|
Lines 34-40
use POSIX qw/strftime/;
Link Here
|
| 34 |
use List::MoreUtils qw/ any /; |
34 |
use List::MoreUtils qw/ any /; |
| 35 |
|
35 |
|
| 36 |
# use utf8; |
36 |
# use utf8; |
| 37 |
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); |
37 |
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login); |
| 38 |
|
38 |
|
| 39 |
BEGIN { |
39 |
BEGIN { |
| 40 |
sub psgi_env { any { /^psgi\./ } keys %ENV } |
40 |
sub psgi_env { any { /^psgi\./ } keys %ENV } |
|
Lines 54-65
BEGIN {
Link Here
|
| 54 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
54 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
| 55 |
$ldap = C4::Context->config('useldapserver') || 0; |
55 |
$ldap = C4::Context->config('useldapserver') || 0; |
| 56 |
$cas = C4::Context->preference('casAuthentication'); |
56 |
$cas = C4::Context->preference('casAuthentication'); |
|
|
57 |
$shib = C4::Context->preference('shibbolethAuthentication'); |
| 57 |
$caslogout = C4::Context->preference('casLogout'); |
58 |
$caslogout = C4::Context->preference('casLogout'); |
| 58 |
require C4::Auth_with_cas; # no import |
59 |
require C4::Auth_with_cas; # no import |
|
|
60 |
require C4::Auth_with_Shibboleth; |
| 59 |
if ($ldap) { |
61 |
if ($ldap) { |
| 60 |
require C4::Auth_with_ldap; |
62 |
require C4::Auth_with_ldap; |
| 61 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
63 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
| 62 |
} |
64 |
} |
|
|
65 |
if ($shib) { |
| 66 |
import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
| 67 |
# Getting user login |
| 68 |
$shib_login = get_login_shib(); |
| 69 |
} |
| 63 |
if ($cas) { |
70 |
if ($cas) { |
| 64 |
import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); |
71 |
import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); |
| 65 |
} |
72 |
} |
|
Lines 649-656
sub checkauth {
Link Here
|
| 649 |
my $casparam = $query->param('cas'); |
656 |
my $casparam = $query->param('cas'); |
| 650 |
my $q_userid = $query->param('userid') // ''; |
657 |
my $q_userid = $query->param('userid') // ''; |
| 651 |
|
658 |
|
| 652 |
if ( $userid = $ENV{'REMOTE_USER'} ) { |
659 |
# Basic authentication is incompatible with the use of Shibboleth, |
| 653 |
# Using Basic Authentication, no cookies required |
660 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
|
661 |
# and it may not be the attribute we want to use to match the koha login. |
| 662 |
# |
| 663 |
# Also, do not consider an empty REMOTE_USER. |
| 664 |
# |
| 665 |
# Finally, after those tests, we can assume (although if it would be better with |
| 666 |
# a syspref) that if we get a REMOTE_USER, that's from basic authentication, |
| 667 |
# and we can affect it to $userid. |
| 668 |
if ( !$shib and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { |
| 669 |
|
| 670 |
# Using Basic Authentication, no cookies required |
| 654 |
$cookie = $query->cookie( |
671 |
$cookie = $query->cookie( |
| 655 |
-name => 'CGISESSID', |
672 |
-name => 'CGISESSID', |
| 656 |
-value => '', |
673 |
-value => '', |
|
Lines 708-716
sub checkauth {
Link Here
|
| 708 |
$sessionID = undef; |
725 |
$sessionID = undef; |
| 709 |
$userid = undef; |
726 |
$userid = undef; |
| 710 |
|
727 |
|
| 711 |
if ($cas and $caslogout) { |
728 |
if ($cas and $caslogout) { |
| 712 |
logout_cas($query); |
729 |
logout_cas($query); |
| 713 |
} |
730 |
} |
|
|
731 |
|
| 732 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) |
| 733 |
if ( $shib and $shib_login and $type eq 'opac') { |
| 734 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
| 735 |
logout_shib($query); |
| 736 |
} |
| 714 |
} |
737 |
} |
| 715 |
elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { |
738 |
elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { |
| 716 |
# timed logout |
739 |
# timed logout |
|
Lines 780-792
sub checkauth {
Link Here
|
| 780 |
} |
803 |
} |
| 781 |
if ( ( $cas && $query->param('ticket') ) |
804 |
if ( ( $cas && $query->param('ticket') ) |
| 782 |
|| $userid |
805 |
|| $userid |
|
|
806 |
|| $shib |
| 783 |
|| $pki_field ne 'None' |
807 |
|| $pki_field ne 'None' |
| 784 |
|| $persona ) |
808 |
|| $persona ) |
| 785 |
{ |
809 |
{ |
| 786 |
my $password = $query->param('password'); |
810 |
my $password = $query->param('password'); |
| 787 |
|
811 |
|
| 788 |
my ( $return, $cardnumber ); |
812 |
my ( $return, $cardnumber ); |
| 789 |
if ( $cas && $query->param('ticket') ) { |
813 |
if ($shib && $shib_login && $type eq 'opac' && !$password) { |
|
|
814 |
my $retuserid; |
| 815 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); |
| 816 |
$userid = $retuserid; |
| 817 |
$info{'invalidShibLogin'} = 1 unless ($return); |
| 818 |
|
| 819 |
} elsif ( $cas && $query->param('ticket') ) { |
| 790 |
my $retuserid; |
820 |
my $retuserid; |
| 791 |
( $return, $cardnumber, $retuserid ) = |
821 |
( $return, $cardnumber, $retuserid ) = |
| 792 |
checkpw( $dbh, $userid, $password, $query ); |
822 |
checkpw( $dbh, $userid, $password, $query ); |
|
Lines 1033-1038
sub checkauth {
Link Here
|
| 1033 |
login => 1, |
1063 |
login => 1, |
| 1034 |
INPUTS => \@inputs, |
1064 |
INPUTS => \@inputs, |
| 1035 |
casAuthentication => C4::Context->preference("casAuthentication"), |
1065 |
casAuthentication => C4::Context->preference("casAuthentication"), |
|
|
1066 |
shibbolethAuthentication => C4::Context->preference("shibbolethAuthentication"), |
| 1036 |
suggestion => C4::Context->preference("suggestion"), |
1067 |
suggestion => C4::Context->preference("suggestion"), |
| 1037 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1068 |
virtualshelves => C4::Context->preference("virtualshelves"), |
| 1038 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
1069 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
|
Lines 1104-1109
sub checkauth {
Link Here
|
| 1104 |
); |
1135 |
); |
| 1105 |
} |
1136 |
} |
| 1106 |
|
1137 |
|
|
|
1138 |
if ($shib) { |
| 1139 |
$template->param( |
| 1140 |
shibbolethLoginUrl => login_shib_url($query), |
| 1141 |
); |
| 1142 |
} |
| 1143 |
|
| 1107 |
my $self_url = $query->url( -absolute => 1 ); |
1144 |
my $self_url = $query->url( -absolute => 1 ); |
| 1108 |
$template->param( |
1145 |
$template->param( |
| 1109 |
url => $self_url, |
1146 |
url => $self_url, |
|
Lines 1536-1541
sub checkpw {
Link Here
|
| 1536 |
return 0; |
1573 |
return 0; |
| 1537 |
} |
1574 |
} |
| 1538 |
|
1575 |
|
|
|
1576 |
# If we are in a shibboleth session (shibboleth is enabled and no password has been provided) |
| 1577 |
if ($shib && !$password) { |
| 1578 |
|
| 1579 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
| 1580 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
| 1581 |
# (defined in the shibbolethLoginAttribute) tto contain the login of the |
| 1582 |
# shibboleth-authenticated user |
| 1583 |
|
| 1584 |
# Shibboleth attributes are mapped into http environmement variables, |
| 1585 |
# so we're getting the login of the user this way |
| 1586 |
my $attributename = C4::Context->preference('shibbolethLoginAttribute'); |
| 1587 |
my $attributevalue = $ENV{$attributename}; |
| 1588 |
|
| 1589 |
# Then, we check if it matches a valid koha user |
| 1590 |
if ($shib_login) { |
| 1591 |
my ( $retval, $retcard, $retuserid ) = C4::Auth_with_Shibboleth::checkpw_shib( $dbh, $shib_login ); # EXTERNAL AUTH |
| 1592 |
($retval) and return ( $retval, $retcard, $retuserid ); |
| 1593 |
return 0; |
| 1594 |
} |
| 1595 |
} |
| 1596 |
|
| 1597 |
# INTERNAL AUTH |
| 1539 |
return checkpw_internal(@_) |
1598 |
return checkpw_internal(@_) |
| 1540 |
} |
1599 |
} |
| 1541 |
|
1600 |
|