|
Lines 827-832
sub checkauth {
Link Here
|
| 827 |
|
827 |
|
| 828 |
# state variables |
828 |
# state variables |
| 829 |
my $loggedin = 0; |
829 |
my $loggedin = 0; |
|
|
830 |
my $auth_state = 'failed'; |
| 830 |
my %info; |
831 |
my %info; |
| 831 |
my ( $userid, $cookie, $sessionID, $flags ); |
832 |
my ( $userid, $cookie, $sessionID, $flags ); |
| 832 |
my $logout = $query->param('logout.x'); |
833 |
my $logout = $query->param('logout.x'); |
|
Lines 841-847
sub checkauth {
Link Here
|
| 841 |
my $session; |
842 |
my $session; |
| 842 |
my $invalid_otp_token; |
843 |
my $invalid_otp_token; |
| 843 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
844 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
| 844 |
my $auth_challenge_complete; |
|
|
| 845 |
|
845 |
|
| 846 |
# Basic authentication is incompatible with the use of Shibboleth, |
846 |
# Basic authentication is incompatible with the use of Shibboleth, |
| 847 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
847 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
Lines 877-888
sub checkauth {
Link Here
|
| 877 |
$userid = $session->param('id'); |
877 |
$userid = $session->param('id'); |
| 878 |
} |
878 |
} |
| 879 |
|
879 |
|
| 880 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
880 |
$auth_state = |
|
|
881 |
$return eq 'ok' ? 'completed' |
| 882 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
| 883 |
: 'failed'; |
| 881 |
|
884 |
|
| 882 |
# We are at the second screen if the waiting-for-2FA is set in session |
885 |
# We are at the second screen if the waiting-for-2FA is set in session |
| 883 |
# and otp_token param has been passed |
886 |
# and otp_token param has been passed |
| 884 |
if ( $require_2FA |
887 |
if ( $require_2FA |
| 885 |
&& $additional_auth_needed |
888 |
&& $auth_state eq 'additional-auth-needed' |
| 886 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
889 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
| 887 |
{ |
890 |
{ |
| 888 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
891 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
|
Lines 891-900
sub checkauth {
Link Here
|
| 891 |
$auth->clear; |
894 |
$auth->clear; |
| 892 |
if ( $verified ) { |
895 |
if ( $verified ) { |
| 893 |
# The token is correct, the user is fully logged in! |
896 |
# The token is correct, the user is fully logged in! |
| 894 |
$additional_auth_needed = 0; |
897 |
$auth_state = 'completed'; |
| 895 |
$session->param( 'waiting-for-2FA', 0 ); |
898 |
$session->param( 'waiting-for-2FA', 0 ); |
| 896 |
$return = "ok"; |
|
|
| 897 |
$auth_challenge_complete = 1; |
| 898 |
|
899 |
|
| 899 |
# This is an ugly trick to pass the test |
900 |
# This is an ugly trick to pass the test |
| 900 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
901 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
|
Lines 906-912
sub checkauth {
Link Here
|
| 906 |
} |
907 |
} |
| 907 |
} |
908 |
} |
| 908 |
|
909 |
|
| 909 |
if ( $return eq 'ok' ) { |
910 |
if ( $auth_state eq 'completed' ) { |
| 910 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
911 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
| 911 |
|
912 |
|
| 912 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
913 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
|
Lines 930-938
sub checkauth {
Link Here
|
| 930 |
); |
931 |
); |
| 931 |
|
932 |
|
| 932 |
$flags = haspermission( $userid, $flagsrequired ); |
933 |
$flags = haspermission( $userid, $flagsrequired ); |
| 933 |
if ($flags) { |
934 |
unless ( $flags ) { |
| 934 |
$loggedin = 1; |
935 |
$auth_state = 'failed'; |
| 935 |
} else { |
|
|
| 936 |
$info{'nopermission'} = 1; |
936 |
$info{'nopermission'} = 1; |
| 937 |
} |
937 |
} |
| 938 |
} |
938 |
} |
|
Lines 947-953
sub checkauth {
Link Here
|
| 947 |
} |
947 |
} |
| 948 |
} |
948 |
} |
| 949 |
|
949 |
|
| 950 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
950 |
if ( $auth_state eq 'failed' || $logout ) { |
| 951 |
$sessionID = undef; |
951 |
$sessionID = undef; |
| 952 |
$session = undef; |
952 |
$session = undef; |
| 953 |
$userid = undef; |
953 |
$userid = undef; |
|
Lines 976-982
sub checkauth {
Link Here
|
| 976 |
$sessionID = undef; |
976 |
$sessionID = undef; |
| 977 |
$session = undef; |
977 |
$session = undef; |
| 978 |
$userid = undef; |
978 |
$userid = undef; |
| 979 |
$additional_auth_needed = 0; |
979 |
$auth_state = 'logout'; |
| 980 |
} |
980 |
} |
| 981 |
|
981 |
|
| 982 |
unless ( $userid ) { |
982 |
unless ( $userid ) { |
|
Lines 1126-1132
sub checkauth {
Link Here
|
| 1126 |
if ($return) { |
1126 |
if ($return) { |
| 1127 |
|
1127 |
|
| 1128 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1128 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
| 1129 |
$loggedin = 1; |
1129 |
$auth_state = "logged_in"; |
| 1130 |
} |
1130 |
} |
| 1131 |
else { |
1131 |
else { |
| 1132 |
$info{'nopermission'} = 1; |
1132 |
$info{'nopermission'} = 1; |
|
Lines 1268-1285
sub checkauth {
Link Here
|
| 1268 |
} |
1268 |
} |
| 1269 |
} # END unless ($userid) |
1269 |
} # END unless ($userid) |
| 1270 |
|
1270 |
|
| 1271 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1271 |
|
|
|
1272 |
if ( $require_2FA && $auth_state eq 'logged_in' ) { |
| 1272 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1273 |
my $patron = Koha::Patrons->find({userid => $userid}); |
| 1273 |
if ( $patron->auth_method eq 'two-factor' ) { |
1274 |
if ( $patron->auth_method eq 'two-factor' ) { |
| 1274 |
# Ask for the OTP token |
1275 |
# Ask for the OTP token |
| 1275 |
$additional_auth_needed = 1; |
1276 |
$auth_state = 'additional-auth-needed'; |
| 1276 |
$session->param('waiting-for-2FA', 1); |
1277 |
$session->param('waiting-for-2FA', 1); |
| 1277 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1278 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
|
|
1279 |
} else { |
| 1280 |
$auth_state = 'completed'; |
| 1278 |
} |
1281 |
} |
| 1279 |
} |
1282 |
} |
| 1280 |
|
1283 |
|
| 1281 |
# finished authentification, now respond |
1284 |
# finished authentification, now respond |
| 1282 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1285 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
| 1283 |
# successful login |
1286 |
# successful login |
| 1284 |
unless ($cookie) { |
1287 |
unless ($cookie) { |
| 1285 |
$cookie = $query->cookie( |
1288 |
$cookie = $query->cookie( |
|
Lines 1371-1377
sub checkauth {
Link Here
|
| 1371 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1374 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
| 1372 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1375 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
| 1373 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1376 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
| 1374 |
if ( $additional_auth_needed ) { |
1377 |
if ( $auth_state eq 'additional-auth-needed' ) { |
| 1375 |
$template->param( |
1378 |
$template->param( |
| 1376 |
TwoFA_prompt => 1, |
1379 |
TwoFA_prompt => 1, |
| 1377 |
invalid_otp_token => $invalid_otp_token, |
1380 |
invalid_otp_token => $invalid_otp_token, |
| 1378 |
- |
|
|