Lines 845-850
sub checkauth {
Link Here
|
845 |
|
845 |
|
846 |
# state variables |
846 |
# state variables |
847 |
my $loggedin = 0; |
847 |
my $loggedin = 0; |
|
|
848 |
my $auth_state = 'failed'; |
848 |
my %info; |
849 |
my %info; |
849 |
my ( $userid, $cookie, $sessionID, $flags ); |
850 |
my ( $userid, $cookie, $sessionID, $flags ); |
850 |
my $logout = $query->param('logout.x'); |
851 |
my $logout = $query->param('logout.x'); |
Lines 859-865
sub checkauth {
Link Here
|
859 |
my $session; |
860 |
my $session; |
860 |
my $invalid_otp_token; |
861 |
my $invalid_otp_token; |
861 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
862 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
862 |
my $auth_challenge_complete; |
|
|
863 |
|
863 |
|
864 |
# Basic authentication is incompatible with the use of Shibboleth, |
864 |
# Basic authentication is incompatible with the use of Shibboleth, |
865 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
865 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
Lines 896-907
sub checkauth {
Link Here
|
896 |
$userid = $session->param('id'); |
896 |
$userid = $session->param('id'); |
897 |
} |
897 |
} |
898 |
|
898 |
|
899 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
899 |
$auth_state = |
|
|
900 |
$return eq 'ok' ? 'completed' |
901 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
902 |
: 'failed'; |
900 |
|
903 |
|
901 |
# We are at the second screen if the waiting-for-2FA is set in session |
904 |
# We are at the second screen if the waiting-for-2FA is set in session |
902 |
# and otp_token param has been passed |
905 |
# and otp_token param has been passed |
903 |
if ( $require_2FA |
906 |
if ( $require_2FA |
904 |
&& $additional_auth_needed |
907 |
&& $auth_state eq 'additional-auth-needed' |
905 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
908 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
906 |
{ |
909 |
{ |
907 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
910 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
Lines 910-919
sub checkauth {
Link Here
|
910 |
$auth->clear; |
913 |
$auth->clear; |
911 |
if ( $verified ) { |
914 |
if ( $verified ) { |
912 |
# The token is correct, the user is fully logged in! |
915 |
# The token is correct, the user is fully logged in! |
913 |
$additional_auth_needed = 0; |
916 |
$auth_state = 'completed'; |
914 |
$session->param( 'waiting-for-2FA', 0 ); |
917 |
$session->param( 'waiting-for-2FA', 0 ); |
915 |
$return = "ok"; |
|
|
916 |
$auth_challenge_complete = 1; |
917 |
|
918 |
|
918 |
# This is an ugly trick to pass the test |
919 |
# This is an ugly trick to pass the test |
919 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
920 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
Lines 925-931
sub checkauth {
Link Here
|
925 |
} |
926 |
} |
926 |
} |
927 |
} |
927 |
|
928 |
|
928 |
if ( $return eq 'ok' ) { |
929 |
if ( $auth_state eq 'completed' ) { |
929 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
930 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
930 |
|
931 |
|
931 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
932 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
Lines 950-958
sub checkauth {
Link Here
|
950 |
); |
951 |
); |
951 |
|
952 |
|
952 |
$flags = haspermission( $userid, $flagsrequired ); |
953 |
$flags = haspermission( $userid, $flagsrequired ); |
953 |
if ($flags) { |
954 |
unless ( $flags ) { |
954 |
$loggedin = 1; |
955 |
$auth_state = 'failed'; |
955 |
} else { |
|
|
956 |
$info{'nopermission'} = 1; |
956 |
$info{'nopermission'} = 1; |
957 |
} |
957 |
} |
958 |
} |
958 |
} |
Lines 967-973
sub checkauth {
Link Here
|
967 |
} |
967 |
} |
968 |
} |
968 |
} |
969 |
|
969 |
|
970 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
970 |
if ( $auth_state eq 'failed' || $logout ) { |
971 |
$sessionID = undef; |
971 |
$sessionID = undef; |
972 |
$userid = undef; |
972 |
$userid = undef; |
973 |
} |
973 |
} |
Lines 993-999
sub checkauth {
Link Here
|
993 |
} |
993 |
} |
994 |
|
994 |
|
995 |
$session = undef; |
995 |
$session = undef; |
996 |
$additional_auth_needed = 0; |
996 |
$auth_state = 'logout'; |
997 |
} |
997 |
} |
998 |
|
998 |
|
999 |
unless ( $userid ) { |
999 |
unless ( $userid ) { |
Lines 1143-1149
sub checkauth {
Link Here
|
1143 |
if ($return) { |
1143 |
if ($return) { |
1144 |
|
1144 |
|
1145 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1145 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1146 |
$loggedin = 1; |
1146 |
$auth_state = "logged_in"; |
1147 |
} |
1147 |
} |
1148 |
else { |
1148 |
else { |
1149 |
$info{'nopermission'} = 1; |
1149 |
$info{'nopermission'} = 1; |
Lines 1293-1310
sub checkauth {
Link Here
|
1293 |
$session->flush; |
1293 |
$session->flush; |
1294 |
} # END unless ($userid) |
1294 |
} # END unless ($userid) |
1295 |
|
1295 |
|
1296 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1296 |
|
|
|
1297 |
if ( $require_2FA && $auth_state eq 'logged_in' ) { |
1297 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1298 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1298 |
if ( $patron->auth_method eq 'two-factor' ) { |
1299 |
if ( $patron->auth_method eq 'two-factor' ) { |
1299 |
# Ask for the OTP token |
1300 |
# Ask for the OTP token |
1300 |
$additional_auth_needed = 1; |
1301 |
$auth_state = 'additional-auth-needed'; |
1301 |
$session->param('waiting-for-2FA', 1); |
1302 |
$session->param('waiting-for-2FA', 1); |
1302 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1303 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
|
|
1304 |
} else { |
1305 |
$auth_state = 'completed'; |
1303 |
} |
1306 |
} |
1304 |
} |
1307 |
} |
1305 |
|
1308 |
|
1306 |
# finished authentification, now respond |
1309 |
# finished authentification, now respond |
1307 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1310 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
1308 |
# successful login |
1311 |
# successful login |
1309 |
unless ($cookie) { |
1312 |
unless ($cookie) { |
1310 |
$cookie = $query->cookie( |
1313 |
$cookie = $query->cookie( |
Lines 1396-1402
sub checkauth {
Link Here
|
1396 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1399 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1397 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1400 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1398 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1401 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1399 |
if ( $additional_auth_needed ) { |
1402 |
if ( $auth_state eq 'additional-auth-needed' ) { |
1400 |
$template->param( |
1403 |
$template->param( |
1401 |
TwoFA_prompt => 1, |
1404 |
TwoFA_prompt => 1, |
1402 |
invalid_otp_token => $invalid_otp_token, |
1405 |
invalid_otp_token => $invalid_otp_token, |
1403 |
- |
|
|