Bug 14034 - User logged out on refresh after Shibboleth authentication
Summary: User logged out on refresh after Shibboleth authentication
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Keywords:
Depends on: 12887
Blocks: 14035
  Show dependency treegraph
 
Reported: 2015-04-21 11:13 UTC by Martin Renvoize
Modified: 2017-06-14 22:10 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 14034: Fix logout on refresh for shibboleth (1.10 KB, patch)
2015-09-18 08:11 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 14034: Fix logout on refresh for shibboleth (1.40 KB, patch)
2015-12-23 19:22 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14034: Fix logout on refresh for shibboleth (1.70 KB, patch)
2015-12-31 20:06 UTC, Jesse Weaver
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2015-04-21 11:13:27 UTC
+++ This bug was initially created as a clone of Bug #12887 +++

The bug seems to also affect shibboleth.. I have no idea at what point it crept in or how.. but I've found the same on a recent update of one of our shibboleth customers.

If you enable the _session_log you'll spot that every page request in fact results in an entirely new login taking place via shibboleth.
Comment 1 Martin Renvoize 2015-09-18 08:11:36 UTC Comment hidden (obsolete)
Comment 2 Martin Renvoize 2015-09-18 11:01:49 UTC
This patch has been in live operation on at least four customers here since it was initially found..  I just hadn't had a chance to extract and submit it.

Would be nice to get an external to PTFS-Europe signoff though.
Comment 3 Chris Cormack 2015-12-23 19:22:39 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-12-26 11:35:59 UTC
Matts, could you please test this patch and confirm that it works as expected?
Comment 5 Jesse Weaver 2015-12-31 20:06:08 UTC
Created attachment 46162 [details] [review]
Bug 14034: Fix logout on refresh for shibboleth

This is similar to bug 12877

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

While this is missing a detailed test plan, what I did to test was

1/ Login to koha .. it works
2/ Apply patch
3/ Login to koha .. it still works, no regressions. I can't test the
shibboleth part but it doesnt break anything else so I'm happy to sign
off

Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>

We had to implement this fix for one of our customers using Shibboleth.
Can verify that it fixes the issue (which, incidentally, breaks
stage-marc-import since that depends on a constant sessionID).

Passing QA (verified with QA tools). Thanks, Martin!
Comment 6 Brendan Gallagher 2015-12-31 20:42:50 UTC
Pushed to Master - Thanks!
Comment 7 Julian Maurice 2016-01-03 10:54:02 UTC
Patch pushed to 3.22.x, will be in 3.22.2
Comment 8 Frédéric Demians 2016-01-04 15:05:09 UTC
This patch has been pushed to 3.20.x, will be in 3.20.8.