Lines 32-37
use Koha;
Link Here
|
32 |
use Koha::Logger; |
32 |
use Koha::Logger; |
33 |
use Koha::Caches; |
33 |
use Koha::Caches; |
34 |
use Koha::AuthUtils qw( get_script_name hash_password ); |
34 |
use Koha::AuthUtils qw( get_script_name hash_password ); |
|
|
35 |
use Koha::Auth::TwoFactorAuth; |
35 |
use Koha::Checkouts; |
36 |
use Koha::Checkouts; |
36 |
use Koha::DateUtils qw( dt_from_string ); |
37 |
use Koha::DateUtils qw( dt_from_string ); |
37 |
use Koha::Library::Groups; |
38 |
use Koha::Library::Groups; |
Lines 839-844
sub checkauth {
Link Here
|
839 |
my $q_userid = $query->param('userid') // ''; |
840 |
my $q_userid = $query->param('userid') // ''; |
840 |
|
841 |
|
841 |
my $session; |
842 |
my $session; |
|
|
843 |
my $invalid_otp_token; |
844 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
845 |
my $auth_challenge_complete; |
842 |
|
846 |
|
843 |
# Basic authentication is incompatible with the use of Shibboleth, |
847 |
# Basic authentication is incompatible with the use of Shibboleth, |
844 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
848 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
Lines 870-882
sub checkauth {
Link Here
|
870 |
{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } |
874 |
{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } |
871 |
); |
875 |
); |
872 |
|
876 |
|
|
|
877 |
if ( $return eq 'ok' || $return eq 'additional-auth-needed' ) { |
878 |
$userid = $session->param('id'); |
879 |
} |
880 |
|
881 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
882 |
|
883 |
# We are at the second screen if the waiting-for-2FA is set in session |
884 |
# and otp_token param has been passed |
885 |
if ( $require_2FA |
886 |
&& $additional_auth_needed |
887 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
888 |
{ |
889 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
890 |
my $auth = Koha::Auth::TwoFactorAuth::get_auth( { patron => $patron } ); |
891 |
my $verified = $auth->verify($otp_token); |
892 |
$auth->clear; |
893 |
if ( $verified ) { |
894 |
# The token is correct, the user is fully logged in! |
895 |
$additional_auth_needed = 0; |
896 |
$session->param( 'waiting-for-2FA', 0 ); |
897 |
$return = "ok"; |
898 |
$auth_challenge_complete = 1; |
899 |
|
900 |
# This is an ugly trick to pass the test |
901 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
902 |
# few lines later |
903 |
$q_userid = $userid; |
904 |
} |
905 |
else { |
906 |
$invalid_otp_token = 1; |
907 |
} |
908 |
} |
909 |
|
873 |
if ( $return eq 'ok' ) { |
910 |
if ( $return eq 'ok' ) { |
874 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
911 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
875 |
|
912 |
|
876 |
my $s_userid = $session->param('id'); |
913 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
877 |
$userid = $s_userid; |
|
|
878 |
|
879 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $s_userid ) ) |
880 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
914 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
881 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
915 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
882 |
) { |
916 |
) { |
Lines 887-911
sub checkauth {
Link Here
|
887 |
$session->delete(); |
921 |
$session->delete(); |
888 |
$session->flush; |
922 |
$session->flush; |
889 |
C4::Context->_unset_userenv($sessionID); |
923 |
C4::Context->_unset_userenv($sessionID); |
890 |
} |
924 |
} elsif (!$logout) { |
891 |
elsif ($logout) { |
|
|
892 |
|
893 |
# voluntary logout the user |
894 |
# check wether the user was using their shibboleth session or a local one |
895 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
896 |
$session->delete(); |
897 |
$session->flush; |
898 |
C4::Context->_unset_userenv($sessionID); |
899 |
|
900 |
if ($cas and $caslogout) { |
901 |
logout_cas($query, $type); |
902 |
} |
903 |
|
904 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
905 |
if ( $shib and $shib_login and $shibSuccess) { |
906 |
logout_shib($query); |
907 |
} |
908 |
} else { |
909 |
|
925 |
|
910 |
$cookie = $query->cookie( |
926 |
$cookie = $query->cookie( |
911 |
-name => 'CGISESSID', |
927 |
-name => 'CGISESSID', |
Lines 935-948
sub checkauth {
Link Here
|
935 |
} |
951 |
} |
936 |
} |
952 |
} |
937 |
|
953 |
|
938 |
unless ( $loggedin ) { |
954 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
939 |
$sessionID = undef; |
955 |
$sessionID = undef; |
|
|
956 |
$session = undef; |
940 |
$userid = undef; |
957 |
$userid = undef; |
941 |
} |
958 |
} |
942 |
|
959 |
|
|
|
960 |
if ($logout) { |
961 |
|
962 |
# voluntary logout the user |
963 |
# check wether the user was using their shibboleth session or a local one |
964 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
965 |
if ( $session ) { |
966 |
$session->delete(); |
967 |
$session->flush; |
968 |
} |
969 |
C4::Context->_unset_userenv($sessionID); |
970 |
|
971 |
if ($cas and $caslogout) { |
972 |
logout_cas($query, $type); |
973 |
} |
974 |
|
975 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
976 |
if ( $shib and $shib_login and $shibSuccess) { |
977 |
logout_shib($query); |
978 |
} |
979 |
|
980 |
$sessionID = undef; |
981 |
$session = undef; |
982 |
$userid = undef; |
983 |
$additional_auth_needed = 0; |
984 |
} |
985 |
|
943 |
unless ( $userid ) { |
986 |
unless ( $userid ) { |
944 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
987 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
945 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
988 |
$session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
946 |
|
989 |
|
947 |
# Save anonymous search history in new session so it can be retrieved |
990 |
# Save anonymous search history in new session so it can be retrieved |
948 |
# by get_template_and_user to store it in user's search history after |
991 |
# by get_template_and_user to store it in user's search history after |
Lines 1229-1237
sub checkauth {
Link Here
|
1229 |
} |
1272 |
} |
1230 |
} # END unless ($userid) |
1273 |
} # END unless ($userid) |
1231 |
|
1274 |
|
|
|
1275 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1276 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1277 |
if ( $patron->auth_method eq 'two-factor' ) { |
1278 |
# Ask for the OTP token |
1279 |
$additional_auth_needed = 1; |
1280 |
$session->param('waiting-for-2FA', 1); |
1281 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1282 |
} |
1283 |
} |
1284 |
|
1232 |
# finished authentification, now respond |
1285 |
# finished authentification, now respond |
1233 |
if ( $loggedin || $authnotrequired ) |
1286 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1234 |
{ |
|
|
1235 |
# successful login |
1287 |
# successful login |
1236 |
unless ($cookie) { |
1288 |
unless ($cookie) { |
1237 |
$cookie = $query->cookie( |
1289 |
$cookie = $query->cookie( |
Lines 1265-1280
sub checkauth {
Link Here
|
1265 |
# |
1317 |
# |
1266 |
# |
1318 |
# |
1267 |
|
1319 |
|
|
|
1320 |
my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! |
1321 |
|
1268 |
# get the inputs from the incoming query |
1322 |
# get the inputs from the incoming query |
1269 |
my @inputs = (); |
1323 |
my @inputs = (); |
|
|
1324 |
my @inputs_to_clean = qw( userid password ticket logout.x otp_token ); |
1270 |
foreach my $name ( param $query) { |
1325 |
foreach my $name ( param $query) { |
1271 |
(next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' ); |
1326 |
next if grep { $name eq $_ } @inputs_to_clean; |
1272 |
my @value = $query->multi_param($name); |
1327 |
my @value = $query->multi_param($name); |
1273 |
push @inputs, { name => $name, value => $_ } for @value; |
1328 |
push @inputs, { name => $name, value => $_ } for @value; |
1274 |
} |
1329 |
} |
1275 |
|
1330 |
|
1276 |
my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! |
|
|
1277 |
|
1278 |
my $LibraryNameTitle = C4::Context->preference("LibraryName"); |
1331 |
my $LibraryNameTitle = C4::Context->preference("LibraryName"); |
1279 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
1332 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
1280 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
1333 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
Lines 1324-1329
sub checkauth {
Link Here
|
1324 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1377 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1325 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1378 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1326 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1379 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
|
|
1380 |
if ( $additional_auth_needed ) { |
1381 |
$template->param( |
1382 |
TwoFA_prompt => 1, |
1383 |
invalid_otp_token => $invalid_otp_token, |
1384 |
); |
1385 |
} |
1327 |
|
1386 |
|
1328 |
if ( $type eq 'opac' ) { |
1387 |
if ( $type eq 'opac' ) { |
1329 |
require Koha::Virtualshelves; |
1388 |
require Koha::Virtualshelves; |
Lines 1431-1436
Possible return values in C<$status> are:
Link Here
|
1431 |
|
1490 |
|
1432 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
1491 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
1433 |
|
1492 |
|
|
|
1493 |
=item "additional-auth-needed -- User is in an authentication process that is not finished |
1494 |
|
1434 |
=back |
1495 |
=back |
1435 |
|
1496 |
|
1436 |
=cut |
1497 |
=cut |
Lines 1706-1711
sub check_cookie_auth {
Link Here
|
1706 |
$session->param( 'lasttime', time() ); |
1767 |
$session->param( 'lasttime', time() ); |
1707 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1768 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1708 |
if ($flags) { |
1769 |
if ($flags) { |
|
|
1770 |
|
1771 |
return ( "additional-auth-needed", $session ) |
1772 |
if $session->param('waiting-for-2FA'); |
1773 |
|
1709 |
return ( "ok", $session ); |
1774 |
return ( "ok", $session ); |
1710 |
} else { |
1775 |
} else { |
1711 |
$session->delete(); |
1776 |
$session->delete(); |