Bug 14034 - User logged out on refresh after Shibboleth authentication
Summary: User logged out on refresh after Shibboleth authentication
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords:
Depends on: 12887
Blocks: 14035
  Show dependency tree / graph
 
Reported: 2015-04-21 11:13 UTC by Martin Renvoize (ashimema)
Modified: 2017-06-14 22:10 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 14034: Fix logout on refresh for shibboleth (1.10 KB, patch)
2015-09-18 08:11 UTC, Martin Renvoize (ashimema) 		Details | Diff | Splinter Review
Bug 14034: Fix logout on refresh for shibboleth (1.40 KB, patch)
2015-12-23 19:22 UTC, Chris Cormack 		Details | Diff | Splinter Review
Bug 14034: Fix logout on refresh for shibboleth (1.70 KB, patch)
2015-12-31 20:06 UTC, Jesse Weaver 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2015-04-21 11:13:27 UTC 
+++ This bug was initially created as a clone of Bug #12887 +++

The bug seems to also affect shibboleth.. I have no idea at what point it crept in or how.. but I've found the same on a recent update of one of our shibboleth customers.

If you enable the _session_log you'll spot that every page request in fact results in an entirely new login taking place via shibboleth.
Comment 1 Martin Renvoize (ashimema) 2015-09-18 08:11:36 UTC Comment hidden (obsolete)
Comment 2 Martin Renvoize (ashimema) 2015-09-18 11:01:49 UTC 
This patch has been in live operation on at least four customers here since it was initially found..  I just hadn't had a chance to extract and submit it.

Would be nice to get an external to PTFS-Europe signoff though.
Comment 3 Chris Cormack 2015-12-23 19:22:39 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-12-26 11:35:59 UTC 
Matts, could you please test this patch and confirm that it works as expected?
Comment 5 Jesse Weaver 2015-12-31 20:06:08 UTC 
Created attachment 46162 [details] [review]
Bug 14034: Fix logout on refresh for shibboleth

This is similar to bug 12877

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

While this is missing a detailed test plan, what I did to test was

1/ Login to koha .. it works
2/ Apply patch
3/ Login to koha .. it still works, no regressions. I can't test the
shibboleth part but it doesnt break anything else so I'm happy to sign
off

Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>

We had to implement this fix for one of our customers using Shibboleth.
Can verify that it fixes the issue (which, incidentally, breaks
stage-marc-import since that depends on a constant sessionID).

Passing QA (verified with QA tools). Thanks, Martin!
Comment 6 Brendan Gallagher 2015-12-31 20:42:50 UTC 
Pushed to Master - Thanks!
Comment 7 Julian Maurice 2016-01-03 10:54:02 UTC 
Patch pushed to 3.22.x, will be in 3.22.2
Comment 8 Frédéric Demians 2016-01-04 15:05:09 UTC 
This patch has been pushed to 3.20.x, will be in 3.20.8.