View | Details | Raw Unified | Return to bug 39224
Collapse All | Expand All

(-)a/C4/Auth.pm (-3 / +6 lines)
Lines 197-203 sub get_template_and_user { Link Here
197
    my $cookie_mgr = Koha::CookieManager->new;
197
    my $cookie_mgr = Koha::CookieManager->new;
198
198
199
    # Get shibboleth login attribute
199
    # Get shibboleth login attribute
200
    my $shib       = C4::Context->config('useshibboleth') && shib_ok();
200
    my $shib       = C4::Context->preference('ShibbolethAuthentication') && shib_ok();
201
    my $shib_login = $shib ? get_login_shib() : undef;
201
    my $shib_login = $shib ? get_login_shib() : undef;
202
202
203
    C4::Context->interface( $in->{type} );
203
    C4::Context->interface( $in->{type} );
Lines 448-453 sub get_template_and_user { Link Here
448
            $template->param(
448
            $template->param(
449
                shibbolethAuthentication => $shib,
449
                shibbolethAuthentication => $shib,
450
                shibbolethLoginUrl       => login_shib_url( $in->{'query'} ),
450
                shibbolethLoginUrl       => login_shib_url( $in->{'query'} ),
451
                shibbolethOnly           => get_force_sso_setting( $in->{'type'} ),
451
            );
452
            );
452
453
453
            # If shibboleth is enabled and we have a shibboleth login attribute,
454
            # If shibboleth is enabled and we have a shibboleth login attribute,
Lines 843-849 sub checkauth { Link Here
843
    my $query = shift;
844
    my $query = shift;
844
845
845
    # Get shibboleth login attribute
846
    # Get shibboleth login attribute
846
    my $shib       = C4::Context->config('useshibboleth') && shib_ok();
847
    my $shib       = C4::Context->preference('ShibbolethAuthentication') && shib_ok();
847
    my $shib_login = $shib ? get_login_shib() : undef;
848
    my $shib_login = $shib ? get_login_shib() : undef;
848
849
849
    # $authnotrequired will be set for scripts which will run without authentication
850
    # $authnotrequired will be set for scripts which will run without authentication
Lines 1492-1497 sub checkauth { Link Here
1492
        script_name                           => get_script_name(),
1493
        script_name                           => get_script_name(),
1493
        casAuthentication                     => C4::Context->preference("casAuthentication"),
1494
        casAuthentication                     => C4::Context->preference("casAuthentication"),
1494
        shibbolethAuthentication              => $shib,
1495
        shibbolethAuthentication              => $shib,
1496
        shibbolethOnly                        => get_force_sso_setting($type),
1495
        suggestion                            => C4::Context->preference("suggestion"),
1497
        suggestion                            => C4::Context->preference("suggestion"),
1496
        virtualshelves                        => C4::Context->preference("virtualshelves"),
1498
        virtualshelves                        => C4::Context->preference("virtualshelves"),
1497
        LibraryName                           => "" . C4::Context->preference("LibraryName"),
1499
        LibraryName                           => "" . C4::Context->preference("LibraryName"),
Lines 1589-1594 sub checkauth { Link Here
1589
        $template->param(
1591
        $template->param(
1590
            shibbolethAuthentication => $shib,
1592
            shibbolethAuthentication => $shib,
1591
            shibbolethLoginUrl       => login_shib_url($query),
1593
            shibbolethLoginUrl       => login_shib_url($query),
1594
            shibbolethOnly           => get_force_sso_setting($type),
1592
        );
1595
        );
1593
    }
1596
    }
1594
1597
Lines 2060-2066 sub checkpw { Link Here
2060
    $type = 'opac' unless $type;
2063
    $type = 'opac' unless $type;
2061
2064
2062
    # Get shibboleth login attribute
2065
    # Get shibboleth login attribute
2063
    my $shib       = C4::Context->config('useshibboleth') && shib_ok();
2066
    my $shib       = C4::Context->preference('ShibbolethAuthentication') && shib_ok();
2064
    my $shib_login = $shib ? get_login_shib() : undef;
2067
    my $shib_login = $shib ? get_login_shib() : undef;
2065
2068
2066
    my $anonymous_patron = C4::Context->preference('AnonymousPatron');
2069
    my $anonymous_patron = C4::Context->preference('AnonymousPatron');
(-)a/installer/data/mysql/mandatory/sysprefs.sql (-2 / +1 lines)
Lines 567-573 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here
567
('opacSerialDefaultTab','subscriptions','holdings|serialcollection|subscriptions|titlenotes','Define the default tab for serials in OPAC.','Choice'),
567
('opacSerialDefaultTab','subscriptions','holdings|serialcollection|subscriptions|titlenotes','Define the default tab for serials in OPAC.','Choice'),
568
('OPACSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the OPAC','Integer'),
568
('OPACSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the OPAC','Integer'),
569
('OPACShelfBrowser','1','','Enable/disable Shelf Browser on item details page. WARNING: this feature is very resource consuming on collections with large numbers of items.','YesNo'),
569
('OPACShelfBrowser','1','','Enable/disable Shelf Browser on item details page. WARNING: this feature is very resource consuming on collections with large numbers of items.','YesNo'),
570
('OPACShibOnly','0','','If ON enables shibboleth only authentication for the opac','YesNo'),
571
('OPACShowCheckoutName','0','','Displays in the OPAC the name of patron who has checked out the material. WARNING: Most sites should leave this off. It is intended for corporate or special sites which need to track who has the item.','YesNo'),
570
('OPACShowCheckoutName','0','','Displays in the OPAC the name of patron who has checked out the material. WARNING: Most sites should leave this off. It is intended for corporate or special sites which need to track who has the item.','YesNo'),
572
('OPACShowHoldQueueDetails','none','none|priority|holds|holds_priority','Show holds details in OPAC','Choice'),
571
('OPACShowHoldQueueDetails','none','none|priority|holds|holds_priority','Show holds details in OPAC','Choice'),
573
('OPACShowLibraries', '1', '', 'If enabled, a link is shown in the OPAC pointing to a page with library information', 'YesNo'),
572
('OPACShowLibraries', '1', '', 'If enabled, a link is shown in the OPAC pointing to a page with library information', 'YesNo'),
Lines 745-750 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here
745
('ShelfBrowserUsesCcode','1','0','Use the item collection code when finding items for the shelf browser.','YesNo'),
744
('ShelfBrowserUsesCcode','1','0','Use the item collection code when finding items for the shelf browser.','YesNo'),
746
('ShelfBrowserUsesHomeBranch','1','1','Use the item home branch when finding items for the shelf browser.','YesNo'),
745
('ShelfBrowserUsesHomeBranch','1','1','Use the item home branch when finding items for the shelf browser.','YesNo'),
747
('ShelfBrowserUsesLocation','1','1','Use the item location when finding items for the shelf browser.','YesNo'),
746
('ShelfBrowserUsesLocation','1','1','Use the item location when finding items for the shelf browser.','YesNo'),
747
('ShibbolethAuthentication','0','','Enable or disable Shibboleth authentication integration','YesNo'),
748
('ShowAllCheckins', '0', '', 'Show all checkins', 'YesNo'),
748
('ShowAllCheckins', '0', '', 'Show all checkins', 'YesNo'),
749
('ShowComponentRecords', 'nowhere', 'nowhere|staff|opac|both','In which record detail pages to show list of the component records, as linked via 773','Choice'),
749
('ShowComponentRecords', 'nowhere', 'nowhere|staff|opac|both','In which record detail pages to show list of the component records, as linked via 773','Choice'),
750
('ShowHeadingUse', '0', NULL, 'Show whether MARC21 authority record contains an established heading that conforms to descriptive cataloguing rules, and can therefore be used as a main/added entry, or subject, or series title', 'YesNo'),
750
('ShowHeadingUse', '0', NULL, 'Show whether MARC21 authority record contains an established heading that conforms to descriptive cataloguing rules, and can therefore be used as a main/added entry, or subject, or series title', 'YesNo'),
Lines 776-782 INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` Link Here
776
('StaffLoginRestrictLibraryByIP','0',NULL,'If ON, IP authentication is enabled, blocking access to the staff interface from unauthorized IP addresses based on branch','YesNo'),
776
('StaffLoginRestrictLibraryByIP','0',NULL,'If ON, IP authentication is enabled, blocking access to the staff interface from unauthorized IP addresses based on branch','YesNo'),
777
('StaffSearchResultsDisplayBranch','holdingbranch','holdingbranch|homebranch','Controls the display of the home or holding branch for staff search results','Choice'),
777
('StaffSearchResultsDisplayBranch','holdingbranch','holdingbranch|homebranch','Controls the display of the home or holding branch for staff search results','Choice'),
778
('StaffSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the staff interface','Integer'),
778
('StaffSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the staff interface','Integer'),
779
('staffShibOnly','0','','If ON enables shibboleth only authentication for the staff client','YesNo'),
780
('StaticHoldsQueueWeight','0',NULL,'Specify a list of library location codes separated by commas -- the list of codes will be traversed and weighted with first values given higher weight for holds fulfillment -- alternatively, if RandomizeHoldsQueueWeight is set, the list will be randomly selective','Integer'),
779
('StaticHoldsQueueWeight','0',NULL,'Specify a list of library location codes separated by commas -- the list of codes will be traversed and weighted with first values given higher weight for holds fulfillment -- alternatively, if RandomizeHoldsQueueWeight is set, the list will be randomly selective','Integer'),
781
('StatisticsFields','location|itype|ccode', NULL, 'Define Fields (from the items table) used for statistics members','Free'),
780
('StatisticsFields','location|itype|ccode', NULL, 'Define Fields (from the items table) used for statistics members','Free'),
782
('StockRotation','0',NULL,'If ON, enables the stock rotation module','YesNo'),
781
('StockRotation','0',NULL,'If ON, enables the stock rotation module','YesNo'),
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc (-1 / +1 lines)
Lines 40-46 Link Here
40
                <li><a href="/cgi-bin/koha/admin/branch_transfer_limits.pl">Library transfer limits</a></li>
40
                <li><a href="/cgi-bin/koha/admin/branch_transfer_limits.pl">Library transfer limits</a></li>
41
                <li><a href="/cgi-bin/koha/admin/transport-cost-matrix.pl">Transport cost matrix</a></li>
41
                <li><a href="/cgi-bin/koha/admin/transport-cost-matrix.pl">Transport cost matrix</a></li>
42
            [% END %]
42
            [% END %]
43
            [% IF ( CAN_user_parameters_manage_identity_providers ) %]
43
            [% IF ( CAN_user_parameters_manage_identity_providers && Koha.Preference('ShibbolethAuthentication') ) %]
44
                <li><a href="/cgi-bin/koha/shibboleth/shibboleth.pl">Shibboleth configuration</a></li>
44
                <li><a href="/cgi-bin/koha/shibboleth/shibboleth.pl">Shibboleth configuration</a></li>
45
            [% END %]
45
            [% END %]
46
            [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %]
46
            [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %]
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt (+4 lines)
Lines 109-114 Link Here
109
                        <dt><a href="/cgi-bin/koha/admin/transport-cost-matrix.pl">Transport cost matrix</a></dt>
109
                        <dt><a href="/cgi-bin/koha/admin/transport-cost-matrix.pl">Transport cost matrix</a></dt>
110
                        <dd>Define transport costs between branches</dd>
110
                        <dd>Define transport costs between branches</dd>
111
                    [% END %]
111
                    [% END %]
112
                    [% IF ( CAN_user_parameters_manage_identity_providers && Koha.Preference('ShibbolethAuthentication') ) %]
113
                        <dt><a href="/cgi-bin/koha/shibboleth/shibboleth.pl">Shibboleth configuration</a></dt>
114
                        <dd>Configure Shibboleth authentication settings, field mappings, and SSO options</dd>
115
                    [% END %]
112
                    [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %]
116
                    [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %]
113
                        <dt><a href="/cgi-bin/koha/admin/item_circulation_alerts.pl">Item circulation alerts</a></dt>
117
                        <dt><a href="/cgi-bin/koha/admin/item_circulation_alerts.pl">Item circulation alerts</a></dt>
114
                        <dd>Define rules for check-in and checkout notifications for combinations of libraries, patron categories, and item types</dd>
118
                        <dd>Define rules for check-in and checkout notifications for combinations of libraries, patron categories, and item types</dd>
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref (+9 lines)
Lines 155-160 Administration: Link Here
155
                  0: "Don't force"
155
                  0: "Don't force"
156
            - "library selection when logging into the staff interface."
156
            - "library selection when logging into the staff interface."
157
157
158
    Shibboleth authentication:
159
        -
160
            - "Use Shibboleth for login authentication: "
161
            - pref: ShibbolethAuthentication
162
              default: 0
163
              choices:
164
                  1: "Yes"
165
                  0: "No"
166
158
    CAS authentication:
167
    CAS authentication:
159
        -
168
        -
160
            - "Use CAS for login authentication: "
169
            - "Use CAS for login authentication: "
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref (-6 lines)
Lines 1015-1023 OPAC: Link Here
1015
            - "fields (separate values with |). Tabs appear in the order listed.<br/>"
1015
            - "fields (separate values with |). Tabs appear in the order listed.<br/>"
1016
            - "<em>Currently supported values</em>: Item types (<strong>itemtypes</strong>), Collection, (<strong>ccode</strong>) and Shelving location (<strong>loc</strong>)."
1016
            - "<em>Currently supported values</em>: Item types (<strong>itemtypes</strong>), Collection, (<strong>ccode</strong>) and Shelving location (<strong>loc</strong>)."
1017
    Authentication:
1017
    Authentication:
1018
        -
1019
            - pref: OPACShibOnly
1020
              choices:
1021
                  1: "Don't allow"
1022
                  0: Allow
1023
            - patrons to login by means other than Shibboleth.
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref (-7 / +1 lines)
Lines 204-219 Staff interface: Link Here
204
            - 'records when downloading from the reports module.<br>NOTE: Only a positive value will enforce a limit. A specific limit in the report overrides this setting.'
204
            - 'records when downloading from the reports module.<br>NOTE: Only a positive value will enforce a limit. A specific limit in the report overrides this setting.'
205
205
206
    Authentication:
206
    Authentication:
207
        -
208
            - pref: staffShibOnly
209
              choices:
210
                  1: "Don't allow"
211
                  0: Allow
212
            - staff to login by means other than shibboleth.
213
        -
207
        -
214
            - pref: TwoFactorAuthentication
208
            - pref: TwoFactorAuthentication
215
              choices:
209
              choices:
216
                  "enforced": Enforce
210
                  "enforced": Enforce
217
                  "enabled": Enable
211
                  "enabled": Enable
218
                  "disabled": "Don't enable"
212
                  "disabled": "Don't enable"
219
            - two-factor authentication (2FA) for staff members.
213
            - two-factor authentication (2FA) for staff members.
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (-2 / +2 lines)
Lines 135-142 Link Here
135
                            </a>
135
                            </a>
136
                            <a tabindex="0" role="menuitem" class="logout js-hide" href="/cgi-bin/koha/opac-main.pl?logout.x=1"><i class="fa fa-fw fa-sign-out" aria-hidden="true"></i> Log out</a>
136
                            <a tabindex="0" role="menuitem" class="logout js-hide" href="/cgi-bin/koha/opac-main.pl?logout.x=1"><i class="fa fa-fw fa-sign-out" aria-hidden="true"></i> Log out</a>
137
                        [% ELSE %]
137
                        [% ELSE %]
138
                            [% IF Koha.Preference('casAuthentication') %]
138
                            [% IF Koha.Preference('casAuthentication') || shibbolethOnly %]
139
                                [%# CAS authentication is too complicated for modal window %]
139
                                [%# CAS authentication and Shibboleth force SSO are too complicated for modal window %]
140
                                <a class="nav-link login-link" href="/cgi-bin/koha/opac-user.pl" aria-label="Log in to your account"
140
                                <a class="nav-link login-link" href="/cgi-bin/koha/opac-user.pl" aria-label="Log in to your account"
141
                                    ><i class="fa fa-user fa-icon-black fa-fw" aria-hidden="true"></i> <span class="userlabel">Log in to your account</span></a
141
                                    ><i class="fa fa-user fa-icon-black fa-fw" aria-hidden="true"></i> <span class="userlabel">Log in to your account</span></a
142
                                >
142
                                >
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-4 / +4 lines)
Lines 97-103 Link Here
97
                                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
97
                                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
98
                                    <div class="alert alert-info">
98
                                    <div class="alert alert-info">
99
                                        <p aria-live="assertive" role="alert" class="shib_invalid">Sorry, your Shibboleth identity does not match a valid library identity.</p>
99
                                        <p aria-live="assertive" role="alert" class="shib_invalid">Sorry, your Shibboleth identity does not match a valid library identity.</p>
100
                                        [% UNLESS ( Koha.Preference('OPACShibOnly') ) %]
100
                                        [% UNLESS ( shibbolethOnly ) %]
101
                                            [% IF ( casAuthentication ) %]
101
                                            [% IF ( casAuthentication ) %]
102
                                                [% IF ( invalidCasLogin ) %]
102
                                                [% IF ( invalidCasLogin ) %]
103
                                                    <!-- This is what is displayed if cas login has failed -->
103
                                                    <!-- This is what is displayed if cas login has failed -->
Lines 114-120 Link Here
114
                                    <h2 class="shib_title">Shibboleth login</h2>
114
                                    <h2 class="shib_title">Shibboleth login</h2>
115
                                    <p><a class="shib_url" href="[% shibbolethLoginUrl | $raw %]">Log in using a Shibboleth account.</a></p>
115
                                    <p><a class="shib_url" href="[% shibbolethLoginUrl | $raw %]">Log in using a Shibboleth account.</a></p>
116
                                [% END # /IF invalidShibLogin %]
116
                                [% END # /IF invalidShibLogin %]
117
                                [% UNLESS ( Koha.Preference('OPACShibOnly') ) %]
117
                                [% UNLESS ( shibbolethOnly ) %]
118
                                    [% IF ( casAuthentication ) %]
118
                                    [% IF ( casAuthentication ) %]
119
                                        <h2 class="cas_title">CAS login</h2>
119
                                        <h2 class="cas_title">CAS login</h2>
120
                                        <p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
120
                                        <p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
Lines 125-131 Link Here
125
                                [% END %]
125
                                [% END %]
126
                            [% END # /IF shibbolethAuthentication %]
126
                            [% END # /IF shibbolethAuthentication %]
127
127
128
                            [% UNLESS ( Koha.Preference('OPACShibOnly') ) %]
128
                            [% UNLESS ( shibbolethOnly ) %]
129
                                [% IF ( casAuthentication ) %]
129
                                [% IF ( casAuthentication ) %]
130
                                    [% IF ( shibbolethAuthentication ) %]
130
                                    [% IF ( shibbolethAuthentication ) %]
131
                                        [% IF ( casServerUrl ) %]
131
                                        [% IF ( casServerUrl ) %]
Lines 227-233 Link Here
227
                                [% ELSE %]
227
                                [% ELSE %]
228
                                    <p>You must contact the library to reset your password</p>
228
                                    <p>You must contact the library to reset your password</p>
229
                                [% END %]
229
                                [% END %]
230
                            [% ELSIF !Koha.Preference('OPACShibOnly') or SCO_login or SCI_login %]
230
                            [% ELSIF !shibbolethOnly or SCO_login or SCI_login %]
231
                                [% SET form_action = script_name %]
231
                                [% SET form_action = script_name %]
232
                                [% IF SCO_login %]
232
                                [% IF SCO_login %]
233
                                    [% form_action = "/cgi-bin/koha/sco/sco-main.pl" %]
233
                                    [% form_action = "/cgi-bin/koha/sco/sco-main.pl" %]
(-)a/opac/opac-user.pl (-2 / +1 lines)
Lines 82-88 for ( C4::Context->preference("OPACShowHoldQueueDetails") ) { Link Here
82
my $patronupdate = $query->param('patronupdate');
82
my $patronupdate = $query->param('patronupdate');
83
my $canrenew     = 1;
83
my $canrenew     = 1;
84
84
85
$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') );
85
$template->param( shibbolethAuthentication => C4::Context->preference('ShibbolethAuthentication') );
86
86
87
# get borrower information ....
87
# get borrower information ....
88
my $patron = Koha::Patrons->find($borrowernumber);
88
my $patron = Koha::Patrons->find($borrowernumber);
89
- 

Return to bug 39224