Attachment #116536 for bug #18506

View | Details | Raw Unified | Return to bug 18506
Collapse All | Expand All




                }
            }

            # If shib configured and shibOnly enabled, we should ignore anything other than a shibboleth type login.
            if (
                   $shib
                && !$shibSuccess
                && (
                    (
                        ( $type eq 'opac' )
                        && C4::Context->preference('opacShibOnly')
                    )
                    || ( ( $type ne 'opac' )
                        && C4::Context->preference('staffShibOnly') )
                )
              )
            {
                $return = 0;
            }

            # $return: 1 = valid user
            if ($return) {


    }

    if ($shib) {
        #If shibOnly is enabled just go ahead and redirect directly
        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
            my $redirect_url = login_shib_url( $query );
            print $query->redirect( -uri => "$redirect_url", -status => 303 );
            safe_exit;
        }

        $template->param(
            shibbolethAuthentication => $shib,
            shibbolethLoginUrl       => login_shib_url($query),

Line 0 Link Here

(-)a/installer/data/mysql/atomicupdate/shibOnly.perl (+6 lines)
	1	$DBversion = 'XXX'; # will be replaced by the RM
	2	if( CheckVersion( $DBversion ) ) {
	3	$dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
	4	SetVersion( $DBversion );
	5	print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
	6	}

Lines 932-934 OPAC: Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref (+7 lines)
932	BaseURL: "OPACBaseURL"	932	BaseURL: "OPACBaseURL"
933	OPACAlias: "configured return URL"	933	OPACAlias: "configured return URL"
934	- "."	934	- "."
		935	Authentication:
		936	-
		937	- pref: opacShibOnly
		938	choices:
		939	yes: "Don't allow"
		940	no: Allow
		941	- patrons to login by means other than Shibboleth.

Lines 181-183 Staff interface: Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref (+7 lines)
181	yes: Show	181	yes: Show
182	no: "Don't show"	182	no: "Don't show"
183	- a search field pulldown for 'Search the catalog' boxes.	183	- a search field pulldown for 'Search the catalog' boxes.
		184	Authentication:
		185	-
		186	- pref: staffShibOnly
		187	choices:
		188	yes: "Don't allow"
		189	no: Allow
		190	- staff to login by means other than shibboleth.




                                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
                                    <div class="alert alert-info">
                                        <p>Sorry, your Shibboleth identity does not match a valid library identity.</p>
                                        [% UNLESS ( Koha.Preference('opacShibOnly') ) %]
                                        [% IF ( casAuthentication ) %]
                                            [% IF ( invalidCasLogin ) %]
                                                <!-- This is what is displayed if cas login has failed -->

                                        [% ELSE %]
                                            <p>If you have a local account, you may use that below.</p>
                                        [% END %]
                                        [% END %]
                                    </div>
                                [% ELSE %]
                                    <h3>Shibboleth Login</h3>
                                    <p><a href="[% shibbolethLoginUrl | $raw %]">Log in using a Shibboleth account.</a></p>
                                [% END # /IF invalidShibLogin %]
                                [% UNLESS ( Koha.Preference('opacShibOnly') ) %]
                                [% IF ( casAuthentication ) %]
                                    <h3>CAS login</h3>
                                    <p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>

                                    <h3>Local login</h3>
                                    <p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>
                                [% END %]
                                [% END %]
                            [% END # /IF shibbolethAuthentication %]

                        [% UNLESS ( Koha.Preference('opacShibOnly') ) %]
                        [% IF ( casAuthentication ) %]
                            [% IF ( shibbolethAuthentication ) %]
                                [% IF ( casServerUrl ) %]

                            <a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>
                            <p>If you do not have a Google account, but do have a local account, you can still log in: </p>
                        [% END # /IF GoogleOpenIDConnect %]
                        [% END # /UNLESS opacShibOnly %]

                        [% IF !Koha.Preference('opacShibOnly') or SCO_login or SCI_login %]
                        [% IF SCO_login %]
                            <form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">
                        [% ELSIF SCI_login %]

                                [% END %]
                            </div>
                        </form>
                        [% END # / IF !opacShibOnly or SCO_login or SCI_login %]
                    [% END # / IF loginprompt %]

                    [% ELSE %]
- 

Return to bug 18506

Lines 1100-1105 sub checkauth { Link Here

(-)a/C4/Auth.pm (+24 lines)
1100	}	1100	}
1101	}	1101	}
1102		1102
		1103	# If shib configured and shibOnly enabled, we should ignore anything other than a shibboleth type login.
		1104	if (
		1105	$shib
		1106	&& !$shibSuccess
		1107	&& (
		1108	(
		1109	( $type eq 'opac' )
		1110	&& C4::Context->preference('opacShibOnly')
		1111	)
		1112	\|\| ( ( $type ne 'opac' )
		1113	&& C4::Context->preference('staffShibOnly') )
		1114	)
		1115	)
		1116	{
		1117	$return = 0;
		1118	}
		1119
1103	# $return: 1 = valid user	1120	# $return: 1 = valid user
1104	if ($return) {	1121	if ($return) {
1105		1122
Lines 1393-1398 sub checkauth { Link Here
1393	}	1410	}
1394		1411
1395	if ($shib) {	1412	if ($shib) {
		1413	#If shibOnly is enabled just go ahead and redirect directly
		1414	if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) \|\| (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
		1415	my $redirect_url = login_shib_url( $query );
		1416	print $query->redirect( -uri => "$redirect_url", -status => 303 );
		1417	safe_exit;
		1418	}
		1419
1396	$template->param(	1420	$template->param(
1397	shibbolethAuthentication => $shib,	1421	shibbolethAuthentication => $shib,
1398	shibbolethLoginUrl => login_shib_url($query),	1422	shibbolethLoginUrl => login_shib_url($query),

Lines 79-84 Link Here

(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-1 / +8 lines)
79	<!-- This is what is displayed if shibboleth login has failed to match a koha user -->	79	<!-- This is what is displayed if shibboleth login has failed to match a koha user -->
80	<div class="alert alert-info">	80	<div class="alert alert-info">
81	<p>Sorry, your Shibboleth identity does not match a valid library identity.</p>	81	<p>Sorry, your Shibboleth identity does not match a valid library identity.</p>
		82	[% UNLESS ( Koha.Preference('opacShibOnly') ) %]
82	[% IF ( casAuthentication ) %]	83	[% IF ( casAuthentication ) %]
83	[% IF ( invalidCasLogin ) %]	84	[% IF ( invalidCasLogin ) %]
84	<!-- This is what is displayed if cas login has failed -->	85	<!-- This is what is displayed if cas login has failed -->
Lines 89-99 Link Here
89	[% ELSE %]	90	[% ELSE %]
90	<p>If you have a local account, you may use that below.</p>	91	<p>If you have a local account, you may use that below.</p>
91	[% END %]	92	[% END %]
		93	[% END %]
92	</div>	94	</div>
93	[% ELSE %]	95	[% ELSE %]
94	<h3>Shibboleth Login</h3>	96	<h3>Shibboleth Login</h3>
95	<p><a href="[% shibbolethLoginUrl \| $raw %]">Log in using a Shibboleth account.</a></p>	97	<p><a href="[% shibbolethLoginUrl \| $raw %]">Log in using a Shibboleth account.</a></p>
96	[% END # /IF invalidShibLogin %]	98	[% END # /IF invalidShibLogin %]
		99	[% UNLESS ( Koha.Preference('opacShibOnly') ) %]
97	[% IF ( casAuthentication ) %]	100	[% IF ( casAuthentication ) %]
98	<h3>CAS login</h3>	101	<h3>CAS login</h3>
99	<p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>	102	<p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
Lines 101-108 Link Here
101	<h3>Local login</h3>	104	<h3>Local login</h3>
102	<p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>	105	<p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>
103	[% END %]	106	[% END %]
		107	[% END %]
104	[% END # /IF shibbolethAuthentication %]	108	[% END # /IF shibbolethAuthentication %]
105		109
		110	[% UNLESS ( Koha.Preference('opacShibOnly') ) %]
106	[% IF ( casAuthentication ) %]	111	[% IF ( casAuthentication ) %]
107	[% IF ( shibbolethAuthentication ) %]	112	[% IF ( shibbolethAuthentication ) %]
108	[% IF ( casServerUrl ) %]	113	[% IF ( casServerUrl ) %]
Lines 158-164 Link Here
158	<a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>	163	<a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>
159	<p>If you do not have a Google account, but do have a local account, you can still log in: </p>	164	<p>If you do not have a Google account, but do have a local account, you can still log in: </p>
160	[% END # /IF GoogleOpenIDConnect %]	165	[% END # /IF GoogleOpenIDConnect %]
		166	[% END # /UNLESS opacShibOnly %]
161		167
		168	[% IF !Koha.Preference('opacShibOnly') or SCO_login or SCI_login %]
162	[% IF SCO_login %]	169	[% IF SCO_login %]
163	<form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">	170	<form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">
164	[% ELSIF SCI_login %]	171	[% ELSIF SCI_login %]
Lines 208-213 Link Here
208	[% END %]	215	[% END %]
209	</div>	216	</div>
210	</form>	217	</form>
		218	[% END # / IF !opacShibOnly or SCO_login or SCI_login %]
211	[% END # / IF loginprompt %]	219	[% END # / IF loginprompt %]
212		220
213	[% ELSE %]	221	[% ELSE %]
214	-