| Lines 828-833
          sub checkauth {
      
      
        Link Here | 
        
          | 828 |  | 828 |  | 
        
          | 829 |     # state variables | 829 |     # state variables | 
        
          | 830 |     my $loggedin = 0; | 830 |     my $loggedin = 0; | 
            
              |  |  | 831 |     my $auth_state = 'failed'; | 
        
          | 831 |     my %info; | 832 |     my %info; | 
        
          | 832 |     my ( $userid, $cookie, $sessionID, $flags ); | 833 |     my ( $userid, $cookie, $sessionID, $flags ); | 
        
          | 833 |     my $logout = $query->param('logout.x'); | 834 |     my $logout = $query->param('logout.x'); | 
  
    | Lines 842-848
          sub checkauth {
      
      
        Link Here | 
        
          | 842 |     my $session; | 843 |     my $session; | 
        
          | 843 |     my $invalid_otp_token; | 844 |     my $invalid_otp_token; | 
        
          | 844 |     my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; | 845 |     my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; | 
            
              | 845 |     my $auth_challenge_complete; |  |  | 
        
          | 846 |  | 846 |  | 
        
          | 847 |     # Basic authentication is incompatible with the use of Shibboleth, | 847 |     # Basic authentication is incompatible with the use of Shibboleth, | 
        
          | 848 |     # as Shibboleth may return REMOTE_USER as a Shibboleth attribute, | 848 |     # as Shibboleth may return REMOTE_USER as a Shibboleth attribute, | 
  
    | Lines 878-889
          sub checkauth {
      
      
        Link Here | 
        
          | 878 |             $userid = $session->param('id'); | 878 |             $userid = $session->param('id'); | 
        
          | 879 |         } | 879 |         } | 
        
          | 880 |  | 880 |  | 
          
            
              | 881 |         $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; | 881 |         $auth_state = | 
            
              |  |  | 882 |             $return eq 'ok'                     ? 'completed' | 
            
              | 883 |           : $return eq 'additional-auth-needed' ? 'additional-auth-needed' | 
            
              | 884 |           :                                       'failed'; | 
        
          | 882 |  | 885 |  | 
        
          | 883 |         # We are at the second screen if the waiting-for-2FA is set in session | 886 |         # We are at the second screen if the waiting-for-2FA is set in session | 
        
          | 884 |         # and otp_token param has been passed | 887 |         # and otp_token param has been passed | 
        
          | 885 |         if (   $require_2FA | 888 |         if (   $require_2FA | 
          
            
              | 886 |             && $additional_auth_needed | 889 |             && $auth_state eq 'additional-auth-needed' | 
        
          | 887 |             && ( my $otp_token = $query->param('otp_token') ) ) | 890 |             && ( my $otp_token = $query->param('otp_token') ) ) | 
        
          | 888 |         { | 891 |         { | 
        
          | 889 |             my $patron    = Koha::Patrons->find( { userid => $userid } ); | 892 |             my $patron    = Koha::Patrons->find( { userid => $userid } ); | 
  
    | Lines 892-901
          sub checkauth {
      
      
        Link Here | 
        
          | 892 |             $auth->clear; | 895 |             $auth->clear; | 
        
          | 893 |             if ( $verified ) { | 896 |             if ( $verified ) { | 
        
          | 894 |                 # The token is correct, the user is fully logged in! | 897 |                 # The token is correct, the user is fully logged in! | 
          
            
              | 895 |                 $additional_auth_needed = 0; | 898 |                 $auth_state = 'completed'; | 
        
          | 896 |                 $session->param( 'waiting-for-2FA', 0 ); | 899 |                 $session->param( 'waiting-for-2FA', 0 ); | 
            
              | 897 |                 $return = "ok"; |  |  | 
            
              | 898 |                 $auth_challenge_complete = 1; | 
        
          | 899 |  | 900 |  | 
        
          | 900 |                # This is an ugly trick to pass the test | 901 |                # This is an ugly trick to pass the test | 
        
          | 901 |                # $query->param('koha_login_context') && ( $q_userid ne $userid ) | 902 |                # $query->param('koha_login_context') && ( $q_userid ne $userid ) | 
  
    | Lines 907-913
          sub checkauth {
      
      
        Link Here | 
        
          | 907 |             } | 908 |             } | 
        
          | 908 |         } | 909 |         } | 
        
          | 909 |  | 910 |  | 
          
            
              | 910 |         if ( $return eq 'ok' ) { | 911 |         if ( $auth_state eq 'completed' ) { | 
        
          | 911 |             Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); | 912 |             Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); | 
        
          | 912 |  | 913 |  | 
        
          | 913 |             if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) | 914 |             if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) | 
  
    | Lines 933-941
          sub checkauth {
      
      
        Link Here | 
        
          | 933 |                 my $sessiontype = $session->param('sessiontype') || ''; | 934 |                 my $sessiontype = $session->param('sessiontype') || ''; | 
        
          | 934 |                 unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... | 935 |                 unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... | 
        
          | 935 |                     $flags = haspermission( $userid, $flagsrequired ); | 936 |                     $flags = haspermission( $userid, $flagsrequired ); | 
          
            
              | 936 |                     if ($flags) { | 937 |                     unless ( $flags ) { | 
            
              | 937 |                         $loggedin = 1; | 938 |                         $auth_state = 'failed'; | 
            
              | 938 |                     } else { |  |  | 
        
          | 939 |                         $info{'nopermission'} = 1; | 939 |                         $info{'nopermission'} = 1; | 
        
          | 940 |                     } | 940 |                     } | 
        
          | 941 |                 } | 941 |                 } | 
  
    | Lines 951-957
          sub checkauth {
      
      
        Link Here | 
        
          | 951 |         } | 951 |         } | 
        
          | 952 |     } | 952 |     } | 
        
          | 953 |  | 953 |  | 
          
            
              | 954 |     if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { | 954 |     if ( $auth_state eq 'failed' || $logout ) { | 
        
          | 955 |         $sessionID = undef; | 955 |         $sessionID = undef; | 
        
          | 956 |         $session   = undef; | 956 |         $session   = undef; | 
        
          | 957 |         $userid    = undef; | 957 |         $userid    = undef; | 
  
    | Lines 980-986
          sub checkauth {
      
      
        Link Here | 
        
          | 980 |         $sessionID = undef; | 980 |         $sessionID = undef; | 
        
          | 981 |         $session   = undef; | 981 |         $session   = undef; | 
        
          | 982 |         $userid    = undef; | 982 |         $userid    = undef; | 
          
            
              | 983 |         $additional_auth_needed = 0; | 983 |         $auth_state = 'logout'; | 
        
          | 984 |     } | 984 |     } | 
        
          | 985 |  | 985 |  | 
        
          | 986 |     unless ( $userid ) { | 986 |     unless ( $userid ) { | 
  
    | Lines 1130-1136
          sub checkauth {
      
      
        Link Here | 
        
          | 1130 |             if ($return) { | 1130 |             if ($return) { | 
        
          | 1131 |  | 1131 |  | 
        
          | 1132 |                 if ( $flags = haspermission( $userid, $flagsrequired ) ) { | 1132 |                 if ( $flags = haspermission( $userid, $flagsrequired ) ) { | 
          
            
              | 1133 |                     $loggedin = 1; | 1133 |                     $auth_state = "logged_in"; | 
        
          | 1134 |                 } | 1134 |                 } | 
        
          | 1135 |                 else { | 1135 |                 else { | 
        
          | 1136 |                     $info{'nopermission'} = 1; | 1136 |                     $info{'nopermission'} = 1; | 
  
    | Lines 1272-1289
          sub checkauth {
      
      
        Link Here | 
        
          | 1272 |         } | 1272 |         } | 
        
          | 1273 |     }    # END unless ($userid) | 1273 |     }    # END unless ($userid) | 
        
          | 1274 |  | 1274 |  | 
          
            
              | 1275 |     if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { | 1275 |  | 
            
              |  |  | 1276 |     if ( $require_2FA && $auth_state eq 'logged_in' ) { | 
        
          | 1276 |         my $patron = Koha::Patrons->find({userid => $userid}); | 1277 |         my $patron = Koha::Patrons->find({userid => $userid}); | 
        
          | 1277 |         if ( $patron->auth_method eq 'two-factor' ) { | 1278 |         if ( $patron->auth_method eq 'two-factor' ) { | 
        
          | 1278 |             # Ask for the OTP token | 1279 |             # Ask for the OTP token | 
          
            
              | 1279 |             $additional_auth_needed = 1; | 1280 |             $auth_state = 'additional-auth-needed'; | 
        
          | 1280 |             $session->param('waiting-for-2FA', 1); | 1281 |             $session->param('waiting-for-2FA', 1); | 
        
          | 1281 |             %info = ();# We remove the warnings/errors we may have set incorrectly before | 1282 |             %info = ();# We remove the warnings/errors we may have set incorrectly before | 
            
              |  |  | 1283 |         } else { | 
            
              | 1284 |             $auth_state = 'completed'; | 
        
          | 1282 |         } | 1285 |         } | 
        
          | 1283 |     } | 1286 |     } | 
        
          | 1284 |  | 1287 |  | 
        
          | 1285 |     # finished authentification, now respond | 1288 |     # finished authentification, now respond | 
          
            
              | 1286 |     if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { | 1289 |     if ( $auth_state eq 'completed' || $authnotrequired ) { | 
        
          | 1287 |         # successful login | 1290 |         # successful login | 
        
          | 1288 |         unless ($cookie) { | 1291 |         unless ($cookie) { | 
        
          | 1289 |             $cookie = $query->cookie( | 1292 |             $cookie = $query->cookie( | 
  
    | Lines 1377-1383
          sub checkauth {
      
      
        Link Here | 
        
          | 1377 |     $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); | 1380 |     $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); | 
        
          | 1378 |     $template->param( OpacPublic => C4::Context->preference("OpacPublic") ); | 1381 |     $template->param( OpacPublic => C4::Context->preference("OpacPublic") ); | 
        
          | 1379 |     $template->param( loginprompt => 1 ) unless $info{'nopermission'}; | 1382 |     $template->param( loginprompt => 1 ) unless $info{'nopermission'}; | 
          
            
              | 1380 |     if ( $additional_auth_needed ) { | 1383 |     if ( $auth_state eq 'additional-auth-needed' ) { | 
        
          | 1381 |         $template->param( | 1384 |         $template->param( | 
        
          | 1382 |             TwoFA_prompt => 1, | 1385 |             TwoFA_prompt => 1, | 
        
          | 1383 |             invalid_otp_token => $invalid_otp_token, | 1386 |             invalid_otp_token => $invalid_otp_token, | 
            
              | 1384 | -  |  |  |