The current shibboleth implementation only support authentication into the opac. We should also enable shibboleth for the staff client.
Created attachment 30373 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work.
Created attachment 30374 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work.
Created attachment 30375 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work.
Created attachment 30377 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. http://bugs.koha-community.org/show_bug.cgi?id=12026
Created attachment 35553 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. http://bugs.koha-community.org/show_bug.cgi?id=12026
Created attachment 35554 [details] [review] BUG 12027 [Followup]: Added missing documentation
Rebased
Created attachment 43371 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. http://bugs.koha-community.org/show_bug.cgi?id=12026
Created attachment 43372 [details] [review] BUG 12027 [Followup]: Added missing documentation
Rebased again
Are there good instructions on how to set up a test environment for shibboleth patches?
Sorry I missed this a while back. There are some instructions on the wiki for configuring shibboleth on your server, and there are now a couple of public identity providers one can use to test against I believe.. Just Google shibboleth test IdP to find one for your locality.
https://wiki.koha-community.org/wiki/Shibboleth_Configuration
Created attachment 62523 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. http://bugs.koha-community.org/show_bug.cgi?id=12026
Created attachment 62524 [details] [review] BUG 12027 [Followup]: Added missing documentation https://bugs.koha-community.org/show_bug.cgi?id=12026
Simple Rebase
We have this running in production at three sites and have had since it's first submission.
Created attachment 62823 [details] [review] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. http://bugs.koha-community.org/show_bug.cgi?id=12026 Tested in production Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 62824 [details] [review] BUG 12027 [Followup]: Added missing documentation https://bugs.koha-community.org/show_bug.cgi?id=12026 Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 62825 [details] [review] BUG 12027 [QA Followup] - Update tests
Added a follow up to update the tests to cover the addition of intranet handling to quell a suspected QA failure before it happens ;)
Forgot to mention that last follow-up also silenced a silly warning which was a result of rebases at some point. Just a simple double declaration warning.
(In reply to Martin Renvoize from comment #13) > https://wiki.koha-community.org/wiki/Shibboleth_Configuration Sweet, tangentially, do we have attempts at other authentication methods? Also, we should also have a bug for changing the StaffBaseURL to include the protocol. After all, shibboleth requires https, does it not?
(In reply to M. Tompsett from comment #23) > (In reply to Martin Renvoize from comment #13) > > https://wiki.koha-community.org/wiki/Shibboleth_Configuration > > Sweet, tangentially, do we have attempts at other authentication methods? > Also, we should also have a bug for changing the StaffBaseURL to include the > protocol. After all, shibboleth requires https, does it not? This patch does allow fallback logins as per OPAC shibboleth, although due to the nature of shibboleth the same caveats apply (i.e. once you've clicked the 'login via shibboleth' link and been redirected to the IdP, if you fail to login you won't get redirected back to the koha client, so you'll have to navigate back yourself to use a fallback method. This is protocol specific and at the IdP end, there's no way to fix this at the koha side) Bug 18506 allows for a 'Shibboleth Only' mode should you wish to use shibboleth in that way. Hmm, I must admit I'd lost track fo the StaffBaseURL preference and whether it allowed specifying a protocol or not now; I best check up on that one. Cheers
(In reply to Martin Renvoize from comment #24) > (In reply to M. Tompsett from comment #23) > Hmm, I must admit I'd lost track fo the StaffBaseURL preference and whether > it allowed specifying a protocol or not now; I best check up on that one. Unfortunately for you Mark only fixed OPACBaseURL iirc. Which means that your assumption that StaffBaseURL includes the protocol is not correct.
Now that Bug 16401 has been pushed, assuming that staffClientBaseURL has a protocol should be ok now.
Also please add feedback for comment 25.
Zeno asked me: === I think that Matthias on commen7 #26 is quite clear It is not enough a rebase for this patch ? === Yeah I focused on a reply from Martin. So probably true.
Created attachment 73152 [details] [review] BUG 12027 [QA Followup] - Update tests
Patch rebased. Marcel, do you still need feedback for comment 25 ? Other than that, is there something else expected for this patch to move on ?
(In reply to Matthias Meusburger from comment #30) > Marcel, do you still need feedback for comment 25 ? Not anymore.
Thanks for rebasing matthias.. Counting down the days until my return to the community now [U+1F600]
Created attachment 75868 [details] [review] BUG 12027 [QA Followup] - Update tests
Another minor rebase of the last patch.
Created attachment 79416 [details] [review] Bug 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Created attachment 79417 [details] [review] Bug 12027: (follow-up) Added missing documentation Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Created attachment 79418 [details] [review] Bug 12027: (QA follow-up) Update tests Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Created attachment 79419 [details] [review] Bug 12027: (QA follow-up) Fix spelling and tab characters Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Thx, Julian!
Awesome work all! Pushed to master for 18.11
Enhancement, will not be backported to 18.05.x series