@@ -, +, @@ Working on Mozilla Persona support (browser id) This will let a user log into Koha using browser id, if their email address used matches the email address inside Koha. Once an assertion is received, we simply need to find the user that matches that email address, and create a session for them. opac/svc/login handles this part. The nice thing about it is, the user doesn't have to do anything, like linking their account. As long as the email address they are using to identify themselves in browserid is the same as the one in Koha it will just work. This is covered by a systempreference, to allow people to do it, and is of course totally opt in, it works alongside normal Koha (or any other method) of login. So only those choosing to use it, need use it --- C4/Auth.pm | 49 ++++- installer/data/mysql/sysprefs.sql | 1 + installer/data/mysql/updatedatabase.pl | 9 + .../prog/en/modules/admin/preferences/admin.pref | 8 + .../opac-tmpl/prog/en/css/persona-buttons.css | 228 ++++++++++++++++++++ .../opac-tmpl/prog/en/includes/doc-head-close.inc | 3 + koha-tmpl/opac-tmpl/prog/en/includes/masthead.inc | 2 +- .../opac-tmpl/prog/en/includes/opac-bottom.inc | 36 ++++ .../opac-tmpl/prog/en/js/browserid_include.js | 1 + koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt | 8 +- koha-tmpl/opac-tmpl/prog/en/modules/opac-main.tt | 3 + koha-tmpl/opac-tmpl/prog/images/sign_in_green.png | Bin 0 -> 1803 bytes opac/svc/login | 52 +++++ 13 files changed, 390 insertions(+), 10 deletions(-) create mode 100644 koha-tmpl/opac-tmpl/prog/en/css/persona-buttons.css create mode 100644 koha-tmpl/opac-tmpl/prog/en/js/browserid_include.js create mode 100644 koha-tmpl/opac-tmpl/prog/images/sign_in_green.png create mode 100755 opac/svc/login --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -323,6 +323,7 @@ sub get_template_and_user { LoginBranchcode => (C4::Context->userenv?C4::Context->userenv->{"branch"}:"insecure"), LoginFirstname => (C4::Context->userenv?C4::Context->userenv->{"firstname"}:"Bel"), LoginSurname => C4::Context->userenv?C4::Context->userenv->{"surname"}:"Inconnu", + emailaddress => C4::Context->userenv?C4::Context->userenv->{"emailaddress"}:undef, TagsEnabled => C4::Context->preference("TagsEnabled"), hide_marc => C4::Context->preference("hide_marc"), item_level_itypes => C4::Context->preference('item-level_itypes'), @@ -333,6 +334,7 @@ sub get_template_and_user { using_https => $in->{'query'}->https() ? 1 : 0, noItemTypeImages => C4::Context->preference("noItemTypeImages"), marcflavour => C4::Context->preference("marcflavour"), + persona => C4::Context->preference("persona"), ); if ( $in->{'type'} eq "intranet" ) { @@ -618,6 +620,7 @@ sub checkauth { my $authnotrequired = shift; my $flagsrequired = shift; my $type = shift; + my $persona = shift; $type = 'opac' unless $type; my $dbh = C4::Context->dbh; @@ -634,7 +637,7 @@ sub checkauth { # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml my $casparam = $query->param('cas'); - if ( $userid = $ENV{'REMOTE_USER'} ) { + if ( $userid = $ENV{'REMOTE_USER'} ) { # Using Basic Authentication, no cookies required $cookie = $query->cookie( -name => 'CGISESSID', @@ -644,6 +647,9 @@ sub checkauth { ); $loggedin = 1; } + elsif ( $persona ){ + # we dont want to set a session because we are being called by a persona callback + } elsif ( $sessionID = $query->cookie("CGISESSID") ) { # assignment, not comparison my $session = get_session($sessionID); @@ -728,6 +734,7 @@ sub checkauth { } } unless ($userid || $sessionID) { + #we initiate a session prior to checking for a username to allow for anonymous sessions... my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; my $sessionID = $session->id; @@ -737,13 +744,14 @@ sub checkauth { -value => $session->id, -HttpOnly => 1 ); - $userid = $query->param('userid'); + $userid = $query->param('userid'); if ( ( $cas && $query->param('ticket') ) || $userid || ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne - 'None' ) + 'None' || $persona ) { my $password = $query->param('password'); + my ( $return, $cardnumber ); if ( $cas && $query->param('ticket') ) { my $retuserid; @@ -752,7 +760,30 @@ sub checkauth { $userid = $retuserid; $info{'invalidCasLogin'} = 1 unless ($return); } - elsif ( + + elsif ($persona) { + my $value = $persona; + + # If we're looking up the email, there's a chance that the person + # doesn't have a userid. So if there is none, we pass along the + # borrower number, and the bits of code that need to know the user + # ID will have to be smart enough to handle that. + require C4::Members; + my @users_info = C4::Members::GetBorrowersWithEmail($value); + if (@users_info) { + + # First the userid, then the borrowernum + $value = $users_info[0][1] || $users_info[0][0]; + } + else { + undef $value; + } + $return = $value ? 1 : 0; + $userid = $value; + + } + + elsif ( ( $pki_field eq 'Common Name' && $ENV{'SSL_CLIENT_S_DN_CN'} ) || ( $pki_field eq 'emailAddress' && $ENV{'SSL_CLIENT_S_DN_Email'} ) @@ -780,17 +811,18 @@ sub checkauth { } } - # 0 for no user, 1 for normal, 2 for demo user. + $return = $value ? 1 : 0; $userid = $value; - } + + } else { my $retuserid; ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); $userid = $retuserid if ( $retuserid ne '' ); - } - if ($return) { + } + if ($return) { #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); if ( $flags = haspermission( $userid, $flagsrequired ) ) { $loggedin = 1; @@ -992,6 +1024,7 @@ sub checkauth { wrongip => $info{'wrongip'}, PatronSelfRegistration => C4::Context->preference("PatronSelfRegistration"), PatronSelfRegistrationDefaultCategory => C4::Context->preference("PatronSelfRegistrationDefaultCategory"), + persona => C4::Context->preference("Persona"), ); $template->param( OpacPublic => C4::Context->preference("OpacPublic")); --- a/installer/data/mysql/sysprefs.sql +++ a/installer/data/mysql/sysprefs.sql @@ -411,3 +411,4 @@ INSERT INTO systempreferences (variable,value,options,explanation,type) VALUES ( INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES('IDreamBooksReviews','0','Display book review snippets from IDreamBooks.com','','YesNo'); INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES('IDreamBooksReadometer','0','Display Readometer from IDreamBooks.com','','YesNo'); INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES('IDreamBooksResults','0','Display IDreamBooks.com rating in search results','','YesNo'); +INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES('Persona',0,'Use Mozilla Persona for login','','YesNo'); --- a/installer/data/mysql/updatedatabase.pl +++ a/installer/data/mysql/updatedatabase.pl @@ -6399,6 +6399,15 @@ if ( CheckVersion($DBversion) ) { SetVersion($DBversion); } +$DBversion = "XXX"; +if ( CheckVersion($DBversion) ) { + $dbh->do( +"INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES('Persona',0,'Use Mozilla Persona for login','','YesNo')" + ); + print "Upgrade to $DBversion done (Bug 9587 Allow login via Persona)\n"; + SetVersion($DBversion); +} + =head1 FUNCTIONS --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -104,6 +104,14 @@ Administration: Common Name: the Common Name emailAddress: the emailAddress - field for SSL client certificate authentication + Mozilla Persona: + - + - pref: Persona + default: 0 + choices: + yes: Allow + no: "Don't Allow" + - Mozilla persona for login Search Engine: - - pref: SearchEngine --- a/koha-tmpl/opac-tmpl/prog/en/css/persona-buttons.css +++ a/koha-tmpl/opac-tmpl/prog/en/css/persona-buttons.css @@ -0,0 +1,228 @@ +/* Link body */ +.persona-button{ + color: #fff; + display: inline-block; + font-size: 14px; + font-family: Helvetica, Arial, sans-serif; + font-weight: bold; + line-height: 1.1; + overflow: hidden; + position: relative; + text-decoration: none; + text-shadow: 0 1px rgba(0,0,0,0.5), 0 0 2px rgba(0,0,0,0.2); + + background: #297dc3; + background: -moz-linear-gradient(top, #43a6e2, #287cc2); + background: -ms-linear-gradient(top, #43a6e2, #287cc2); + background: -o-linear-gradient(top, #43a6e2, #287cc2); + background: -webkit-linear-gradient(top, #43a6e2, #287cc2); + background: linear-gradient(top, #43a6e2, #287cc2); + + -moz-border-radius: 3px; + -ms-border-radius: 3px; + -o-border-radius: 3px; + -webkit-border-radius: 3px; + border-radius: 3px; + + -moz-box-shadow: 0 1px 0 rgba(0,0,0,0.2); + -ms-box-shadow: 0 1px 0 rgba(0,0,0,0.2); + -o-box-shadow: 0 1px 0 rgba(0,0,0,0.2); + -webkit-box-shadow: 0 1px 0 rgba(0,0,0,0.2); + box-shadow: 0 1px 0 rgba(0,0,0,0.2); +} + +.persona-button:hover{ + background: #21669f; + background: -moz-linear-gradient(top, #3788b9, #21669f); + background: -ms-linear-gradient(top, #3788b9, #21669f); + background: -o-linear-gradient(top, #3788b9, #21669f); + background: -webkit-linear-gradient(top, #3788b9, #21669f); + background: linear-gradient(top, #3788b9, #21669f); +} + +.persona-button:active, .persona-button:focus{ + top: 1px; + -moz-box-shadow: none; + -ms-box-shadow: none; + -o-box-shadow: none; + -webkit-box-shadow: none; + box-shadow: none; +} + +.persona-button span{ + display: inline-block; + padding: 5px 10px 5px 40px; +} + +/* Icon */ +.persona-button span:after{ + background: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAA0AAAAPCAYAAAA/I0V3AAAA4klEQVR42o2RWaqEMBRE3YaCiDjPwQGcd9CrysLv4wTyoLFD90dxqbp1EgdPRB7Kskznea6Zn/aPoKoqUUrJOI5m4l2QBfSyLHKep1zXZSae3An1fS/7vst931bGkzuhaZrsLVbGkzuheZ7lOI6HyJ2QUkqv6yrbtv0LT+6E7G0UrfBfP3lZlpoXH4ZBmHgn5Pv+KwxDfqp0XQdgJp6c/RsUBIGOokiSJDE/s21bACbe5Ozp0TdAHMdSFIXUdS1N01C2wpObPT36HifwCJzI0iX29Oh7XP0E3CB9L01TzM+i/wePv4ZE5RtAngAAAABJRU5ErkJggg==) 10px center no-repeat; + content: ''; + display: block; + width: 31px; + + position: absolute; + bottom: 0; + left: -3px; + top: 0; + z-index: 10; +} + +/* Icon background */ +.persona-button span:before{ + content: ''; + display: block; + height: 100%; + width: 20px; + + position: absolute; + bottom: 0; + left: 0; + top: 0; + z-index: 1; + + background: #42a9dd; + background: -moz-linear-gradient(top, #50b8e8, #3095ce); + background: -ms-linear-gradient(top, #50b8e8, #3095ce); + background: -o-linear-gradient(top, #50b8e8, #3095ce); + background: -webkit-linear-gradient(top, #50b8e8, #3095ce); + background: linear-gradient(top, #50b8e8, #3095ce); + + -moz-border-radius: 3px 0 0 3px; + -ms-border-radius: 3px 0 0 3px; + -o-border-radius: 3px 0 0 3px; + -webkit-border-radius: 3px 0 0 3px; + border-radius: 3px 0 0 3px; +} + +/* Triangle */ +.persona-button:before{ + background: #42a9dd; + content: ''; + display: block; + height: 26px; + width: 26px; + + position: absolute; + left: 2px; + top: 50%; + margin-top: -13px; + z-index: 0; + + background: -moz-linear-gradient(-45deg, #50b8e8, #3095ce); + background: -ms-linear-gradient(-45deg, #50b8e8, #3095ce); + background: -o-linear-gradient(-45deg, #50b8e8, #3095ce); + background: -webkit-linear-gradient(-45deg, #50b8e8, #3095ce); + background: linear-gradient(-45deg, #3095ce, #50b8e8); /* flipped for updated spec */ + + -moz-box-shadow: 1px -1px 1px rgba(0,0,0,0.1); + -ms-box-shadow: 1px -1px 1px rgba(0,0,0,0.1); + -o-box-shadow: 1px -1px 1px rgba(0,0,0,0.1); + -webkit-box-shadow: 1px -1px 1px rgba(0,0,0,0.1); + box-shadow: 1px -1px 1px rgba(0,0,0,0.1); + + -moz-transform: rotate(45deg); + -ms-transform: rotate(45deg); + -o-transform: rotate(45deg); + -webkit-transform: rotate(45deg); + transform: rotate(45deg); +} + +/* Inset shadow (required here because the icon background clips it when on the `a` element) */ +.persona-button:after{ + content: ''; + display: block; + height: 100%; + width: 100%; + + position: absolute; + left: 0; + top: 0; + bottom: 0; + right: 0; + z-index: 10; + + -moz-border-radius: 3px; + -ms-border-radius: 3px; + -o-border-radius: 3px; + -webkit-border-radius: 3px; + border-radius: 3px; + + -moz-box-shadow: inset 0 -1px 0 rgba(0,0,0,0.3); + -ms-box-shadow: inset 0 -1px 0 rgba(0,0,0,0.3); + -o-box-shadow: inset 0 -1px 0 rgba(0,0,0,0.3); + -webkit-box-shadow: inset 0 -1px 0 rgba(0,0,0,0.3); + box-shadow: inset 0 -1px 0 rgba(0,0,0,0.3); +} + +/* ======================================================== + * Dark button + * ===================================================== */ +.persona-button.dark{ + background: #3c3c3c; + background: -moz-linear-gradient(top, #606060, #3c3c3c); + background: -ms-linear-gradient(top, #606060, #3c3c3c); + background: -o-linear-gradient(top, #606060, #3c3c3c); + background: -webkit-linear-gradient(top, #606060, #3c3c3c); + background: linear-gradient(top, #606060, #3c3c3c); +} +.persona-button.dark:hover{ + background: #2d2d2d; + background: -moz-linear-gradient(top, #484848, #2d2d2d); + background: -ms-linear-gradient(top, #484848, #2d2d2d); + background: -o-linear-gradient(top, #484848, #2d2d2d); + background: -webkit-linear-gradient(top, #484848, #2d2d2d); + background: linear-gradient(top, #484848, #2d2d2d); +} +.persona-button.dark span:before{ /* Icon BG */ + background: #d34f2d; + background: -moz-linear-gradient(top, #ebac45, #d34f2d); + background: -ms-linear-gradient(top, #ebac45, #d34f2d); + background: -o-linear-gradient(top, #ebac45, #d34f2d); + background: -webkit-linear-gradient(top, #ebac45, #d34f2d); + background: linear-gradient(top, #ebac45, #d34f2d); +} +.persona-button.dark:before{ /* Triangle */ + background: #d34f2d; + background: -moz-linear-gradient(-45deg, #ebac45, #d34f2d); + background: -ms-linear-gradient(-45deg, #ebac45, #d34f2d); + background: -o-linear-gradient(-45deg, #ebac45, #d34f2d); + background: -webkit-linear-gradient(-45deg, #ebac45, #d34f2d); + background: linear-gradient(-45deg, #d34f2d, #ebac45); /* flipped for updated spec */ +} + +/* ======================================================== + * Orange button + * ===================================================== */ +.persona-button.orange{ + background: #ee731a; + background: -moz-linear-gradient(top, #ee731a, #d03116); + background: -ms-linear-gradient(top, #ee731a, #d03116); + background: -o-linear-gradient(top, #ee731a, #d03116); + background: -webkit-linear-gradient(top, #ee731a, #d03116); + background: linear-gradient(top, #ee731a, #d03116); +} +.persona-button.orange:hover{ + background: #cb6216; + background: -moz-linear-gradient(top, #cb6216, #b12a13); + background: -ms-linear-gradient(top, #cb6216, #b12a13); + background: -o-linear-gradient(top, #cb6216, #b12a13); + background: -webkit-linear-gradient(top, #cb6216, #b12a13); + background: linear-gradient(top, #cb6216, #b12a13); +} +.persona-button.orange span:before{ /* Icon BG */ + background: #e84a21; + background: -moz-linear-gradient(top, #f7ad27, #e84a21); + background: -ms-linear-gradient(top, #f7ad27, #e84a21); + background: -o-linear-gradient(top, #f7ad27, #e84a21); + background: -webkit-linear-gradient(top, #f7ad27, #e84a21); + background: linear-gradient(top, #f7ad27, #e84a21); +} +.persona-button.orange:before{ /* Triangle */ + background: #e84a21; + background: -moz-linear-gradient(-45deg, #f7ad27, #e84a21); + background: -ms-linear-gradient(-45deg, #f7ad27, #e84a21); + background: -o-linear-gradient(-45deg, #f7ad27, #e84a21); + background: -webkit-linear-gradient(-45deg, #f7ad27, #e84a21); + background: linear-gradient(-45deg, #e84a21, #f7ad27); /* flipped for updated spec */ +} --- a/koha-tmpl/opac-tmpl/prog/en/includes/doc-head-close.inc +++ a/koha-tmpl/opac-tmpl/prog/en/includes/doc-head-close.inc @@ -20,6 +20,9 @@ [% END %] +[% IF persona %] + +[% END %] [% IF ( OPACMobileUserCSS ) %][% END %] [% IF ( OPACUserCSS ) %][% END %] --- a/koha-tmpl/opac-tmpl/prog/en/includes/masthead.inc +++ a/koha-tmpl/opac-tmpl/prog/en/includes/masthead.inc @@ -10,7 +10,7 @@ [% IF ( ShowOpacRecentSearchLink ) %]