Lines 34-40
use POSIX qw/strftime/;
Link Here
|
34 |
use List::MoreUtils qw/ any /; |
34 |
use List::MoreUtils qw/ any /; |
35 |
|
35 |
|
36 |
# use utf8; |
36 |
# use utf8; |
37 |
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); |
37 |
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login); |
38 |
|
38 |
|
39 |
BEGIN { |
39 |
BEGIN { |
40 |
sub psgi_env { any { /^psgi\./ } keys %ENV } |
40 |
sub psgi_env { any { /^psgi\./ } keys %ENV } |
Lines 54-65
BEGIN {
Link Here
|
54 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
54 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
55 |
$ldap = C4::Context->config('useldapserver') || 0; |
55 |
$ldap = C4::Context->config('useldapserver') || 0; |
56 |
$cas = C4::Context->preference('casAuthentication'); |
56 |
$cas = C4::Context->preference('casAuthentication'); |
|
|
57 |
$shib = C4::Context->preference('shibbolethAuthentication'); |
57 |
$caslogout = C4::Context->preference('casLogout'); |
58 |
$caslogout = C4::Context->preference('casLogout'); |
58 |
require C4::Auth_with_cas; # no import |
59 |
require C4::Auth_with_cas; # no import |
|
|
60 |
require C4::Auth_with_Shibboleth; |
59 |
if ($ldap) { |
61 |
if ($ldap) { |
60 |
require C4::Auth_with_ldap; |
62 |
require C4::Auth_with_ldap; |
61 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
63 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
62 |
} |
64 |
} |
|
|
65 |
if ($shib) { |
66 |
import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
67 |
# Getting user login |
68 |
$shib_login = get_login_shib(); |
69 |
} |
63 |
if ($cas) { |
70 |
if ($cas) { |
64 |
import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); |
71 |
import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); |
65 |
} |
72 |
} |
Lines 646-653
sub checkauth {
Link Here
|
646 |
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml |
653 |
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml |
647 |
my $casparam = $query->param('cas'); |
654 |
my $casparam = $query->param('cas'); |
648 |
|
655 |
|
649 |
if ( $userid = $ENV{'REMOTE_USER'} ) { |
656 |
# Basic authentication is incompatible with the use of Shibboleth, |
650 |
# Using Basic Authentication, no cookies required |
657 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
|
658 |
# and it may not be the attribute we want to use to match the koha login. |
659 |
# |
660 |
# Also, do not consider an empty REMOTE_USER. |
661 |
# |
662 |
# Finally, after those tests, we can assume (although if it would be better with |
663 |
# a syspref) that if we get a REMOTE_USER, that's from basic authentication, |
664 |
# and we can affect it to $userid. |
665 |
if ( !$shib and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { |
666 |
|
667 |
# Using Basic Authentication, no cookies required |
651 |
$cookie = $query->cookie( |
668 |
$cookie = $query->cookie( |
652 |
-name => 'CGISESSID', |
669 |
-name => 'CGISESSID', |
653 |
-value => '', |
670 |
-value => '', |
Lines 702-712
sub checkauth {
Link Here
|
702 |
$sessionID = undef; |
719 |
$sessionID = undef; |
703 |
$userid = undef; |
720 |
$userid = undef; |
704 |
|
721 |
|
705 |
if ($cas and $caslogout) { |
722 |
if ($cas and $caslogout) { |
706 |
logout_cas($query); |
723 |
logout_cas($query); |
707 |
} |
724 |
} |
|
|
725 |
|
726 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) |
727 |
if ( $shib and $shib_login and $type eq 'opac') { |
728 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
729 |
logout_shib($query); |
730 |
} |
708 |
} |
731 |
} |
709 |
elsif ( $lasttime < time() - $timeout ) { |
732 |
elsif ( $lasttime < time() - $timeout ) { |
|
|
733 |
|
710 |
# timed logout |
734 |
# timed logout |
711 |
$info{'timed_out'} = 1; |
735 |
$info{'timed_out'} = 1; |
712 |
$session->delete() if $session; |
736 |
$session->delete() if $session; |
Lines 754-769
sub checkauth {
Link Here
|
754 |
-value => $session->id, |
778 |
-value => $session->id, |
755 |
-HttpOnly => 1 |
779 |
-HttpOnly => 1 |
756 |
); |
780 |
); |
757 |
$userid = $query->param('userid'); |
781 |
$userid = $query->param('userid'); |
758 |
if ( ( $cas && $query->param('ticket') ) |
782 |
if ( ( $cas && $query->param('ticket') ) |
759 |
|| $userid |
783 |
|| $userid |
|
|
784 |
|| $shib |
760 |
|| ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne |
785 |
|| ( my $pki_field = C4::Context->preference('AllowPKIAuth') ) ne |
761 |
'None' || $persona ) |
786 |
'None' || $persona ) |
762 |
{ |
787 |
{ |
763 |
my $password = $query->param('password'); |
788 |
my $password = $query->param('password'); |
764 |
|
789 |
|
765 |
my ( $return, $cardnumber ); |
790 |
my ( $return, $cardnumber ); |
766 |
if ( $cas && $query->param('ticket') ) { |
791 |
if ($shib && $shib_login && $type eq 'opac' && !$password) { |
|
|
792 |
my $retuserid; |
793 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); |
794 |
$userid = $retuserid; |
795 |
$info{'invalidShibLogin'} = 1 unless ($return); |
796 |
|
797 |
} elsif ( $cas && $query->param('ticket') ) { |
767 |
my $retuserid; |
798 |
my $retuserid; |
768 |
( $return, $cardnumber, $retuserid ) = |
799 |
( $return, $cardnumber, $retuserid ) = |
769 |
checkpw( $dbh, $userid, $password, $query ); |
800 |
checkpw( $dbh, $userid, $password, $query ); |
Lines 1008-1013
sub checkauth {
Link Here
|
1008 |
login => 1, |
1039 |
login => 1, |
1009 |
INPUTS => \@inputs, |
1040 |
INPUTS => \@inputs, |
1010 |
casAuthentication => C4::Context->preference("casAuthentication"), |
1041 |
casAuthentication => C4::Context->preference("casAuthentication"), |
|
|
1042 |
shibbolethAuthentication => C4::Context->preference("shibbolethAuthentication"), |
1011 |
suggestion => C4::Context->preference("suggestion"), |
1043 |
suggestion => C4::Context->preference("suggestion"), |
1012 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1044 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1013 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
1045 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
Lines 1079-1084
sub checkauth {
Link Here
|
1079 |
); |
1111 |
); |
1080 |
} |
1112 |
} |
1081 |
|
1113 |
|
|
|
1114 |
if ($shib) { |
1115 |
$template->param( |
1116 |
shibbolethLoginUrl => login_shib_url($query), |
1117 |
); |
1118 |
} |
1119 |
|
1082 |
my $self_url = $query->url( -absolute => 1 ); |
1120 |
my $self_url = $query->url( -absolute => 1 ); |
1083 |
$template->param( |
1121 |
$template->param( |
1084 |
url => $self_url, |
1122 |
url => $self_url, |
Lines 1505-1510
sub checkpw {
Link Here
|
1505 |
return 0; |
1543 |
return 0; |
1506 |
} |
1544 |
} |
1507 |
|
1545 |
|
|
|
1546 |
# If we are in a shibboleth session (shibboleth is enabled and no password has been provided) |
1547 |
if ($shib && !$password) { |
1548 |
|
1549 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1550 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1551 |
# (defined in the shibbolethLoginAttribute) tto contain the login of the |
1552 |
# shibboleth-authenticated user |
1553 |
|
1554 |
# Shibboleth attributes are mapped into http environmement variables, |
1555 |
# so we're getting the login of the user this way |
1556 |
my $attributename = C4::Context->preference('shibbolethLoginAttribute'); |
1557 |
my $attributevalue = $ENV{$attributename}; |
1558 |
|
1559 |
# Then, we check if it matches a valid koha user |
1560 |
if ($shib_login) { |
1561 |
my ( $retval, $retcard, $retuserid ) = C4::Auth_with_Shibboleth::checkpw_shib( $dbh, $shib_login ); # EXTERNAL AUTH |
1562 |
($retval) and return ( $retval, $retcard, $retuserid ); |
1563 |
return 0; |
1564 |
} |
1565 |
} |
1566 |
|
1567 |
# INTERNAL AUTH |
1508 |
return checkpw_internal(@_) |
1568 |
return checkpw_internal(@_) |
1509 |
} |
1569 |
} |
1510 |
|
1570 |
|