|
Lines 846-851
sub checkauth {
Link Here
|
| 846 |
|
846 |
|
| 847 |
# state variables |
847 |
# state variables |
| 848 |
my $loggedin = 0; |
848 |
my $loggedin = 0; |
|
|
849 |
my $auth_state = 'failed'; |
| 849 |
my %info; |
850 |
my %info; |
| 850 |
my ( $userid, $cookie, $sessionID, $flags ); |
851 |
my ( $userid, $cookie, $sessionID, $flags ); |
| 851 |
$cookie = []; |
852 |
$cookie = []; |
|
Lines 861-867
sub checkauth {
Link Here
|
| 861 |
my $session; |
862 |
my $session; |
| 862 |
my $invalid_otp_token; |
863 |
my $invalid_otp_token; |
| 863 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
864 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
| 864 |
my $auth_challenge_complete; |
|
|
| 865 |
|
865 |
|
| 866 |
# Basic authentication is incompatible with the use of Shibboleth, |
866 |
# Basic authentication is incompatible with the use of Shibboleth, |
| 867 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
867 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
Lines 897-908
sub checkauth {
Link Here
|
| 897 |
$userid = $session->param('id'); |
897 |
$userid = $session->param('id'); |
| 898 |
} |
898 |
} |
| 899 |
|
899 |
|
| 900 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
900 |
$auth_state = |
|
|
901 |
$return eq 'ok' ? 'completed' |
| 902 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
| 903 |
: 'failed'; |
| 901 |
|
904 |
|
| 902 |
# We are at the second screen if the waiting-for-2FA is set in session |
905 |
# We are at the second screen if the waiting-for-2FA is set in session |
| 903 |
# and otp_token param has been passed |
906 |
# and otp_token param has been passed |
| 904 |
if ( $require_2FA |
907 |
if ( $require_2FA |
| 905 |
&& $additional_auth_needed |
908 |
&& $auth_state eq 'additional-auth-needed' |
| 906 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
909 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
| 907 |
{ |
910 |
{ |
| 908 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
911 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
|
Lines 911-920
sub checkauth {
Link Here
|
| 911 |
$auth->clear; |
914 |
$auth->clear; |
| 912 |
if ( $verified ) { |
915 |
if ( $verified ) { |
| 913 |
# The token is correct, the user is fully logged in! |
916 |
# The token is correct, the user is fully logged in! |
| 914 |
$additional_auth_needed = 0; |
917 |
$auth_state = 'completed'; |
| 915 |
$session->param( 'waiting-for-2FA', 0 ); |
918 |
$session->param( 'waiting-for-2FA', 0 ); |
| 916 |
$return = "ok"; |
|
|
| 917 |
$auth_challenge_complete = 1; |
| 918 |
|
919 |
|
| 919 |
# This is an ugly trick to pass the test |
920 |
# This is an ugly trick to pass the test |
| 920 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
921 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
|
Lines 926-932
sub checkauth {
Link Here
|
| 926 |
} |
927 |
} |
| 927 |
} |
928 |
} |
| 928 |
|
929 |
|
| 929 |
if ( $return eq 'ok' ) { |
930 |
if ( $auth_state eq 'completed' ) { |
| 930 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
931 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
| 931 |
|
932 |
|
| 932 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
933 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
|
Lines 952-960
sub checkauth {
Link Here
|
| 952 |
)); |
953 |
)); |
| 953 |
|
954 |
|
| 954 |
$flags = haspermission( $userid, $flagsrequired ); |
955 |
$flags = haspermission( $userid, $flagsrequired ); |
| 955 |
if ($flags) { |
956 |
unless ( $flags ) { |
| 956 |
$loggedin = 1; |
957 |
$auth_state = 'failed'; |
| 957 |
} else { |
|
|
| 958 |
$info{'nopermission'} = 1; |
958 |
$info{'nopermission'} = 1; |
| 959 |
} |
959 |
} |
| 960 |
} |
960 |
} |
|
Lines 969-975
sub checkauth {
Link Here
|
| 969 |
} |
969 |
} |
| 970 |
} |
970 |
} |
| 971 |
|
971 |
|
| 972 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
972 |
if ( $auth_state eq 'failed' || $logout ) { |
| 973 |
$sessionID = undef; |
973 |
$sessionID = undef; |
| 974 |
$userid = undef; |
974 |
$userid = undef; |
| 975 |
} |
975 |
} |
|
Lines 996-1002
sub checkauth {
Link Here
|
| 996 |
} |
996 |
} |
| 997 |
|
997 |
|
| 998 |
$session = undef; |
998 |
$session = undef; |
| 999 |
$additional_auth_needed = 0; |
999 |
$auth_state = 'logout'; |
| 1000 |
} |
1000 |
} |
| 1001 |
|
1001 |
|
| 1002 |
unless ( $userid ) { |
1002 |
unless ( $userid ) { |
|
Lines 1148-1154
sub checkauth {
Link Here
|
| 1148 |
if ($return) { |
1148 |
if ($return) { |
| 1149 |
|
1149 |
|
| 1150 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1150 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
| 1151 |
$loggedin = 1; |
1151 |
$auth_state = "logged_in"; |
| 1152 |
} |
1152 |
} |
| 1153 |
else { |
1153 |
else { |
| 1154 |
$info{'nopermission'} = 1; |
1154 |
$info{'nopermission'} = 1; |
|
Lines 1298-1315
sub checkauth {
Link Here
|
| 1298 |
$session->flush; |
1298 |
$session->flush; |
| 1299 |
} # END unless ($userid) |
1299 |
} # END unless ($userid) |
| 1300 |
|
1300 |
|
| 1301 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1301 |
|
| 1302 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1302 |
if ( $auth_state eq 'logged_in' ) { |
| 1303 |
if ( $patron->auth_method eq 'two-factor' ) { |
1303 |
$auth_state = 'completed'; |
| 1304 |
# Ask for the OTP token |
1304 |
|
| 1305 |
$additional_auth_needed = 1; |
1305 |
# Auth is completed unless an additional auth is needed |
| 1306 |
$session->param('waiting-for-2FA', 1); |
1306 |
if ( $require_2FA ) { |
| 1307 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1307 |
my $patron = Koha::Patrons->find({userid => $userid}); |
|
|
1308 |
if ( $patron->auth_method eq 'two-factor' ) { |
| 1309 |
# Ask for the OTP token |
| 1310 |
$auth_state = 'additional-auth-needed'; |
| 1311 |
$session->param('waiting-for-2FA', 1); |
| 1312 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
| 1313 |
} |
| 1308 |
} |
1314 |
} |
| 1309 |
} |
1315 |
} |
| 1310 |
|
1316 |
|
| 1311 |
# finished authentification, now respond |
1317 |
# finished authentification, now respond |
| 1312 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1318 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
| 1313 |
# successful login |
1319 |
# successful login |
| 1314 |
unless (@$cookie) { |
1320 |
unless (@$cookie) { |
| 1315 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( |
1321 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( |
|
Lines 1401-1407
sub checkauth {
Link Here
|
| 1401 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1407 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
| 1402 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1408 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
| 1403 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1409 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
| 1404 |
if ( $additional_auth_needed ) { |
1410 |
if ( $auth_state eq 'additional-auth-needed' ) { |
| 1405 |
$template->param( |
1411 |
$template->param( |
| 1406 |
TwoFA_prompt => 1, |
1412 |
TwoFA_prompt => 1, |
| 1407 |
invalid_otp_token => $invalid_otp_token, |
1413 |
invalid_otp_token => $invalid_otp_token, |
| 1408 |
- |
|
|