|
Lines 58-63
use Koha::Patron::Consents;
Link Here
|
| 58 |
use List::MoreUtils qw( any ); |
58 |
use List::MoreUtils qw( any ); |
| 59 |
use Encode; |
59 |
use Encode; |
| 60 |
use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib ); |
60 |
use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib ); |
|
|
61 |
use Koha::Auth::Identity::Providers; |
| 61 |
use Net::CIDR; |
62 |
use Net::CIDR; |
| 62 |
use C4::Log qw( logaction ); |
63 |
use C4::Log qw( logaction ); |
| 63 |
use Koha::CookieManager; |
64 |
use Koha::CookieManager; |
|
Lines 68-87
use Koha::Session;
Link Here
|
| 68 |
|
69 |
|
| 69 |
# use utf8; |
70 |
# use utf8; |
| 70 |
|
71 |
|
| 71 |
use vars qw($ldap $cas $caslogout); |
72 |
use vars qw($ldap); |
|
|
73 |
|
| 74 |
use C4::Auth_with_cas |
| 75 |
qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required multipleAuth getMultipleAuth); |
| 72 |
|
76 |
|
| 73 |
BEGIN { |
77 |
BEGIN { |
| 74 |
C4::Context->set_remote_address; |
78 |
C4::Context->set_remote_address; |
| 75 |
|
|
|
| 76 |
$cas = C4::Context->preference('casAuthentication'); |
| 77 |
$caslogout = C4::Context->preference('casLogout'); |
| 78 |
|
| 79 |
if ($cas) { |
| 80 |
require C4::Auth_with_cas; # no import |
| 81 |
import C4::Auth_with_cas |
| 82 |
qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required multipleAuth getMultipleAuth); |
| 83 |
} |
| 84 |
|
| 85 |
} |
79 |
} |
| 86 |
|
80 |
|
| 87 |
=head1 NAME |
81 |
=head1 NAME |
|
Lines 943-949
sub checkauth {
Link Here
|
| 943 |
); |
937 |
); |
| 944 |
|
938 |
|
| 945 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
939 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
| 946 |
|| ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
940 |
|| ( $query->param('cas_provider') && $query->param('ticket') && !C4::Context->userenv->{'id'} ) |
| 947 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) ) |
941 |
|| ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) ) |
| 948 |
{ |
942 |
{ |
| 949 |
|
943 |
|
|
Lines 1000-1006
sub checkauth {
Link Here
|
| 1000 |
|
994 |
|
| 1001 |
# voluntary logout the user |
995 |
# voluntary logout the user |
| 1002 |
# check whether the user was using their shibboleth session or a local one |
996 |
# check whether the user was using their shibboleth session or a local one |
| 1003 |
my $shibSuccess = C4::Context->userenv ? C4::Context->userenv->{'shibboleth'} : undef; |
997 |
my $shibSuccess = C4::Context->userenv ? C4::Context->userenv->{'shibboleth'} : undef; |
|
|
998 |
my $cas_provider_code = $session ? $session->param('cas_provider') : undef; |
| 1004 |
if ($session) { |
999 |
if ($session) { |
| 1005 |
$session->delete(); |
1000 |
$session->delete(); |
| 1006 |
$session->flush; |
1001 |
$session->flush; |
|
Lines 1008-1015
sub checkauth {
Link Here
|
| 1008 |
C4::Context::unset_userenv(); |
1003 |
C4::Context::unset_userenv(); |
| 1009 |
$cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie ); |
1004 |
$cookie = $cookie_mgr->clear_unless( $query->cookie, @$cookie ); |
| 1010 |
|
1005 |
|
| 1011 |
if ( $cas and $caslogout ) { |
1006 |
if ( C4::Context->preference('casLogout') && $cas_provider_code ) { |
| 1012 |
logout_cas( $query, $type ); |
1007 |
logout_cas( $query, $type, $cas_provider_code ); |
| 1013 |
} |
1008 |
} |
| 1014 |
|
1009 |
|
| 1015 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
1010 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
|
Lines 1058-1064
sub checkauth {
Link Here
|
| 1058 |
print STDERR "ERROR: Missing system preference AllowPKIAuth.\n"; |
1053 |
print STDERR "ERROR: Missing system preference AllowPKIAuth.\n"; |
| 1059 |
$pki_field = 'None'; |
1054 |
$pki_field = 'None'; |
| 1060 |
} |
1055 |
} |
| 1061 |
if ( ( $cas && $query->param('ticket') ) |
1056 |
if ( ( $query->param('ticket') && $query->param('cas_provider') ) |
| 1062 |
|| $q_userid |
1057 |
|| $q_userid |
| 1063 |
|| ( $shib && $shib_login ) |
1058 |
|| ( $shib && $shib_login ) |
| 1064 |
|| $pki_field ne 'None' |
1059 |
|| $pki_field ne 'None' |
|
Lines 1081-1087
sub checkauth {
Link Here
|
| 1081 |
|
1076 |
|
| 1082 |
# If shib login and match were successful, skip further login methods |
1077 |
# If shib login and match were successful, skip further login methods |
| 1083 |
unless ($shibSuccess) { |
1078 |
unless ($shibSuccess) { |
| 1084 |
if ( $cas && $query->param('ticket') ) { |
1079 |
if ( $query->param('ticket') && $query->param('cas_provider') ) { |
| 1085 |
my $retuserid; |
1080 |
my $retuserid; |
| 1086 |
my $patron; |
1081 |
my $patron; |
| 1087 |
( $return, $cardnumber, $retuserid, $patron, $cas_ticket ) = |
1082 |
( $return, $cardnumber, $retuserid, $patron, $cas_ticket ) = |
|
Lines 1320-1326
sub checkauth {
Link Here
|
| 1320 |
$session->param( 'register_name', $register_name ); |
1315 |
$session->param( 'register_name', $register_name ); |
| 1321 |
$session->param( 'sco_user', $is_sco_user ); |
1316 |
$session->param( 'sco_user', $is_sco_user ); |
| 1322 |
} |
1317 |
} |
| 1323 |
$session->param( 'cas_ticket', $cas_ticket ) if $cas_ticket; |
1318 |
$session->param( 'cas_ticket', $cas_ticket ) if $cas_ticket; |
|
|
1319 |
$session->param( 'cas_provider', $query->param('cas_provider') ) if $cas_ticket; |
| 1324 |
C4::Context->set_userenv_from_session($session); |
1320 |
C4::Context->set_userenv_from_session($session); |
| 1325 |
} |
1321 |
} |
| 1326 |
|
1322 |
|
|
Lines 1453-1462
sub checkauth {
Link Here
|
| 1453 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
1449 |
my $template = C4::Templates::gettemplate( $auth_template_name, $type, $query ); |
| 1454 |
|
1450 |
|
| 1455 |
$template->param( |
1451 |
$template->param( |
| 1456 |
login => 1, |
1452 |
login => 1, |
| 1457 |
INPUTS => \@inputs, |
1453 |
INPUTS => \@inputs, |
| 1458 |
script_name => get_script_name(), |
1454 |
script_name => get_script_name(), |
| 1459 |
casAuthentication => C4::Context->preference("casAuthentication"), |
1455 |
casAuthentication => Koha::Auth::Identity::Providers->search( { protocol => 'CAS', enabled => 1 } )->count, |
| 1460 |
shibbolethAuthentication => $shib, |
1456 |
shibbolethAuthentication => $shib, |
| 1461 |
suggestion => C4::Context->preference("suggestion"), |
1457 |
suggestion => C4::Context->preference("suggestion"), |
| 1462 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1458 |
virtualshelves => C4::Context->preference("virtualshelves"), |
|
Lines 1525-1531
sub checkauth {
Link Here
|
| 1525 |
|
1521 |
|
| 1526 |
if ($forced_provider) { |
1522 |
if ($forced_provider) { |
| 1527 |
my $redirect_url; |
1523 |
my $redirect_url; |
| 1528 |
if ( $forced_provider->protocol eq 'SAML2' ) { |
1524 |
if ( $forced_provider->protocol eq 'CAS' ) { |
|
|
1525 |
$redirect_url = login_cas_url( $query, $forced_provider->code, $type ); |
| 1526 |
} elsif ( $forced_provider->protocol eq 'SAML2' ) { |
| 1529 |
$redirect_url = login_shib_url($query); |
1527 |
$redirect_url = login_shib_url($query); |
| 1530 |
} elsif ( $forced_provider->protocol eq 'OIDC' || $forced_provider->protocol eq 'OAuth' ) { |
1528 |
} elsif ( $forced_provider->protocol eq 'OIDC' || $forced_provider->protocol eq 'OAuth' ) { |
| 1531 |
my $base = ( $type eq 'opac' ) ? "/api/v1/public/oauth/login" : "/api/v1/oauth/login"; |
1529 |
my $base = ( $type eq 'opac' ) ? "/api/v1/public/oauth/login" : "/api/v1/oauth/login"; |
|
Lines 1537-1559
sub checkauth {
Link Here
|
| 1537 |
} |
1535 |
} |
| 1538 |
} |
1536 |
} |
| 1539 |
|
1537 |
|
| 1540 |
if ($cas) { |
1538 |
if ( Koha::Auth::Identity::Providers->search( { protocol => 'CAS', enabled => 1 } )->count ) { |
| 1541 |
|
1539 |
if ( multipleAuth() && !$query->param('cas_provider') ) { |
| 1542 |
# Is authentication against multiple CAS servers enabled? |
|
|
| 1543 |
require C4::Auth_with_cas; |
| 1544 |
if ( multipleAuth() && !$casparam ) { |
| 1545 |
my $casservers = getMultipleAuth(); |
1540 |
my $casservers = getMultipleAuth(); |
| 1546 |
my @tmplservers; |
1541 |
my @tmplservers; |
| 1547 |
foreach my $key ( keys %$casservers ) { |
1542 |
foreach my $key ( sort keys %$casservers ) { |
| 1548 |
push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" }; |
1543 |
push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) }; |
| 1549 |
} |
1544 |
} |
| 1550 |
$template->param( casServersLoop => \@tmplservers ); |
1545 |
$template->param( casServersLoop => \@tmplservers ); |
| 1551 |
} else { |
1546 |
} else { |
| 1552 |
$template->param( |
1547 |
$template->param( |
| 1553 |
casServerUrl => login_cas_url( $query, undef, $type ), |
1548 |
casServerUrl => login_cas_url( $query, $query->param('cas_provider'), $type ), |
| 1554 |
); |
1549 |
); |
| 1555 |
} |
1550 |
} |
| 1556 |
|
|
|
| 1557 |
$template->param( invalidCasLogin => $info{'invalidCasLogin'} ); |
1551 |
$template->param( invalidCasLogin => $info{'invalidCasLogin'} ); |
| 1558 |
} |
1552 |
} |
| 1559 |
|
1553 |
|
|
Lines 1651-1657
sub check_api_auth {
Link Here
|
| 1651 |
unless ( $query->param('login_userid') ) { |
1645 |
unless ( $query->param('login_userid') ) { |
| 1652 |
$sessionID = $query->cookie("CGISESSID"); |
1646 |
$sessionID = $query->cookie("CGISESSID"); |
| 1653 |
} |
1647 |
} |
| 1654 |
if ( $sessionID && not( $cas && $query->param('PT') ) ) { |
1648 |
if ( $sessionID && not( $query->param('PT') ) ) { |
| 1655 |
|
1649 |
|
| 1656 |
my $return; |
1650 |
my $return; |
| 1657 |
( $return, $session, undef ) = |
1651 |
( $return, $session, undef ) = |
|
Lines 1677-1683
sub check_api_auth {
Link Here
|
| 1677 |
my ( $return, $cardnumber, $cas_ticket ); |
1671 |
my ( $return, $cardnumber, $cas_ticket ); |
| 1678 |
|
1672 |
|
| 1679 |
# Proxy CAS auth |
1673 |
# Proxy CAS auth |
| 1680 |
if ( $cas && $query->param('PT') ) { |
1674 |
if ( $query->param('PT') ) { |
| 1681 |
my $retuserid; |
1675 |
my $retuserid; |
| 1682 |
|
1676 |
|
| 1683 |
# In case of a CAS authentication, we use the ticket instead of the password |
1677 |
# In case of a CAS authentication, we use the ticket instead of the password |
|
Lines 2036-2042
sub checkpw {
Link Here
|
| 2036 |
} |
2030 |
} |
| 2037 |
$check_internal_as_fallback = 1 if $retval == 0; |
2031 |
$check_internal_as_fallback = 1 if $retval == 0; |
| 2038 |
|
2032 |
|
| 2039 |
} elsif ( $cas && $query && $query->param('ticket') ) { |
2033 |
} elsif ( $query && $query->param('ticket') && $query->param('cas_provider') ) { |
| 2040 |
|
2034 |
|
| 2041 |
# In case of a CAS authentication, we use the ticket instead of the password |
2035 |
# In case of a CAS authentication, we use the ticket instead of the password |
| 2042 |
my $ticket = $query->param('ticket'); |
2036 |
my $ticket = $query->param('ticket'); |
| 2043 |
- |
|
|