|
Lines 828-833
sub checkauth {
Link Here
|
| 828 |
|
828 |
|
| 829 |
# state variables |
829 |
# state variables |
| 830 |
my $loggedin = 0; |
830 |
my $loggedin = 0; |
|
|
831 |
my $auth_state = 'failed'; |
| 831 |
my %info; |
832 |
my %info; |
| 832 |
my ( $userid, $cookie, $sessionID, $flags ); |
833 |
my ( $userid, $cookie, $sessionID, $flags ); |
| 833 |
my $logout = $query->param('logout.x'); |
834 |
my $logout = $query->param('logout.x'); |
|
Lines 842-848
sub checkauth {
Link Here
|
| 842 |
my $session; |
843 |
my $session; |
| 843 |
my $invalid_otp_token; |
844 |
my $invalid_otp_token; |
| 844 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
845 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
| 845 |
my $auth_challenge_complete; |
|
|
| 846 |
|
846 |
|
| 847 |
# Basic authentication is incompatible with the use of Shibboleth, |
847 |
# Basic authentication is incompatible with the use of Shibboleth, |
| 848 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
848 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
Lines 878-889
sub checkauth {
Link Here
|
| 878 |
$userid = $session->param('id'); |
878 |
$userid = $session->param('id'); |
| 879 |
} |
879 |
} |
| 880 |
|
880 |
|
| 881 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
881 |
$auth_state = |
|
|
882 |
$return eq 'ok' ? 'completed' |
| 883 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
| 884 |
: 'failed'; |
| 882 |
|
885 |
|
| 883 |
# We are at the second screen if the waiting-for-2FA is set in session |
886 |
# We are at the second screen if the waiting-for-2FA is set in session |
| 884 |
# and otp_token param has been passed |
887 |
# and otp_token param has been passed |
| 885 |
if ( $require_2FA |
888 |
if ( $require_2FA |
| 886 |
&& $additional_auth_needed |
889 |
&& $auth_state eq 'additional-auth-needed' |
| 887 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
890 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
| 888 |
{ |
891 |
{ |
| 889 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
892 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
|
Lines 892-901
sub checkauth {
Link Here
|
| 892 |
$auth->clear; |
895 |
$auth->clear; |
| 893 |
if ( $verified ) { |
896 |
if ( $verified ) { |
| 894 |
# The token is correct, the user is fully logged in! |
897 |
# The token is correct, the user is fully logged in! |
| 895 |
$additional_auth_needed = 0; |
898 |
$auth_state = 'completed'; |
| 896 |
$session->param( 'waiting-for-2FA', 0 ); |
899 |
$session->param( 'waiting-for-2FA', 0 ); |
| 897 |
$return = "ok"; |
|
|
| 898 |
$auth_challenge_complete = 1; |
| 899 |
|
900 |
|
| 900 |
# This is an ugly trick to pass the test |
901 |
# This is an ugly trick to pass the test |
| 901 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
902 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
|
Lines 907-913
sub checkauth {
Link Here
|
| 907 |
} |
908 |
} |
| 908 |
} |
909 |
} |
| 909 |
|
910 |
|
| 910 |
if ( $return eq 'ok' ) { |
911 |
if ( $auth_state eq 'completed' ) { |
| 911 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
912 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
| 912 |
|
913 |
|
| 913 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
914 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
|
Lines 933-941
sub checkauth {
Link Here
|
| 933 |
my $sessiontype = $session->param('sessiontype') || ''; |
934 |
my $sessiontype = $session->param('sessiontype') || ''; |
| 934 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
935 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
| 935 |
$flags = haspermission( $userid, $flagsrequired ); |
936 |
$flags = haspermission( $userid, $flagsrequired ); |
| 936 |
if ($flags) { |
937 |
unless ( $flags ) { |
| 937 |
$loggedin = 1; |
938 |
$auth_state = 'failed'; |
| 938 |
} else { |
|
|
| 939 |
$info{'nopermission'} = 1; |
939 |
$info{'nopermission'} = 1; |
| 940 |
} |
940 |
} |
| 941 |
} |
941 |
} |
|
Lines 951-957
sub checkauth {
Link Here
|
| 951 |
} |
951 |
} |
| 952 |
} |
952 |
} |
| 953 |
|
953 |
|
| 954 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
954 |
if ( $auth_state eq 'failed' || $logout ) { |
| 955 |
$sessionID = undef; |
955 |
$sessionID = undef; |
| 956 |
$session = undef; |
956 |
$session = undef; |
| 957 |
$userid = undef; |
957 |
$userid = undef; |
|
Lines 980-986
sub checkauth {
Link Here
|
| 980 |
$sessionID = undef; |
980 |
$sessionID = undef; |
| 981 |
$session = undef; |
981 |
$session = undef; |
| 982 |
$userid = undef; |
982 |
$userid = undef; |
| 983 |
$additional_auth_needed = 0; |
983 |
$auth_state = 'logout'; |
| 984 |
} |
984 |
} |
| 985 |
|
985 |
|
| 986 |
unless ( $userid ) { |
986 |
unless ( $userid ) { |
|
Lines 1130-1136
sub checkauth {
Link Here
|
| 1130 |
if ($return) { |
1130 |
if ($return) { |
| 1131 |
|
1131 |
|
| 1132 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1132 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
| 1133 |
$loggedin = 1; |
1133 |
$auth_state = "logged_in"; |
| 1134 |
} |
1134 |
} |
| 1135 |
else { |
1135 |
else { |
| 1136 |
$info{'nopermission'} = 1; |
1136 |
$info{'nopermission'} = 1; |
|
Lines 1272-1289
sub checkauth {
Link Here
|
| 1272 |
} |
1272 |
} |
| 1273 |
} # END unless ($userid) |
1273 |
} # END unless ($userid) |
| 1274 |
|
1274 |
|
| 1275 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1275 |
|
|
|
1276 |
if ( $require_2FA && $auth_state eq 'logged_in' ) { |
| 1276 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1277 |
my $patron = Koha::Patrons->find({userid => $userid}); |
| 1277 |
if ( $patron->auth_method eq 'two-factor' ) { |
1278 |
if ( $patron->auth_method eq 'two-factor' ) { |
| 1278 |
# Ask for the OTP token |
1279 |
# Ask for the OTP token |
| 1279 |
$additional_auth_needed = 1; |
1280 |
$auth_state = 'additional-auth-needed'; |
| 1280 |
$session->param('waiting-for-2FA', 1); |
1281 |
$session->param('waiting-for-2FA', 1); |
| 1281 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1282 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
|
|
1283 |
} else { |
| 1284 |
$auth_state = 'completed'; |
| 1282 |
} |
1285 |
} |
| 1283 |
} |
1286 |
} |
| 1284 |
|
1287 |
|
| 1285 |
# finished authentification, now respond |
1288 |
# finished authentification, now respond |
| 1286 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1289 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
| 1287 |
# successful login |
1290 |
# successful login |
| 1288 |
unless ($cookie) { |
1291 |
unless ($cookie) { |
| 1289 |
$cookie = $query->cookie( |
1292 |
$cookie = $query->cookie( |
|
Lines 1377-1383
sub checkauth {
Link Here
|
| 1377 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1380 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
| 1378 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1381 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
| 1379 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1382 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
| 1380 |
if ( $additional_auth_needed ) { |
1383 |
if ( $auth_state eq 'additional-auth-needed' ) { |
| 1381 |
$template->param( |
1384 |
$template->param( |
| 1382 |
TwoFA_prompt => 1, |
1385 |
TwoFA_prompt => 1, |
| 1383 |
invalid_otp_token => $invalid_otp_token, |
1386 |
invalid_otp_token => $invalid_otp_token, |
| 1384 |
- |
|
|