|
Lines 827-832
sub checkauth {
Link Here
|
| 827 |
|
827 |
|
| 828 |
# state variables |
828 |
# state variables |
| 829 |
my $loggedin = 0; |
829 |
my $loggedin = 0; |
|
|
830 |
my $auth_state = 'failed'; |
| 830 |
my %info; |
831 |
my %info; |
| 831 |
my ( $userid, $cookie, $sessionID, $flags ); |
832 |
my ( $userid, $cookie, $sessionID, $flags ); |
| 832 |
my $logout = $query->param('logout.x'); |
833 |
my $logout = $query->param('logout.x'); |
|
Lines 841-847
sub checkauth {
Link Here
|
| 841 |
my $session; |
842 |
my $session; |
| 842 |
my $invalid_otp_token; |
843 |
my $invalid_otp_token; |
| 843 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
844 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
| 844 |
my $auth_challenge_complete; |
|
|
| 845 |
|
845 |
|
| 846 |
# Basic authentication is incompatible with the use of Shibboleth, |
846 |
# Basic authentication is incompatible with the use of Shibboleth, |
| 847 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
847 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
Lines 877-888
sub checkauth {
Link Here
|
| 877 |
$userid = $session->param('id'); |
877 |
$userid = $session->param('id'); |
| 878 |
} |
878 |
} |
| 879 |
|
879 |
|
| 880 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
880 |
$auth_state = |
|
|
881 |
$return eq 'ok' ? 'completed' |
| 882 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
| 883 |
: 'failed'; |
| 881 |
|
884 |
|
| 882 |
# We are at the second screen if the waiting-for-2FA is set in session |
885 |
# We are at the second screen if the waiting-for-2FA is set in session |
| 883 |
# and otp_token param has been passed |
886 |
# and otp_token param has been passed |
| 884 |
if ( $require_2FA |
887 |
if ( $require_2FA |
| 885 |
&& $additional_auth_needed |
888 |
&& $auth_state eq 'additional-auth-needed' |
| 886 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
889 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
| 887 |
{ |
890 |
{ |
| 888 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
891 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
|
Lines 891-900
sub checkauth {
Link Here
|
| 891 |
$auth->clear; |
894 |
$auth->clear; |
| 892 |
if ( $verified ) { |
895 |
if ( $verified ) { |
| 893 |
# The token is correct, the user is fully logged in! |
896 |
# The token is correct, the user is fully logged in! |
| 894 |
$additional_auth_needed = 0; |
897 |
$auth_state = 'completed'; |
| 895 |
$session->param( 'waiting-for-2FA', 0 ); |
898 |
$session->param( 'waiting-for-2FA', 0 ); |
| 896 |
$return = "ok"; |
|
|
| 897 |
$auth_challenge_complete = 1; |
| 898 |
|
899 |
|
| 899 |
# This is an ugly trick to pass the test |
900 |
# This is an ugly trick to pass the test |
| 900 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
901 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
|
Lines 906-912
sub checkauth {
Link Here
|
| 906 |
} |
907 |
} |
| 907 |
} |
908 |
} |
| 908 |
|
909 |
|
| 909 |
if ( $return eq 'ok' ) { |
910 |
if ( $auth_state eq 'completed' ) { |
| 910 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
911 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
| 911 |
|
912 |
|
| 912 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
913 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
|
Lines 932-940
sub checkauth {
Link Here
|
| 932 |
my $sessiontype = $session->param('sessiontype') || ''; |
933 |
my $sessiontype = $session->param('sessiontype') || ''; |
| 933 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
934 |
unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... |
| 934 |
$flags = haspermission( $userid, $flagsrequired ); |
935 |
$flags = haspermission( $userid, $flagsrequired ); |
| 935 |
if ($flags) { |
936 |
unless ( $flags ) { |
| 936 |
$loggedin = 1; |
937 |
$auth_state = 'failed'; |
| 937 |
} else { |
|
|
| 938 |
$info{'nopermission'} = 1; |
938 |
$info{'nopermission'} = 1; |
| 939 |
} |
939 |
} |
| 940 |
} |
940 |
} |
|
Lines 950-956
sub checkauth {
Link Here
|
| 950 |
} |
950 |
} |
| 951 |
} |
951 |
} |
| 952 |
|
952 |
|
| 953 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
953 |
if ( $auth_state eq 'failed' || $logout ) { |
| 954 |
$sessionID = undef; |
954 |
$sessionID = undef; |
| 955 |
$session = undef; |
955 |
$session = undef; |
| 956 |
$userid = undef; |
956 |
$userid = undef; |
|
Lines 979-985
sub checkauth {
Link Here
|
| 979 |
$sessionID = undef; |
979 |
$sessionID = undef; |
| 980 |
$session = undef; |
980 |
$session = undef; |
| 981 |
$userid = undef; |
981 |
$userid = undef; |
| 982 |
$additional_auth_needed = 0; |
982 |
$auth_state = 'logout'; |
| 983 |
} |
983 |
} |
| 984 |
|
984 |
|
| 985 |
unless ( $userid ) { |
985 |
unless ( $userid ) { |
|
Lines 1129-1135
sub checkauth {
Link Here
|
| 1129 |
if ($return) { |
1129 |
if ($return) { |
| 1130 |
|
1130 |
|
| 1131 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1131 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
| 1132 |
$loggedin = 1; |
1132 |
$auth_state = "logged_in"; |
| 1133 |
} |
1133 |
} |
| 1134 |
else { |
1134 |
else { |
| 1135 |
$info{'nopermission'} = 1; |
1135 |
$info{'nopermission'} = 1; |
|
Lines 1271-1288
sub checkauth {
Link Here
|
| 1271 |
} |
1271 |
} |
| 1272 |
} # END unless ($userid) |
1272 |
} # END unless ($userid) |
| 1273 |
|
1273 |
|
| 1274 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1274 |
|
|
|
1275 |
if ( $require_2FA && $auth_state eq 'logged_in' ) { |
| 1275 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1276 |
my $patron = Koha::Patrons->find({userid => $userid}); |
| 1276 |
if ( $patron->auth_method eq 'two-factor' ) { |
1277 |
if ( $patron->auth_method eq 'two-factor' ) { |
| 1277 |
# Ask for the OTP token |
1278 |
# Ask for the OTP token |
| 1278 |
$additional_auth_needed = 1; |
1279 |
$auth_state = 'additional-auth-needed'; |
| 1279 |
$session->param('waiting-for-2FA', 1); |
1280 |
$session->param('waiting-for-2FA', 1); |
| 1280 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1281 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
|
|
1282 |
} else { |
| 1283 |
$auth_state = 'completed'; |
| 1281 |
} |
1284 |
} |
| 1282 |
} |
1285 |
} |
| 1283 |
|
1286 |
|
| 1284 |
# finished authentification, now respond |
1287 |
# finished authentification, now respond |
| 1285 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1288 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
| 1286 |
# successful login |
1289 |
# successful login |
| 1287 |
unless ($cookie) { |
1290 |
unless ($cookie) { |
| 1288 |
$cookie = $query->cookie( |
1291 |
$cookie = $query->cookie( |
|
Lines 1374-1380
sub checkauth {
Link Here
|
| 1374 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1377 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
| 1375 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1378 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
| 1376 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1379 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
| 1377 |
if ( $additional_auth_needed ) { |
1380 |
if ( $auth_state eq 'additional-auth-needed' ) { |
| 1378 |
$template->param( |
1381 |
$template->param( |
| 1379 |
TwoFA_prompt => 1, |
1382 |
TwoFA_prompt => 1, |
| 1380 |
invalid_otp_token => $invalid_otp_token, |
1383 |
invalid_otp_token => $invalid_otp_token, |
| 1381 |
- |
|
|