@@ -, +, @@ 0) Back up your database 1) Apply all these patches 2) In your mysql client use your Koha database and execute: > DELETE FROM systempreferences; > SOURCE ~/kohaclone/installer/data/mysql/sysprefs.sql; -- Should be no errors. > SELECT * FROM systempreferences LIKE 'GoogleOAuth%'; -- Should see 4 entries. > QUIT; 3) Restore your database 4) Run ./installer/data/mysql/updatedatabase.pl; 5) In your mysql client use your Koha database and execute: > SELECT * FROM systempreferences LIKE 'GoogleOAuth%'; -- Should see the same 4 entries. 6) Log into the staff client 7) Home -> Koha administration -> Global system preferences 8) -> OPAC -- make sure your OPACBaseURL is set (e.g. https://opac.koha.ca) 9) -> Administration -- There should be a 'Google OAuth2' section with the ability to set those 4 system preferences. library name (e.g. South Pole Library). (e.g. South Pole Library Authentication) (http://library.yourDNS.org) googleoauth2 script (http://library.yourDNS.org/cgi-bin/koha/svc/auth/googleoauth2) system preference. system preference. -- You should get a confirmation request, if you are already logged in, OR a login screen if you are not. -- You need to have the primary email address set to one authenticated by Google in order to log in. --- opac/svc/auth/googleoauth2 | 45 +++++++++++++++++++++------------------------ 1 file changed, 21 insertions(+), 24 deletions(-) --- a/opac/svc/auth/googleoauth2 +++ a/opac/svc/auth/googleoauth2 @@ -46,9 +46,9 @@ use LWP::UserAgent; use HTTP::Request::Common qw{ POST }; use JSON; -my $scope = "openid email"; -my $host = C4::Context->preference('OPACBaseURL') // ''; -my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain') // ''; +my $scope = 'openid email'; +my $host = C4::Context->preference('OPACBaseURL') // q{}; +my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain') // q{}; # protocol is assumed in OPACBaseURL see bug 5010. my $redirecturl = $host . '/cgi-bin/koha/svc/auth/googleoauth2'; @@ -56,25 +56,25 @@ my $issuer = 'accounts.google.com'; my $clientid = C4::Context->preference('GoogleOAuth2ClientID'); my $clientsecret = C4::Context->preference('GoogleOAuth2ClientSecret'); -my $query = new CGI; +my $query = CGI->new; sub loginfailed { - my $query = shift; - my $reason = shift; - $query->delete('code'); - $query->param( 'OAuth2Failed' => $reason ); + my $cgi_query = shift; + my $reason = shift; + $cgi_query->delete('code'); + $cgi_query->param( 'OAuth2Failed' => $reason ); my ( $template, $borrowernumber, $cookie ) = get_template_and_user( { template_name => 'opac-user.tt', - query => $query, + query => $cgi_query, type => 'opac', authnotrequired => 0, - flagsrequired => { borrow => 1 }, } ); $template->param( 'invalidOAuth2Login' => $reason ); $template->param( 'loginprompt' => 1 ); - output_html_with_http_headers $query, $cookie, $template->output; + output_html_with_http_headers $cgi_query, $cookie, $template->output; + return; } if ( defined $query->param('error') ) { @@ -111,11 +111,11 @@ elsif ( defined $query->param('code') ) { && exists( $json->{'email'} ) ) { my $email = $json->{'email'}; - my ( $userid, $cookie, $sessionID ) = - checkauth( $query, 1, { borrow => 1 }, 'opac', $email ); + my ( $userid, $cookie, $session_id ) = + checkauth( $query, 1, { }, 'opac', $email ); if ($userid) { # A valid user has logged in - if ( ( $restricttodomain ne '' ) - && ( index( $email, $restricttodomain ) == -1 ) ) + if ( ( $restricttodomain ne q{} ) + && ( index( $email, $restricttodomain ) < 0 ) ) { loginfailed( $query, 'The email you have used is not valid for this library. Email addresses should conclude with ' @@ -148,22 +148,19 @@ elsif ( defined $query->param('code') ) { } else { - my $prompt = ''; - $prompt = $query->param('reauthenticate') - unless not( defined $query->param('reauthenticate') ); + my $prompt = $query->param('reauthenticate') // q{}; my $authorisationurl = 'https://accounts.google.com/o/oauth2/auth?' . 'response_type=code&' . 'redirect_uri=' - . escape($redirecturl) . '&' + . escape($redirecturl) . q{&} . 'client_id=' - . escape($clientid) . '&' + . escape($clientid) . q{&} . 'scope=' - . escape($scope) . '&'; - if ( $query->param('reauthenticate') ) { - $authorisationurl .= - 'prompt=' . escape( $query->param('reauthenticate') ); + . escape($scope) . q{&}; + if ( $prompt || ( defined $prompt && length $prompt > 0 ) ) { + $authorisationurl .= 'prompt=' . escape($prompt); } print $query->redirect($authorisationurl); } --