View | Details | Raw Unified | Return to bug 40596
Collapse All | Expand All

(-)a/C4/Auth.pm (-36 / +29 lines)
Lines 58-63 use Koha::Patron::Consents; Link Here
58
use List::MoreUtils qw( any );
58
use List::MoreUtils qw( any );
59
use Encode;
59
use Encode;
60
use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib );
60
use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib );
61
use Koha::Auth::Identity::Providers;
61
use Net::CIDR;
62
use Net::CIDR;
62
use C4::Log qw( logaction );
63
use C4::Log qw( logaction );
63
use Koha::CookieManager;
64
use Koha::CookieManager;
Lines 68-87 use Koha::Session; Link Here
68
69
69
# use utf8;
70
# use utf8;
70
71
71
use vars qw($ldap $cas $caslogout);
72
use vars qw($ldap);
73
74
use C4::Auth_with_cas
75
    qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required multipleAuth getMultipleAuth);
72
76
73
BEGIN {
77
BEGIN {
74
    C4::Context->set_remote_address;
78
    C4::Context->set_remote_address;
75
76
    $cas       = C4::Context->preference('casAuthentication');
77
    $caslogout = C4::Context->preference('casLogout');
78
79
    if ($cas) {
80
        require C4::Auth_with_cas;    # no import
81
        import C4::Auth_with_cas
82
            qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required multipleAuth getMultipleAuth);
83
    }
84
85
}
79
}
86
80
87
=head1 NAME
81
=head1 NAME
Lines 943-949 sub checkauth { Link Here
943
            );
937
            );
944
938
945
            if (   ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
939
            if (   ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
946
                || ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} )
940
                || ( $query->param('cas_provider') && $query->param('ticket') && !C4::Context->userenv->{'id'} )
947
                || ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) )
941
                || ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) )
948
            {
942
            {
949
943
Lines 1000-1006 sub checkauth { Link Here
1000
994
1001
        # voluntary logout the user
995
        # voluntary logout the user
1002
        # check whether the user was using their shibboleth session or a local one
996
        # check whether the user was using their shibboleth session or a local one
1003
        my $shibSuccess = C4::Context->userenv ? C4::Context->userenv->{'shibboleth'} : undef;
997
        my $shibSuccess       = C4::Context->userenv ? C4::Context->userenv->{'shibboleth'} : undef;
998
        my $cas_provider_code = $session             ? $session->param('cas_provider')      : undef;
1004
        if ($session) {
999
        if ($session) {
1005
            $session->delete();
1000
            $session->delete();
1006
            $session->flush;
1001
            $session->flush;
Lines 1008-1015 sub checkauth { Link Here
1008
        C4::Context::unset_userenv();
1003
        C4::Context::unset_userenv();
1009
        $cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );
1004
        $cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie );
1010
1005
1011
        if ( $cas and $caslogout ) {
1006
        if ( C4::Context->preference('casLogout') && $cas_provider_code ) {
1012
            logout_cas( $query, $type );
1007
            logout_cas( $query, $type, $cas_provider_code );
1013
        }
1008
        }
1014
1009
1015
        # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
1010
        # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
Lines 1058-1064 sub checkauth { Link Here
1058
            print STDERR "ERROR: Missing system preference AllowPKIAuth.\n";
1053
            print STDERR "ERROR: Missing system preference AllowPKIAuth.\n";
1059
            $pki_field = 'None';
1054
            $pki_field = 'None';
1060
        }
1055
        }
1061
        if (   ( $cas && $query->param('ticket') )
1056
        if (   ( $query->param('ticket') && $query->param('cas_provider') )
1062
            || $q_userid
1057
            || $q_userid
1063
            || ( $shib && $shib_login )
1058
            || ( $shib && $shib_login )
1064
            || $pki_field ne 'None'
1059
            || $pki_field ne 'None'
Lines 1081-1087 sub checkauth { Link Here
1081
1076
1082
            # If shib login and match were successful, skip further login methods
1077
            # If shib login and match were successful, skip further login methods
1083
            unless ($shibSuccess) {
1078
            unless ($shibSuccess) {
1084
                if ( $cas && $query->param('ticket') ) {
1079
                if ( $query->param('ticket') && $query->param('cas_provider') ) {
1085
                    my $retuserid;
1080
                    my $retuserid;
1086
                    my $patron;
1081
                    my $patron;
1087
                    ( $return, $cardnumber, $retuserid, $patron, $cas_ticket ) =
1082
                    ( $return, $cardnumber, $retuserid, $patron, $cas_ticket ) =
Lines 1320-1326 sub checkauth { Link Here
1320
                    $session->param( 'register_name', $register_name );
1315
                    $session->param( 'register_name', $register_name );
1321
                    $session->param( 'sco_user',      $is_sco_user );
1316
                    $session->param( 'sco_user',      $is_sco_user );
1322
                }
1317
                }
1323
                $session->param( 'cas_ticket', $cas_ticket ) if $cas_ticket;
1318
                $session->param( 'cas_ticket',   $cas_ticket )                   if $cas_ticket;
1319
                $session->param( 'cas_provider', $query->param('cas_provider') ) if $cas_ticket;
1324
                C4::Context->set_userenv_from_session($session);
1320
                C4::Context->set_userenv_from_session($session);
1325
            }
1321
            }
1326
1322
Lines 1453-1462 sub checkauth { Link Here
1453
    my $template           = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1449
    my $template           = C4::Templates::gettemplate( $auth_template_name, $type, $query );
1454
1450
1455
    $template->param(
1451
    $template->param(
1456
        login                                 => 1,
1452
        login             => 1,
1457
        INPUTS                                => \@inputs,
1453
        INPUTS            => \@inputs,
1458
        script_name                           => get_script_name(),
1454
        script_name       => get_script_name(),
1459
        casAuthentication                     => C4::Context->preference("casAuthentication"),
1455
        casAuthentication => Koha::Auth::Identity::Providers->search( { protocol => 'CAS', enabled => 1 } )->count,
1460
        shibbolethAuthentication              => $shib,
1456
        shibbolethAuthentication              => $shib,
1461
        suggestion                            => C4::Context->preference("suggestion"),
1457
        suggestion                            => C4::Context->preference("suggestion"),
1462
        virtualshelves                        => C4::Context->preference("virtualshelves"),
1458
        virtualshelves                        => C4::Context->preference("virtualshelves"),
Lines 1525-1531 sub checkauth { Link Here
1525
1521
1526
    if ($forced_provider) {
1522
    if ($forced_provider) {
1527
        my $redirect_url;
1523
        my $redirect_url;
1528
        if ( $forced_provider->protocol eq 'SAML2' ) {
1524
        if ( $forced_provider->protocol eq 'CAS' ) {
1525
            $redirect_url = login_cas_url( $query, $forced_provider->code, $type );
1526
        } elsif ( $forced_provider->protocol eq 'SAML2' ) {
1529
            $redirect_url = login_shib_url($query);
1527
            $redirect_url = login_shib_url($query);
1530
        } elsif ( $forced_provider->protocol eq 'OIDC' || $forced_provider->protocol eq 'OAuth' ) {
1528
        } elsif ( $forced_provider->protocol eq 'OIDC' || $forced_provider->protocol eq 'OAuth' ) {
1531
            my $base = ( $type eq 'opac' ) ? "/api/v1/public/oauth/login" : "/api/v1/oauth/login";
1529
            my $base = ( $type eq 'opac' ) ? "/api/v1/public/oauth/login" : "/api/v1/oauth/login";
Lines 1537-1559 sub checkauth { Link Here
1537
        }
1535
        }
1538
    }
1536
    }
1539
1537
1540
    if ($cas) {
1538
    if ( Koha::Auth::Identity::Providers->search( { protocol => 'CAS', enabled => 1 } )->count ) {
1541
1539
        if ( multipleAuth() && !$query->param('cas_provider') ) {
1542
        # Is authentication against multiple CAS servers enabled?
1543
        require C4::Auth_with_cas;
1544
        if ( multipleAuth() && !$casparam ) {
1545
            my $casservers = getMultipleAuth();
1540
            my $casservers = getMultipleAuth();
1546
            my @tmplservers;
1541
            my @tmplservers;
1547
            foreach my $key ( keys %$casservers ) {
1542
            foreach my $key ( sort keys %$casservers ) {
1548
                push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
1543
                push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) };
1549
            }
1544
            }
1550
            $template->param( casServersLoop => \@tmplservers );
1545
            $template->param( casServersLoop => \@tmplservers );
1551
        } else {
1546
        } else {
1552
            $template->param(
1547
            $template->param(
1553
                casServerUrl => login_cas_url( $query, undef, $type ),
1548
                casServerUrl => login_cas_url( $query, $query->param('cas_provider'), $type ),
1554
            );
1549
            );
1555
        }
1550
        }
1556
1557
        $template->param( invalidCasLogin => $info{'invalidCasLogin'} );
1551
        $template->param( invalidCasLogin => $info{'invalidCasLogin'} );
1558
    }
1552
    }
1559
1553
Lines 1651-1657 sub check_api_auth { Link Here
1651
    unless ( $query->param('login_userid') ) {
1645
    unless ( $query->param('login_userid') ) {
1652
        $sessionID = $query->cookie("CGISESSID");
1646
        $sessionID = $query->cookie("CGISESSID");
1653
    }
1647
    }
1654
    if ( $sessionID && not( $cas && $query->param('PT') ) ) {
1648
    if ( $sessionID && not( $query->param('PT') ) ) {
1655
1649
1656
        my $return;
1650
        my $return;
1657
        ( $return, $session, undef ) =
1651
        ( $return, $session, undef ) =
Lines 1677-1683 sub check_api_auth { Link Here
1677
        my ( $return, $cardnumber, $cas_ticket );
1671
        my ( $return, $cardnumber, $cas_ticket );
1678
1672
1679
        # Proxy CAS auth
1673
        # Proxy CAS auth
1680
        if ( $cas && $query->param('PT') ) {
1674
        if ( $query->param('PT') ) {
1681
            my $retuserid;
1675
            my $retuserid;
1682
1676
1683
            # In case of a CAS authentication, we use the ticket instead of the password
1677
            # In case of a CAS authentication, we use the ticket instead of the password
Lines 2036-2042 sub checkpw { Link Here
2036
        }
2030
        }
2037
        $check_internal_as_fallback = 1 if $retval == 0;
2031
        $check_internal_as_fallback = 1 if $retval == 0;
2038
2032
2039
    } elsif ( $cas && $query && $query->param('ticket') ) {
2033
    } elsif ( $query && $query->param('ticket') && $query->param('cas_provider') ) {
2040
2034
2041
        # In case of a CAS authentication, we use the ticket instead of the password
2035
        # In case of a CAS authentication, we use the ticket instead of the password
2042
        my $ticket = $query->param('ticket');
2036
        my $ticket = $query->param('ticket');
2043
- 

Return to bug 40596