                # The token is correct, the user is fully logged in!
894
                $additional_auth_needed = 0;
897
                $auth_state = 'completed';
895
                $session->param( 'waiting-for-2FA', 0 );
898
                $session->param( 'waiting-for-2FA', 0 );
896
                $return = "ok";
897
                $auth_challenge_complete = 1;
898
899
899
               # This is an ugly trick to pass the test
900
               # This is an ugly trick to pass the test
900
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
901
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
Lines 906-912 sub checkauth { Link Here
906
            }
907
            }
907
        }
908
        }
908
909
909
        if ( $return eq 'ok' ) {
910
        if ( $auth_state eq 'completed' ) {
910
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
911
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
911
912
912
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
913
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
Lines 932-940 sub checkauth { Link Here
932
                my $sessiontype = $session->param('sessiontype') || '';
933
                my $sessiontype = $session->param('sessiontype') || '';
933
                unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
934
                unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
934
                    $flags = haspermission( $userid, $flagsrequired );
935
                    $flags = haspermission( $userid, $flagsrequired );
935
                    if ($flags) {
936
                    unless ( $flags ) {
936
                        $loggedin = 1;
937
                        $auth_state = 'failed';
937
                    } else {
938
                        $info{'nopermission'} = 1;
938
                        $info{'nopermission'} = 1;
939
                    }
939
                    }
940
                }
940
                }
Lines 950-956 sub checkauth { Link Here
950
        }
950
        }
951
    }
951
    }
952
952
953
    if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) {
953
    if ( $auth_state eq 'failed' || $logout ) {
954
        $sessionID = undef;
954
        $sessionID = undef;
955
        $session   = undef;
955
        $session   = undef;
956
        $userid    = undef;
956
        $userid    = undef;
Lines 979-985 sub checkauth { Link Here
979
        $sessionID = undef;
979
        $sessionID = undef;
980
        $session   = undef;
980
        $session   = undef;
981
        $userid    = undef;
981
        $userid    = undef;
982
        $additional_auth_needed = 0;
982
        $auth_state = 'logout';
983
    }
983
    }
984
984
985
    unless ( $userid ) {
985
    unless ( $userid ) {
Lines 1129-1135 sub checkauth { Link Here
1129
            if ($return) {
1129
            if ($return) {
1130
1130
1131
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1131
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1132
                    $loggedin = 1;
1132
                    $auth_state = "logged_in";
1133
                }
1133
                }
1134
                else {
1134
                else {
1135
                    $info{'nopermission'} = 1;
1135
                    $info{'nopermission'} = 1;
Lines 1271-1288 sub checkauth { Link Here
1271
        }
1271
        }
1272
    }    # END unless ($userid)
1272
    }    # END unless ($userid)
1273
1273
1274
    if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) {
1274
1275
    if ( $require_2FA && $auth_state eq 'logged_in' ) {
1275
        my $patron = Koha::Patrons->find({userid => $userid});
1276
        my $patron = Koha::Patrons->find({userid => $userid});
1276
        if ( $patron->auth_method eq 'two-factor' ) {
1277
        if ( $patron->auth_method eq 'two-factor' ) {
1277
            # Ask for the OTP token
1278
            # Ask for the OTP token
1278
            $additional_auth_needed = 1;
1279
            $auth_state = 'additional-auth-needed';
1279
            $session->param('waiting-for-2FA', 1);
1280
            $session->param('waiting-for-2FA', 1);
1280
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1281
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1282
        } else {
1283
            $auth_state = 'completed';
1281
        }
1284
        }
1282
    }
1285
    }
1283
1286
1284
    # finished authentification, now respond
1287
    # finished authentification, now respond
1285
    if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) {
1288
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1286
        # successful login
1289
        # successful login
1287
        unless ($cookie) {
1290
        unless ($cookie) {
1288
            $cookie = $query->cookie(
1291
            $cookie = $query->cookie(
Lines 1374-1380 sub checkauth { Link Here
1374
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1377
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1375
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1378
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1376
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1379
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1377
    if ( $additional_auth_needed ) {
1380
    if ( $auth_state eq 'additional-auth-needed' ) {
1378
        $template->param(
1381
        $template->param(
1379
            TwoFA_prompt => 1,
1382
            TwoFA_prompt => 1,
1380
            invalid_otp_token => $invalid_otp_token,
1383
            invalid_otp_token => $invalid_otp_token,
1381
- 

Return to bug 28786