Lines 63-70
BEGIN {
Link Here
|
63 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
63 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
64 |
} |
64 |
} |
65 |
if ($shib) { |
65 |
if ($shib) { |
66 |
import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
66 |
import C4::Auth_with_Shibboleth |
67 |
# Getting user login |
67 |
qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
|
|
68 |
|
69 |
# Get shibboleth login attribute |
68 |
$shib_login = get_login_shib(); |
70 |
$shib_login = get_login_shib(); |
69 |
} |
71 |
} |
70 |
if ($cas) { |
72 |
if ($cas) { |
Lines 288-293
sub get_template_and_user {
Link Here
|
288 |
} |
290 |
} |
289 |
else { # if this is an anonymous session, setup to display public lists... |
291 |
else { # if this is an anonymous session, setup to display public lists... |
290 |
|
292 |
|
|
|
293 |
# If shibboleth is enabled, and we have a shibboleth login attribute, |
294 |
# but we are in an anonymouse session, we clearly have an invalid |
295 |
# Shibboleth account. |
296 |
if ( $shib && $shib_login ) { |
297 |
$template->param( invalidShibLogin => '1'); |
298 |
} |
299 |
|
291 |
$template->param( sessionID => $sessionID ); |
300 |
$template->param( sessionID => $sessionID ); |
292 |
|
301 |
|
293 |
my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); |
302 |
my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); |
Lines 718-723
sub checkauth {
Link Here
|
718 |
} |
727 |
} |
719 |
elsif ($logout) { |
728 |
elsif ($logout) { |
720 |
# voluntary logout the user |
729 |
# voluntary logout the user |
|
|
730 |
# check wether the user was using their shibboleth session or a local one |
731 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
721 |
$session->delete(); |
732 |
$session->delete(); |
722 |
$session->flush; |
733 |
$session->flush; |
723 |
C4::Context->_unset_userenv($sessionID); |
734 |
C4::Context->_unset_userenv($sessionID); |
Lines 729-736
sub checkauth {
Link Here
|
729 |
logout_cas($query); |
740 |
logout_cas($query); |
730 |
} |
741 |
} |
731 |
|
742 |
|
732 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) |
743 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
733 |
if ( $shib and $shib_login and $type eq 'opac') { |
744 |
if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') { |
734 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
745 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
735 |
logout_shib($query); |
746 |
logout_shib($query); |
736 |
} |
747 |
} |
Lines 803-822
sub checkauth {
Link Here
|
803 |
} |
814 |
} |
804 |
if ( ( $cas && $query->param('ticket') ) |
815 |
if ( ( $cas && $query->param('ticket') ) |
805 |
|| $userid |
816 |
|| $userid |
806 |
|| $shib |
817 |
|| ( $shib && $shib_login ) |
807 |
|| $pki_field ne 'None' |
818 |
|| $pki_field ne 'None' |
808 |
|| $persona ) |
819 |
|| $persona ) |
809 |
{ |
820 |
{ |
810 |
my $password = $query->param('password'); |
821 |
my $password = $query->param('password'); |
|
|
822 |
my $shibSuccess = 0; |
811 |
|
823 |
|
812 |
my ( $return, $cardnumber ); |
824 |
my ( $return, $cardnumber ); |
813 |
if ($shib && $shib_login && $type eq 'opac' && !$password) { |
825 |
# If shib is enabled and we have a shib login, does the login match a valid koha user |
|
|
826 |
if ( $shib && $shib_login && $type eq 'opac' ) { |
814 |
my $retuserid; |
827 |
my $retuserid; |
815 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); |
828 |
# Do not pass password here, else shib will not be checked in checkpw. |
|
|
829 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query ); |
816 |
$userid = $retuserid; |
830 |
$userid = $retuserid; |
|
|
831 |
$shibSuccess = $return; |
817 |
$info{'invalidShibLogin'} = 1 unless ($return); |
832 |
$info{'invalidShibLogin'} = 1 unless ($return); |
818 |
|
833 |
} |
819 |
} elsif ( $cas && $query->param('ticket') ) { |
834 |
# If shib login and match were successfull, skip further login methods |
|
|
835 |
unless ( $shibSuccess ) { |
836 |
if ( $cas && $query->param('ticket') ) { |
820 |
my $retuserid; |
837 |
my $retuserid; |
821 |
( $return, $cardnumber, $retuserid ) = |
838 |
( $return, $cardnumber, $retuserid ) = |
822 |
checkpw( $dbh, $userid, $password, $query ); |
839 |
checkpw( $dbh, $userid, $password, $query ); |
Lines 883-889
sub checkauth {
Link Here
|
883 |
( $return, $cardnumber, $retuserid ) = |
900 |
( $return, $cardnumber, $retuserid ) = |
884 |
checkpw( $dbh, $userid, $password, $query ); |
901 |
checkpw( $dbh, $userid, $password, $query ); |
885 |
$userid = $retuserid if ( $retuserid ); |
902 |
$userid = $retuserid if ( $retuserid ); |
886 |
} |
903 |
$info{'invalid_username_or_password'} = 1 unless ($return); |
|
|
904 |
} } |
887 |
if ($return) { |
905 |
if ($return) { |
888 |
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
906 |
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
889 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
907 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
Lines 971-976
sub checkauth {
Link Here
|
971 |
$session->param('emailaddress',$emailaddress); |
989 |
$session->param('emailaddress',$emailaddress); |
972 |
$session->param('ip',$session->remote_addr()); |
990 |
$session->param('ip',$session->remote_addr()); |
973 |
$session->param('lasttime',time()); |
991 |
$session->param('lasttime',time()); |
|
|
992 |
$session->param('shibboleth',$shibSuccess); |
974 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
993 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
975 |
} |
994 |
} |
976 |
elsif ( $return == 2 ) { |
995 |
elsif ( $return == 2 ) { |
Lines 997-1003
sub checkauth {
Link Here
|
997 |
$session->param('surname'), $session->param('branch'), |
1016 |
$session->param('surname'), $session->param('branch'), |
998 |
$session->param('branchname'), $session->param('flags'), |
1017 |
$session->param('branchname'), $session->param('flags'), |
999 |
$session->param('emailaddress'), $session->param('branchprinter'), |
1018 |
$session->param('emailaddress'), $session->param('branchprinter'), |
1000 |
$session->param('persona') |
1019 |
$session->param('persona'), $session->param('shibboleth') |
1001 |
); |
1020 |
); |
1002 |
|
1021 |
|
1003 |
} |
1022 |
} |
Lines 1557-1563
sub get_session {
Link Here
|
1557 |
|
1576 |
|
1558 |
sub checkpw { |
1577 |
sub checkpw { |
1559 |
my ( $dbh, $userid, $password, $query ) = @_; |
1578 |
my ( $dbh, $userid, $password, $query ) = @_; |
1560 |
|
|
|
1561 |
if ($ldap) { |
1579 |
if ($ldap) { |
1562 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1580 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1563 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
1581 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
Lines 1573-1584
sub checkpw {
Link Here
|
1573 |
return 0; |
1591 |
return 0; |
1574 |
} |
1592 |
} |
1575 |
|
1593 |
|
1576 |
# If we are in a shibboleth session (shibboleth is enabled and no password has been provided) |
1594 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present) |
1577 |
if ($shib && !$password) { |
1595 |
# Check for password to asertain whether we want to be testing against shibboleth or another method this |
|
|
1596 |
# time around. |
1597 |
if ($shib && $shib_login && !$password) { |
1578 |
|
1598 |
|
1579 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1599 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1580 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1600 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1581 |
# (defined in the shibbolethLoginAttribute) tto contain the login of the |
1601 |
# (defined under shibboleth mapping in koha-conf.xml) to contain the login of the |
1582 |
# shibboleth-authenticated user |
1602 |
# shibboleth-authenticated user |
1583 |
|
1603 |
|
1584 |
# Then, we check if it matches a valid koha user |
1604 |
# Then, we check if it matches a valid koha user |