Lines 832-837
sub checkauth {
Link Here
|
832 |
|
832 |
|
833 |
# state variables |
833 |
# state variables |
834 |
my $loggedin = 0; |
834 |
my $loggedin = 0; |
|
|
835 |
my $auth_state = 'failed'; |
835 |
my %info; |
836 |
my %info; |
836 |
my ( $userid, $cookie, $sessionID, $flags ); |
837 |
my ( $userid, $cookie, $sessionID, $flags ); |
837 |
my $logout = $query->param('logout.x'); |
838 |
my $logout = $query->param('logout.x'); |
Lines 846-852
sub checkauth {
Link Here
|
846 |
my $session; |
847 |
my $session; |
847 |
my $invalid_otp_token; |
848 |
my $invalid_otp_token; |
848 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
849 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
849 |
my $auth_challenge_complete; |
|
|
850 |
|
850 |
|
851 |
# Basic authentication is incompatible with the use of Shibboleth, |
851 |
# Basic authentication is incompatible with the use of Shibboleth, |
852 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
852 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
Lines 882-893
sub checkauth {
Link Here
|
882 |
$userid = $session->param('id'); |
882 |
$userid = $session->param('id'); |
883 |
} |
883 |
} |
884 |
|
884 |
|
885 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
885 |
$auth_state = |
|
|
886 |
$return eq 'ok' ? 'completed' |
887 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
888 |
: 'failed'; |
886 |
|
889 |
|
887 |
# We are at the second screen if the waiting-for-2FA is set in session |
890 |
# We are at the second screen if the waiting-for-2FA is set in session |
888 |
# and otp_token param has been passed |
891 |
# and otp_token param has been passed |
889 |
if ( $require_2FA |
892 |
if ( $require_2FA |
890 |
&& $additional_auth_needed |
893 |
&& $auth_state eq 'additional-auth-needed' |
891 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
894 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
892 |
{ |
895 |
{ |
893 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
896 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
Lines 896-905
sub checkauth {
Link Here
|
896 |
$auth->clear; |
899 |
$auth->clear; |
897 |
if ( $verified ) { |
900 |
if ( $verified ) { |
898 |
# The token is correct, the user is fully logged in! |
901 |
# The token is correct, the user is fully logged in! |
899 |
$additional_auth_needed = 0; |
902 |
$auth_state = 'completed'; |
900 |
$session->param( 'waiting-for-2FA', 0 ); |
903 |
$session->param( 'waiting-for-2FA', 0 ); |
901 |
$return = "ok"; |
|
|
902 |
$auth_challenge_complete = 1; |
903 |
|
904 |
|
904 |
# This is an ugly trick to pass the test |
905 |
# This is an ugly trick to pass the test |
905 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
906 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
Lines 911-917
sub checkauth {
Link Here
|
911 |
} |
912 |
} |
912 |
} |
913 |
} |
913 |
|
914 |
|
914 |
if ( $return eq 'ok' ) { |
915 |
if ( $auth_state eq 'completed' ) { |
915 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
916 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
916 |
|
917 |
|
917 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
918 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
Lines 937-945
sub checkauth {
Link Here
|
937 |
my $sessiontype = $session->param('sessiontype') || ''; |
938 |
my $sessiontype = $session->param('sessiontype') || ''; |
938 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
939 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
939 |
$flags = haspermission( $userid, $flagsrequired ); |
940 |
$flags = haspermission( $userid, $flagsrequired ); |
940 |
if ($flags) { |
941 |
unless ( $flags ) { |
941 |
$loggedin = 1; |
942 |
$auth_state = 'failed'; |
942 |
} else { |
|
|
943 |
$info{'nopermission'} = 1; |
943 |
$info{'nopermission'} = 1; |
944 |
} |
944 |
} |
945 |
} |
945 |
} |
Lines 955-961
sub checkauth {
Link Here
|
955 |
} |
955 |
} |
956 |
} |
956 |
} |
957 |
|
957 |
|
958 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
958 |
if ( $auth_state eq 'failed' || $logout ) { |
959 |
$sessionID = undef; |
959 |
$sessionID = undef; |
960 |
$session = undef; |
960 |
$session = undef; |
961 |
$userid = undef; |
961 |
$userid = undef; |
Lines 984-990
sub checkauth {
Link Here
|
984 |
$sessionID = undef; |
984 |
$sessionID = undef; |
985 |
$session = undef; |
985 |
$session = undef; |
986 |
$userid = undef; |
986 |
$userid = undef; |
987 |
$additional_auth_needed = 0; |
987 |
$auth_state = 'logout'; |
988 |
} |
988 |
} |
989 |
|
989 |
|
990 |
unless ( $userid ) { |
990 |
unless ( $userid ) { |
Lines 1134-1140
sub checkauth {
Link Here
|
1134 |
if ($return) { |
1134 |
if ($return) { |
1135 |
|
1135 |
|
1136 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1136 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1137 |
$loggedin = 1; |
1137 |
$auth_state = "logged_in"; |
1138 |
} |
1138 |
} |
1139 |
else { |
1139 |
else { |
1140 |
$info{'nopermission'} = 1; |
1140 |
$info{'nopermission'} = 1; |
Lines 1276-1293
sub checkauth {
Link Here
|
1276 |
} |
1276 |
} |
1277 |
} # END unless ($userid) |
1277 |
} # END unless ($userid) |
1278 |
|
1278 |
|
1279 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1279 |
|
|
|
1280 |
if ( $require_2FA && $auth_state eq 'logged_in' ) { |
1280 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1281 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1281 |
if ( $patron->auth_method eq 'two-factor' ) { |
1282 |
if ( $patron->auth_method eq 'two-factor' ) { |
1282 |
# Ask for the OTP token |
1283 |
# Ask for the OTP token |
1283 |
$additional_auth_needed = 1; |
1284 |
$auth_state = 'additional-auth-needed'; |
1284 |
$session->param('waiting-for-2FA', 1); |
1285 |
$session->param('waiting-for-2FA', 1); |
1285 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1286 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
|
|
1287 |
} else { |
1288 |
$auth_state = 'completed'; |
1286 |
} |
1289 |
} |
1287 |
} |
1290 |
} |
1288 |
|
1291 |
|
1289 |
# finished authentification, now respond |
1292 |
# finished authentification, now respond |
1290 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1293 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
1291 |
# successful login |
1294 |
# successful login |
1292 |
unless ($cookie) { |
1295 |
unless ($cookie) { |
1293 |
$cookie = $query->cookie( |
1296 |
$cookie = $query->cookie( |
Lines 1381-1387
sub checkauth {
Link Here
|
1381 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1384 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1382 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1385 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1383 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1386 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1384 |
if ( $additional_auth_needed ) { |
1387 |
if ( $auth_state eq 'additional-auth-needed' ) { |
1385 |
$template->param( |
1388 |
$template->param( |
1386 |
TwoFA_prompt => 1, |
1389 |
TwoFA_prompt => 1, |
1387 |
invalid_otp_token => $invalid_otp_token, |
1390 |
invalid_otp_token => $invalid_otp_token, |
1388 |
- |
|
|