View | Details | Raw Unified | Return to bug 28786
Collapse All | Expand All

(-)a/C4/Auth.pm (-18 / +20 lines)
Lines 845-850 sub checkauth { Link Here
845
845
846
    # state variables
846
    # state variables
847
    my $loggedin = 0;
847
    my $loggedin = 0;
848
    my $auth_state = 'failed';
848
    my %info;
849
    my %info;
849
    my ( $userid, $cookie, $sessionID, $flags );
850
    my ( $userid, $cookie, $sessionID, $flags );
850
    my $logout = $query->param('logout.x');
851
    my $logout = $query->param('logout.x');
Lines 859-865 sub checkauth { Link Here
859
    my $session;
860
    my $session;
860
    my $invalid_otp_token;
861
    my $invalid_otp_token;
861
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
862
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
862
    my $auth_challenge_complete;
863
863
864
    # Basic authentication is incompatible with the use of Shibboleth,
864
    # Basic authentication is incompatible with the use of Shibboleth,
865
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
865
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 896-907 sub checkauth { Link Here
896
            $userid = $session->param('id');
896
            $userid = $session->param('id');
897
        }
897
        }
898
898
899
        $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0;
899
        $auth_state =
900
            $return eq 'ok'                     ? 'completed'
901
          : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
902
          :                                       'failed';
900
903
901
        # We are at the second screen if the waiting-for-2FA is set in session
904
        # We are at the second screen if the waiting-for-2FA is set in session
902
        # and otp_token param has been passed
905
        # and otp_token param has been passed
903
        if (   $require_2FA
906
        if (   $require_2FA
904
            && $additional_auth_needed
907
            && $auth_state eq 'additional-auth-needed'
905
            && ( my $otp_token = $query->param('otp_token') ) )
908
            && ( my $otp_token = $query->param('otp_token') ) )
906
        {
909
        {
907
            my $patron    = Koha::Patrons->find( { userid => $userid } );
910
            my $patron    = Koha::Patrons->find( { userid => $userid } );
Lines 910-919 sub checkauth { Link Here
910
            $auth->clear;
913
            $auth->clear;
911
            if ( $verified ) {
914
            if ( $verified ) {
912
                # The token is correct, the user is fully logged in!
915
                # The token is correct, the user is fully logged in!
913
                $additional_auth_needed = 0;
916
                $auth_state = 'completed';
914
                $session->param( 'waiting-for-2FA', 0 );
917
                $session->param( 'waiting-for-2FA', 0 );
915
                $return = "ok";
916
                $auth_challenge_complete = 1;
917
918
918
               # This is an ugly trick to pass the test
919
               # This is an ugly trick to pass the test
919
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
920
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
Lines 925-931 sub checkauth { Link Here
925
            }
926
            }
926
        }
927
        }
927
928
928
        if ( $return eq 'ok' ) {
929
        if ( $auth_state eq 'completed' ) {
929
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
930
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
930
931
931
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
932
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
Lines 950-958 sub checkauth { Link Here
950
                );
951
                );
951
952
952
                $flags = haspermission( $userid, $flagsrequired );
953
                $flags = haspermission( $userid, $flagsrequired );
953
                if ($flags) {
954
                unless ( $flags ) {
954
                    $loggedin = 1;
955
                    $auth_state = 'failed';
955
                } else {
956
                    $info{'nopermission'} = 1;
956
                    $info{'nopermission'} = 1;
957
                }
957
                }
958
            }
958
            }
Lines 967-973 sub checkauth { Link Here
967
        }
967
        }
968
    }
968
    }
969
969
970
    if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) {
970
    if ( $auth_state eq 'failed' || $logout ) {
971
        $sessionID = undef;
971
        $sessionID = undef;
972
        $userid    = undef;
972
        $userid    = undef;
973
    }
973
    }
Lines 993-999 sub checkauth { Link Here
993
        }
993
        }
994
994
995
        $session   = undef;
995
        $session   = undef;
996
        $additional_auth_needed = 0;
996
        $auth_state = 'logout';
997
    }
997
    }
998
998
999
    unless ( $userid ) {
999
    unless ( $userid ) {
Lines 1143-1149 sub checkauth { Link Here
1143
            if ($return) {
1143
            if ($return) {
1144
1144
1145
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1145
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1146
                    $loggedin = 1;
1146
                    $auth_state = "logged_in";
1147
                }
1147
                }
1148
                else {
1148
                else {
1149
                    $info{'nopermission'} = 1;
1149
                    $info{'nopermission'} = 1;
Lines 1293-1310 sub checkauth { Link Here
1293
        $session->flush;
1293
        $session->flush;
1294
    }    # END unless ($userid)
1294
    }    # END unless ($userid)
1295
1295
1296
    if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) {
1296
1297
    if ( $require_2FA && $auth_state eq 'logged_in' ) {
1297
        my $patron = Koha::Patrons->find({userid => $userid});
1298
        my $patron = Koha::Patrons->find({userid => $userid});
1298
        if ( $patron->auth_method eq 'two-factor' ) {
1299
        if ( $patron->auth_method eq 'two-factor' ) {
1299
            # Ask for the OTP token
1300
            # Ask for the OTP token
1300
            $additional_auth_needed = 1;
1301
            $auth_state = 'additional-auth-needed';
1301
            $session->param('waiting-for-2FA', 1);
1302
            $session->param('waiting-for-2FA', 1);
1302
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1303
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1304
        } else {
1305
            $auth_state = 'completed';
1303
        }
1306
        }
1304
    }
1307
    }
1305
1308
1306
    # finished authentification, now respond
1309
    # finished authentification, now respond
1307
    if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) {
1310
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1308
        # successful login
1311
        # successful login
1309
        unless ($cookie) {
1312
        unless ($cookie) {
1310
            $cookie = $query->cookie(
1313
            $cookie = $query->cookie(
Lines 1396-1402 sub checkauth { Link Here
1396
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1399
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1397
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1400
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1398
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1401
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1399
    if ( $additional_auth_needed ) {
1402
    if ( $auth_state eq 'additional-auth-needed' ) {
1400
        $template->param(
1403
        $template->param(
1401
            TwoFA_prompt => 1,
1404
            TwoFA_prompt => 1,
1402
            invalid_otp_token => $invalid_otp_token,
1405
            invalid_otp_token => $invalid_otp_token,
1403
- 

Return to bug 28786