From 170b75e93e6999ed43025d11e8fa599e14e67e37 Mon Sep 17 00:00:00 2001 From: PTFS Admin Date: Wed, 26 Apr 2017 12:39:15 +0100 Subject: [PATCH] BUG 18506 - Add xShibOnly preference for shibboleth This patch adds two system preferences to Koha, opacShibOnly and staffShibOnly, allowing users to restrict authentication to just one method, Shibboleth. A system preference was chosen over a configuration file update to allow for local override at the virtualhost level. In this way a hosting provider can setup a 'backdoor opac' for example to allow fallback to local logins for support operations. --- C4/Auth.pm | 7 +++++++ installer/data/mysql/atomicupdate/shibOnly.perl | 6 ++++++ .../intranet-tmpl/prog/en/modules/admin/preferences/opac.pref | 7 +++++++ .../prog/en/modules/admin/preferences/staff_client.pref | 7 +++++++ 4 files changed, 27 insertions(+) create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl diff --git a/C4/Auth.pm b/C4/Auth.pm index 40b273a..cfc435b 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1297,6 +1297,13 @@ sub checkauth { } if ($shib) { + #If shibOnly is enabled just go ahead and redirect directly + if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) { + my $redirect_url = login_shib_url( $query ); + print $query->redirect($redirect_url); + safe_exit; + } + $template->param( shibbolethAuthentication => $shib, shibbolethLoginUrl => login_shib_url($query), diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl new file mode 100644 index 0000000..9b67d0f --- /dev/null +++ b/installer/data/mysql/atomicupdate/shibOnly.perl @@ -0,0 +1,6 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" ); + SetVersion( $DBversion ); + print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n"; +} diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref index b6954ef..7194705 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref @@ -823,3 +823,10 @@ OPAC: - "The patron should see the charge description as " - pref: PayPalChargeDescription class: long + Authentication: + - + - pref: opacShibOnly + choices: + yes: "Don't allow" + no: Allow + - patrons to login by means other than shibboleth. diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref index e7da2e8..52654e2 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref @@ -155,3 +155,10 @@ Staff Client: yes: Show no: "Don't show" - a search field pulldown for 'Search the catalog' boxes. + Authentication: + - + - pref: staffShibOnly + choices: + yes: "Don't allow" + no: Allow + - staff to login by means other than shibboleth. -- 2.1.4