Lines 34-39
use Koha;
Link Here
|
34 |
use Koha::Logger; |
34 |
use Koha::Logger; |
35 |
use Koha::Caches; |
35 |
use Koha::Caches; |
36 |
use Koha::AuthUtils qw( get_script_name hash_password ); |
36 |
use Koha::AuthUtils qw( get_script_name hash_password ); |
|
|
37 |
use Koha::Auth::TwoFactorAuth; |
37 |
use Koha::Checkouts; |
38 |
use Koha::Checkouts; |
38 |
use Koha::DateUtils qw( dt_from_string ); |
39 |
use Koha::DateUtils qw( dt_from_string ); |
39 |
use Koha::Library::Groups; |
40 |
use Koha::Library::Groups; |
Lines 838-843
sub checkauth {
Link Here
|
838 |
my $q_userid = $query->param('userid') // ''; |
839 |
my $q_userid = $query->param('userid') // ''; |
839 |
|
840 |
|
840 |
my $session; |
841 |
my $session; |
|
|
842 |
my $invalid_otp_token; |
843 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
844 |
my $auth_challenge_complete; |
841 |
|
845 |
|
842 |
# Basic authentication is incompatible with the use of Shibboleth, |
846 |
# Basic authentication is incompatible with the use of Shibboleth, |
843 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
847 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
Lines 869-881
sub checkauth {
Link Here
|
869 |
{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } |
873 |
{ remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } |
870 |
); |
874 |
); |
871 |
|
875 |
|
|
|
876 |
if ( $return eq 'ok' || $return eq 'additional-auth-needed' ) { |
877 |
$userid = $session->param('id'); |
878 |
} |
879 |
|
880 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
881 |
|
882 |
# We are at the second screen if the waiting-for-2FA is set in session |
883 |
# and otp_token param has been passed |
884 |
if ( $require_2FA |
885 |
&& $additional_auth_needed |
886 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
887 |
{ |
888 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
889 |
my $auth = Koha::Auth::TwoFactorAuth::get_auth( { patron => $patron } ); |
890 |
my $verified = $auth->verify($otp_token); |
891 |
$auth->clear; |
892 |
if ( $verified ) { |
893 |
# The token is correct, the user is fully logged in! |
894 |
$additional_auth_needed = 0; |
895 |
$session->param( 'waiting-for-2FA', 0 ); |
896 |
$return = "ok"; |
897 |
$auth_challenge_complete = 1; |
898 |
|
899 |
# This is an ugly trick to pass the test |
900 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
901 |
# few lines later |
902 |
$q_userid = $userid; |
903 |
} |
904 |
else { |
905 |
$invalid_otp_token = 1; |
906 |
} |
907 |
} |
908 |
|
872 |
if ( $return eq 'ok' ) { |
909 |
if ( $return eq 'ok' ) { |
873 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
910 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
874 |
|
911 |
|
875 |
my $s_userid = $session->param('id'); |
912 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
876 |
$userid = $s_userid; |
|
|
877 |
|
878 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $s_userid ) ) |
879 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
913 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
880 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
914 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) |
881 |
) { |
915 |
) { |
Lines 886-910
sub checkauth {
Link Here
|
886 |
$session->delete(); |
920 |
$session->delete(); |
887 |
$session->flush; |
921 |
$session->flush; |
888 |
C4::Context->_unset_userenv($sessionID); |
922 |
C4::Context->_unset_userenv($sessionID); |
889 |
} |
923 |
} elsif (!$logout) { |
890 |
elsif ($logout) { |
|
|
891 |
|
892 |
# voluntary logout the user |
893 |
# check wether the user was using their shibboleth session or a local one |
894 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
895 |
$session->delete(); |
896 |
$session->flush; |
897 |
C4::Context->_unset_userenv($sessionID); |
898 |
|
899 |
if ($cas and $caslogout) { |
900 |
logout_cas($query, $type); |
901 |
} |
902 |
|
903 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
904 |
if ( $shib and $shib_login and $shibSuccess) { |
905 |
logout_shib($query); |
906 |
} |
907 |
} else { |
908 |
|
924 |
|
909 |
$cookie = $query->cookie( |
925 |
$cookie = $query->cookie( |
910 |
-name => 'CGISESSID', |
926 |
-name => 'CGISESSID', |
Lines 934-947
sub checkauth {
Link Here
|
934 |
} |
950 |
} |
935 |
} |
951 |
} |
936 |
|
952 |
|
937 |
unless ( $loggedin ) { |
953 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
938 |
$sessionID = undef; |
954 |
$sessionID = undef; |
|
|
955 |
$session = undef; |
939 |
$userid = undef; |
956 |
$userid = undef; |
940 |
} |
957 |
} |
941 |
|
958 |
|
|
|
959 |
if ($logout) { |
960 |
|
961 |
# voluntary logout the user |
962 |
# check wether the user was using their shibboleth session or a local one |
963 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
964 |
if ( $session ) { |
965 |
$session->delete(); |
966 |
$session->flush; |
967 |
} |
968 |
C4::Context->_unset_userenv($sessionID); |
969 |
|
970 |
if ($cas and $caslogout) { |
971 |
logout_cas($query, $type); |
972 |
} |
973 |
|
974 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
975 |
if ( $shib and $shib_login and $shibSuccess) { |
976 |
logout_shib($query); |
977 |
} |
978 |
|
979 |
$sessionID = undef; |
980 |
$session = undef; |
981 |
$userid = undef; |
982 |
$additional_auth_needed = 0; |
983 |
} |
984 |
|
942 |
unless ( $userid ) { |
985 |
unless ( $userid ) { |
943 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
986 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
944 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
987 |
$session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
945 |
|
988 |
|
946 |
# Save anonymous search history in new session so it can be retrieved |
989 |
# Save anonymous search history in new session so it can be retrieved |
947 |
# by get_template_and_user to store it in user's search history after |
990 |
# by get_template_and_user to store it in user's search history after |
Lines 1228-1236
sub checkauth {
Link Here
|
1228 |
} |
1271 |
} |
1229 |
} # END unless ($userid) |
1272 |
} # END unless ($userid) |
1230 |
|
1273 |
|
|
|
1274 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1275 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1276 |
if ( $patron->auth_method eq 'two-factor' ) { |
1277 |
# Ask for the OTP token |
1278 |
$additional_auth_needed = 1; |
1279 |
$session->param('waiting-for-2FA', 1); |
1280 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1281 |
} |
1282 |
} |
1283 |
|
1231 |
# finished authentification, now respond |
1284 |
# finished authentification, now respond |
1232 |
if ( $loggedin || $authnotrequired ) |
1285 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1233 |
{ |
|
|
1234 |
# successful login |
1286 |
# successful login |
1235 |
unless ($cookie) { |
1287 |
unless ($cookie) { |
1236 |
$cookie = $query->cookie( |
1288 |
$cookie = $query->cookie( |
Lines 1264-1279
sub checkauth {
Link Here
|
1264 |
# |
1316 |
# |
1265 |
# |
1317 |
# |
1266 |
|
1318 |
|
|
|
1319 |
my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! |
1320 |
|
1267 |
# get the inputs from the incoming query |
1321 |
# get the inputs from the incoming query |
1268 |
my @inputs = (); |
1322 |
my @inputs = (); |
|
|
1323 |
my @inputs_to_clean = qw( userid password ticket logout.x otp_token ); |
1269 |
foreach my $name ( param $query) { |
1324 |
foreach my $name ( param $query) { |
1270 |
(next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' ); |
1325 |
next if grep { $name eq $_ } @inputs_to_clean; |
1271 |
my @value = $query->multi_param($name); |
1326 |
my @value = $query->multi_param($name); |
1272 |
push @inputs, { name => $name, value => $_ } for @value; |
1327 |
push @inputs, { name => $name, value => $_ } for @value; |
1273 |
} |
1328 |
} |
1274 |
|
1329 |
|
1275 |
my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! |
|
|
1276 |
|
1277 |
my $LibraryNameTitle = C4::Context->preference("LibraryName"); |
1330 |
my $LibraryNameTitle = C4::Context->preference("LibraryName"); |
1278 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
1331 |
$LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; |
1279 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
1332 |
$LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; |
Lines 1321-1326
sub checkauth {
Link Here
|
1321 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1374 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1322 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1375 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1323 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1376 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
|
|
1377 |
if ( $additional_auth_needed ) { |
1378 |
$template->param( |
1379 |
TwoFA_prompt => 1, |
1380 |
invalid_otp_token => $invalid_otp_token, |
1381 |
); |
1382 |
} |
1324 |
|
1383 |
|
1325 |
if ( $type eq 'opac' ) { |
1384 |
if ( $type eq 'opac' ) { |
1326 |
require Koha::Virtualshelves; |
1385 |
require Koha::Virtualshelves; |
Lines 1429-1434
Possible return values in C<$status> are:
Link Here
|
1429 |
|
1488 |
|
1430 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
1489 |
=item "restricted" -- The IP has changed (if SessionRestrictionByIP) |
1431 |
|
1490 |
|
|
|
1491 |
=item "additional-auth-needed -- User is in an authentication process that is not finished |
1492 |
|
1432 |
=back |
1493 |
=back |
1433 |
|
1494 |
|
1434 |
=cut |
1495 |
=cut |
Lines 1704-1709
sub check_cookie_auth {
Link Here
|
1704 |
$session->param( 'lasttime', time() ); |
1765 |
$session->param( 'lasttime', time() ); |
1705 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1766 |
my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; |
1706 |
if ($flags) { |
1767 |
if ($flags) { |
|
|
1768 |
|
1769 |
return ( "additional-auth-needed", $session ) |
1770 |
if $session->param('waiting-for-2FA'); |
1771 |
|
1707 |
return ( "ok", $session ); |
1772 |
return ( "ok", $session ); |
1708 |
} else { |
1773 |
} else { |
1709 |
$session->delete(); |
1774 |
$session->delete(); |