|
Line 0
Link Here
|
| 0 |
- |
1 |
#!/bin/perl -w |
|
|
2 |
# Copyright chris@bigballofwax.co.nz 2013 |
| 3 |
# |
| 4 |
# This file is part of Koha. |
| 5 |
# |
| 6 |
# Koha is free software; you can redistribute it and/or modify it under the |
| 7 |
# terms of the GNU General Public License as published by the Free Software |
| 8 |
# Foundation; either version 3 of the License, or (at your option) any later |
| 9 |
# version. |
| 10 |
# |
| 11 |
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY |
| 12 |
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR |
| 13 |
# A PARTICULAR PURPOSE. See the GNU General Public License for more details. |
| 14 |
# |
| 15 |
# You should have received a copy of the GNU General Public License along |
| 16 |
# with Koha; if not, write to the Free Software Foundation, Inc., |
| 17 |
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
| 18 |
# |
| 19 |
# |
| 20 |
# Basic OAuth2 authentication for google goes like this |
| 21 |
# First: get your clientid, clientsecret from google. At this stage, tell google that |
| 22 |
# your redirect url is /cgi-bin/koha/svc/oauthlogin |
| 23 |
# |
| 24 |
# The first thing that happens when this script is called is that one gets redirected |
| 25 |
# to an authentication url from google |
| 26 |
# |
| 27 |
# If successful, that then redirects back to this script, setting a CODE parameter |
| 28 |
# which we use to look up a json authentication token. This token includes an encrypted |
| 29 |
# json id_token, which we round-trip back to google to decrypt. Finally, we can extract |
| 30 |
# the email address from this. |
| 31 |
# |
| 32 |
# There is LOTS of room for improvement here. |
| 33 |
# 1. move the clientid, clientsecret to systempreferences |
| 34 |
# 2. use the OPACBaseURL preference to compute the redirecturl |
| 35 |
# 4. Google recommends verifying and decrypting the id_token locally, which means caching |
| 36 |
# some information and updating it daily. But that would make things a lot faster |
| 37 |
|
| 38 |
use strict; |
| 39 |
use warnings; |
| 40 |
use CGI qw/escape/; |
| 41 |
use C4::Auth; |
| 42 |
use C4::Context; |
| 43 |
use C4::Output; |
| 44 |
|
| 45 |
use LWP::UserAgent; |
| 46 |
use HTTP::Request::Common qw{ POST }; |
| 47 |
use JSON; |
| 48 |
|
| 49 |
my $scope="openid email"; |
| 50 |
my $host = C4::Context->preference('OPACBaseURL'); |
| 51 |
my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain'); |
| 52 |
my $redirecturl = 'http://' . $host . '/cgi-bin/koha/svc/googleoauth2'; |
| 53 |
my $issuer = 'accounts.google.com'; |
| 54 |
my $clientid = C4::Context->preference('GoogleOAuth2ClientID'); |
| 55 |
my $clientsecret = C4::Context->preference('GoogleOAuth2ClientSecret'); |
| 56 |
|
| 57 |
my $query = new CGI; |
| 58 |
|
| 59 |
sub loginfailed { |
| 60 |
my $query = shift; |
| 61 |
my $reason = shift; |
| 62 |
$query->delete('code'); |
| 63 |
$query->param('OAuth2Failed'=>$reason); |
| 64 |
my ( $template, $borrowernumber, $cookie ) = get_template_and_user( |
| 65 |
{ |
| 66 |
template_name => 'opac-user.tmpl', |
| 67 |
query => $query, |
| 68 |
type => 'opac', |
| 69 |
authnotrequired => 0, |
| 70 |
flagsrequired => { borrow => 1 }, |
| 71 |
} |
| 72 |
); |
| 73 |
$template->param( 'invalidOAuth2Login' => $reason ); |
| 74 |
$template->param( 'loginprompt' => 1); |
| 75 |
output_html_with_http_headers $query, $cookie, $template->output; |
| 76 |
} |
| 77 |
#die $query->param('code'); |
| 78 |
if (defined $query->param('error')) { |
| 79 |
loginfailed($query, 'An authentication error occurred. (Error:' . $query->param('error') . ')'); |
| 80 |
} elsif (defined $query->param('code')) { |
| 81 |
my $code=$query->param('code'); |
| 82 |
my $ua = LWP::UserAgent->new(); |
| 83 |
my $request = POST('https://accounts.google.com/o/oauth2/token', [ |
| 84 |
code => $code, |
| 85 |
client_id => $clientid, |
| 86 |
client_secret => $clientsecret, |
| 87 |
redirect_uri => $redirecturl, |
| 88 |
grant_type => 'authorization_code', |
| 89 |
$scope => $scope |
| 90 |
]); |
| 91 |
my $response = $ua->request($request)->decoded_content ; |
| 92 |
my $json = decode_json ( $response); |
| 93 |
if ( exists($json->{'id_token'}) ) { |
| 94 |
$request = POST('https://www.googleapis.com/oauth2/v1/tokeninfo', [ |
| 95 |
id_token => $json->{'id_token'} |
| 96 |
]); |
| 97 |
$response = $ua->request($request)->decoded_content; |
| 98 |
$json = decode_json ( $response); |
| 99 |
# Confirm (as google suggests) that the issuer and audience are what we expect them to be |
| 100 |
if (($json->{'issuer'} eq $issuer) && ($json->{'audience'} eq $clientid) && exists($json->{'email'})) { |
| 101 |
my $email = $json->{'email'}; |
| 102 |
if (index($email, $restricttodomain) == -1) { |
| 103 |
loginfailed($query, "You can only login with your <strong>$restricttodomain</strong> email address. Please try again."); |
| 104 |
} else { |
| 105 |
my ( $userid, $cookie, $sessionID ) = checkauth( $query, 1, { borrow => 1 }, 'opac', $email ); |
| 106 |
if ($userid) { # A valid user has logged in |
| 107 |
print $query->redirect( -uri => '/cgi-bin/koha/opac-user.pl', -cookie => $cookie ); |
| 108 |
} else { |
| 109 |
loginfailed($query, 'The email address you are trying to use is not associated with a borrower in this library.'); |
| 110 |
} |
| 111 |
} |
| 112 |
} else { # something went wrong with getting appropriate credentials |
| 113 |
loginfailed($query, 'Failed to get proper credentials from google.'); |
| 114 |
} |
| 115 |
} else { # Failed to get ID Token |
| 116 |
loginfailed($query, 'An authentication error occurred. (Error: No ID Token was supplied)'); |
| 117 |
} |
| 118 |
|
| 119 |
} else { |
| 120 |
my $prompt = ''; |
| 121 |
$prompt = $query->param('reauthenticate') unless not (defined $query->param('reauthenticate')); |
| 122 |
|
| 123 |
my $authorisationurl = 'https://accounts.google.com/o/oauth2/auth?' . |
| 124 |
'response_type=code&' . |
| 125 |
'redirect_uri=' . escape ( $redirecturl ) . '&' . |
| 126 |
'client_id=' . escape ( $clientid ) . '&' . |
| 127 |
'scope=' . escape ( $scope ) . '&'; |
| 128 |
$authorisationurl .= 'prompt=' . escape ( $query->param('reauthenticate') ); |
| 129 |
print $query->redirect($authorisationurl); |
| 130 |
} |
| 131 |
|