|
Lines 32-37
use Koha;
Link Here
|
| 32 |
use Koha::Logger; |
32 |
use Koha::Logger; |
| 33 |
use Koha::Caches; |
33 |
use Koha::Caches; |
| 34 |
use Koha::AuthUtils qw( get_script_name hash_password ); |
34 |
use Koha::AuthUtils qw( get_script_name hash_password ); |
|
|
35 |
use Koha::Auth::TwoFactorAuth; |
| 35 |
use Koha::Checkouts; |
36 |
use Koha::Checkouts; |
| 36 |
use Koha::DateUtils qw( dt_from_string ); |
37 |
use Koha::DateUtils qw( dt_from_string ); |
| 37 |
use Koha::Library::Groups; |
38 |
use Koha::Library::Groups; |
|
Lines 839-844
sub checkauth {
Link Here
|
| 839 |
my $q_userid = $query->param('userid') // ''; |
840 |
my $q_userid = $query->param('userid') // ''; |
| 840 |
|
841 |
|
| 841 |
my $session; |
842 |
my $session; |
|
|
843 |
my $invalid_otp_token; |
| 844 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
| 845 |
my $auth_challenge_complete; |
| 842 |
|
846 |
|
| 843 |
# Basic authentication is incompatible with the use of Shibboleth, |
847 |
# Basic authentication is incompatible with the use of Shibboleth, |
| 844 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
848 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
Lines 870-882
sub checkauth {
Link Here
|
| 870 |
{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } |
874 |
{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } |
| 871 |
); |
875 |
); |
| 872 |
|
876 |
|
|
|
877 |
if ( $return eq 'ok' || $return eq 'additional-auth-needed' ) { |
| 878 |
$userid = $session->param('id'); |
| 879 |
} |
| 880 |
|
| 881 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
| 882 |
|
| 883 |
# We are at the second screen if the waiting-for-2FA is set in session |
| 884 |
# and otp_token param has been passed |
| 885 |
if ( $require_2FA |
| 886 |
&& $additional_auth_needed |
| 887 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
| 888 |
{ |
| 889 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
| 890 |
my $auth = Koha::Auth::TwoFactorAuth::get_auth( { patron => $patron } ); |
| 891 |
my $verified = $auth->verify($otp_token); |
| 892 |
$auth->clear; |
| 893 |
if ( $verified ) { |
| 894 |
# The token is correct, the user is fully logged in! |
| 895 |
$additional_auth_needed = 0; |
| 896 |
$session->param( 'waiting-for-2FA', 0 ); |
| 897 |
$return = "ok"; |
| 898 |
$auth_challenge_complete = 1; |
| 899 |
|
| 900 |
# This is an ugly trick to pass the test |
| 901 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
| 902 |
# few lines later |
| 903 |
$q_userid = $userid; |
| 904 |
} |
| 905 |
else { |
| 906 |
$invalid_otp_token = 1; |
| 907 |
} |
| 908 |
} |
| 909 |
|
| 873 |
if ( $return eq 'ok' ) { |
910 |
if ( $return eq 'ok' ) { |
| 874 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
911 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
| 875 |
|
912 |
|
| 876 |
my $s_userid = $session->param('id'); |
913 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
| 877 |
$userid = $s_userid; |
|
|
| 878 |
|
| 879 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $s_userid ) ) |
| 880 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
914 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
| 881 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
915 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
| 882 |
) { |
916 |
) { |
|
Lines 887-911
sub checkauth {
Link Here
|
| 887 |
$session->delete(); |
921 |
$session->delete(); |
| 888 |
$session->flush; |
922 |
$session->flush; |
| 889 |
C4::Context->_unset_userenv($sessionID); |
923 |
C4::Context->_unset_userenv($sessionID); |
| 890 |
} |
924 |
} elsif (!$logout) { |
| 891 |
elsif ($logout) { |
|
|
| 892 |
|
| 893 |
# voluntary logout the user |
| 894 |
# check wether the user was using their shibboleth session or a local one |
| 895 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
| 896 |
$session->delete(); |
| 897 |
$session->flush; |
| 898 |
C4::Context->_unset_userenv($sessionID); |
| 899 |
|
| 900 |
if ($cas and $caslogout) { |
| 901 |
logout_cas($query, $type); |
| 902 |
} |
| 903 |
|
| 904 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
| 905 |
if ( $shib and $shib_login and $shibSuccess) { |
| 906 |
logout_shib($query); |
| 907 |
} |
| 908 |
} else { |
| 909 |
|
925 |
|
| 910 |
$cookie = $query->cookie( |
926 |
$cookie = $query->cookie( |
| 911 |
-name => 'CGISESSID', |
927 |
-name => 'CGISESSID', |
|
Lines 935-948
sub checkauth {
Link Here
|
| 935 |
} |
951 |
} |
| 936 |
} |
952 |
} |
| 937 |
|
953 |
|
| 938 |
unless ( $loggedin ) { |
954 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
| 939 |
$sessionID = undef; |
955 |
$sessionID = undef; |
|
|
956 |
$session = undef; |
| 940 |
$userid = undef; |
957 |
$userid = undef; |
| 941 |
} |
958 |
} |
| 942 |
|
959 |
|
|
|
960 |
if ($logout) { |
| 961 |
|
| 962 |
# voluntary logout the user |
| 963 |
# check wether the user was using their shibboleth session or a local one |
| 964 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
| 965 |
if ( $session ) { |
| 966 |
$session->delete(); |
| 967 |
$session->flush; |
| 968 |
} |
| 969 |
C4::Context->_unset_userenv($sessionID); |
| 970 |
|
| 971 |
if ($cas and $caslogout) { |
| 972 |
logout_cas($query, $type); |
| 973 |
} |
| 974 |
|
| 975 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
| 976 |
if ( $shib and $shib_login and $shibSuccess) { |
| 977 |
logout_shib($query); |
| 978 |
} |
| 979 |
|
| 980 |
$sessionID = undef; |
| 981 |
$session = undef; |
| 982 |
$userid = undef; |
| 983 |
$additional_auth_needed = 0; |
| 984 |
} |
| 985 |
|
| 943 |
unless ( $userid ) { |
986 |
unless ( $userid ) { |
| 944 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
987 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
| 945 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
988 |
$session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
| 946 |
|
989 |
|
| 947 |
# Save anonymous search history in new session so it can be retrieved |
990 |
# Save anonymous search history in new session so it can be retrieved |
| 948 |
# by get_template_and_user to store it in user's search history after |
991 |
# by get_template_and_user to store it in user's search history after |
|
Lines 1229-1237
sub checkauth {
Link Here
|
| 1229 |
} |
1272 |
} |
| 1230 |
} # END unless ($userid) |
1273 |
} # END unless ($userid) |
| 1231 |
|
1274 |
|
|
|
1275 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
| 1276 |
my $patron = Koha::Patrons->find({userid => $userid}); |
| 1277 |
if ( $patron->auth_method eq 'two-factor' ) { |
| 1278 |
# Ask for the OTP token |
| 1279 |
$additional_auth_needed = 1; |
| 1280 |
$session->param('waiting-for-2FA', 1); |
| 1281 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
| 1282 |
} |
| 1283 |
} |
| 1284 |
|
| 1232 |
# finished authentification, now respond |
1285 |
# finished authentification, now respond |
| 1233 |
if ( $loggedin || $authnotrequired ) |
1286 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
| 1234 |
{ |
|
|
| 1235 |
# successful login |
1287 |
# successful login |
| 1236 |
unless ($cookie) { |
1288 |
unless ($cookie) { |
| 1237 |
$cookie = $query->cookie( |
1289 |
$cookie = $query->cookie( |
|
Lines 1265-1280
sub checkauth {
Link Here
|
| 1265 |
# |
1317 |
# |
| 1266 |
# |
1318 |
# |
| 1267 |
|
1319 |
|
|
|
1320 |
my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! |
| 1321 |
|
| 1268 |
# get the inputs from the incoming query |
1322 |
# get the inputs from the incoming query |
| 1269 |
my @inputs = (); |
1323 |
my @inputs = (); |
|
|
1324 |
my @inputs_to_clean = qw( userid password ticket logout.x otp_token ); |
| 1270 |
foreach my $name ( param $query) { |
1325 |
foreach my $name ( param $query) { |
| 1271 |
(next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' ); |
1326 |
next if grep { $name eq $_ } @inputs_to_clean; |
| 1272 |
my @value = $query->multi_param($name); |
1327 |
my @value = $query->multi_param($name); |
| 1273 |
push @inputs, { name => $name, value => $_ } for @value; |
1328 |
push @inputs, { name => $name, value => $_ } for @value; |
| 1274 |
} |
1329 |
} |
| 1275 |
|
1330 |
|
| 1276 |
my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! |
|
|
| 1277 |
|
| 1278 |
my $LibraryNameTitle = C4::Context->preference("LibraryName"); |
1331 |
my $LibraryNameTitle = C4::Context->preference("LibraryName"); |
| 1279 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
1332 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
| 1280 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
1333 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
|
Lines 1324-1329
sub checkauth {
Link Here
|
| 1324 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1377 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
| 1325 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1378 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
| 1326 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1379 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
|
|
1380 |
if ( $additional_auth_needed ) { |
| 1381 |
$template->param( |
| 1382 |
TwoFA_prompt => 1, |
| 1383 |
invalid_otp_token => $invalid_otp_token, |
| 1384 |
); |
| 1385 |
} |
| 1327 |
|
1386 |
|
| 1328 |
if ( $type eq 'opac' ) { |
1387 |
if ( $type eq 'opac' ) { |
| 1329 |
require Koha::Virtualshelves; |
1388 |
require Koha::Virtualshelves; |
|
Lines 1431-1436
Possible return values in C<$status> are:
Link Here
|
| 1431 |
|
1490 |
|
| 1432 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
1491 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
| 1433 |
|
1492 |
|
|
|
1493 |
=item "additional-auth-needed -- User is in an authentication process that is not finished |
| 1494 |
|
| 1434 |
=back |
1495 |
=back |
| 1435 |
|
1496 |
|
| 1436 |
=cut |
1497 |
=cut |
|
Lines 1706-1711
sub check_cookie_auth {
Link Here
|
| 1706 |
$session->param( 'lasttime', time() ); |
1767 |
$session->param( 'lasttime', time() ); |
| 1707 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1768 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
| 1708 |
if ($flags) { |
1769 |
if ($flags) { |
|
|
1770 |
|
| 1771 |
return ( "additional-auth-needed", $session ) |
| 1772 |
if $session->param('waiting-for-2FA'); |
| 1773 |
|
| 1709 |
return ( "ok", $session ); |
1774 |
return ( "ok", $session ); |
| 1710 |
} else { |
1775 |
} else { |
| 1711 |
$session->delete(); |
1776 |
$session->delete(); |