View | Details | Raw Unified | Return to bug 8446
Collapse All | Expand All

(-)a/C4/Auth.pm (-15 / +35 lines)
Lines 64-71 BEGIN { Link Here
64
    import C4::Auth_with_ldap qw(checkpw_ldap);
64
    import C4::Auth_with_ldap qw(checkpw_ldap);
65
    }
65
    }
66
    if ($shib) {
66
    if ($shib) {
67
        import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib);
67
        import C4::Auth_with_Shibboleth
68
        # Getting user login
68
          qw(checkpw_shib logout_shib login_shib_url get_login_shib);
69
70
        # Get shibboleth login attribute
69
        $shib_login = get_login_shib();
71
        $shib_login = get_login_shib();
70
    }
72
    }
71
    if ($cas) {
73
    if ($cas) {
Lines 296-301 sub get_template_and_user { Link Here
296
    }
298
    }
297
    else {    # if this is an anonymous session, setup to display public lists...
299
    else {    # if this is an anonymous session, setup to display public lists...
298
300
301
	# If shibboleth is enabled, and we have a shibboleth login attribute,
302
	# but we are in an anonymouse session, we clearly have an invalid
303
	# Shibboleth account.
304
	if ( $shib && $shib_login ) {
305
	    $template->param( invalidShibLogin => '1');
306
        }
307
299
        $template->param( sessionID        => $sessionID );
308
        $template->param( sessionID        => $sessionID );
300
        
309
        
301
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
310
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
Lines 739-744 sub checkauth { Link Here
739
        }
748
        }
740
        elsif ($logout) {
749
        elsif ($logout) {
741
            # voluntary logout the user
750
            # voluntary logout the user
751
	    # check wether the user was using their shibboleth session or a local one
752
            my $shibSuccess = C4::Context->userenv->{'shibboleth'};
742
            $session->delete();
753
            $session->delete();
743
            $session->flush;
754
            $session->flush;
744
            C4::Context->_unset_userenv($sessionID);
755
            C4::Context->_unset_userenv($sessionID);
Lines 750-757 sub checkauth { Link Here
750
                logout_cas($query);
761
                logout_cas($query);
751
            }
762
            }
752
763
753
            # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set)
764
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
754
            if ( $shib and $shib_login and $type eq 'opac') {
765
            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
755
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
766
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
756
                logout_shib($query);
767
                logout_shib($query);
757
            }
768
            }
Lines 824-843 sub checkauth { Link Here
824
        }
835
        }
825
        if (   ( $cas && $query->param('ticket') )
836
        if (   ( $cas && $query->param('ticket') )
826
            || $userid
837
            || $userid
827
            || $shib
838
            || ( $shib && $shib_login )
828
            || $pki_field ne 'None'
839
            || $pki_field ne 'None'
829
            || $persona )
840
            || $persona )
830
        {
841
        {
831
            my $password = $query->param('password');
842
            my $password = $query->param('password');
843
	    my $shibSuccess = 0;
832
844
833
            my ( $return, $cardnumber );
845
            my ( $return, $cardnumber );
834
            if ($shib && $shib_login && $type eq 'opac' && !$password) {
846
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
847
            if ( $shib && $shib_login && $type eq 'opac' ) {
835
                my $retuserid;
848
                my $retuserid;
836
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
849
		# Do not pass password here, else shib will not be checked in checkpw.
850
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
837
                $userid = $retuserid;
851
                $userid = $retuserid;
852
		$shibSuccess = $return;
838
                $info{'invalidShibLogin'} = 1 unless ($return);
853
                $info{'invalidShibLogin'} = 1 unless ($return);
839
854
            }
840
            } elsif ( $cas && $query->param('ticket') ) {
855
	    # If shib login and match were successfull, skip further login methods
856
	    unless ( $shibSuccess ) {
857
	    if ( $cas && $query->param('ticket') ) {
841
                my $retuserid;
858
                my $retuserid;
842
                ( $return, $cardnumber, $retuserid ) =
859
                ( $return, $cardnumber, $retuserid ) =
843
                  checkpw( $dbh, $userid, $password, $query );
860
                  checkpw( $dbh, $userid, $password, $query );
Lines 904-910 sub checkauth { Link Here
904
                ( $return, $cardnumber, $retuserid ) =
921
                ( $return, $cardnumber, $retuserid ) =
905
                  checkpw( $dbh, $userid, $password, $query );
922
                  checkpw( $dbh, $userid, $password, $query );
906
                $userid = $retuserid if ( $retuserid );
923
                $userid = $retuserid if ( $retuserid );
907
        }
924
		$info{'invalid_username_or_password'} = 1 unless ($return);
925
        } }
908
        if ($return) {
926
        if ($return) {
909
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
927
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
910
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
928
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
Lines 992-997 sub checkauth { Link Here
992
                    $session->param('emailaddress',$emailaddress);
1010
                    $session->param('emailaddress',$emailaddress);
993
                    $session->param('ip',$session->remote_addr());
1011
                    $session->param('ip',$session->remote_addr());
994
                    $session->param('lasttime',time());
1012
                    $session->param('lasttime',time());
1013
		    $session->param('shibboleth',$shibSuccess);
995
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
1014
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
996
                }
1015
                }
997
                elsif ( $return == 2 ) {
1016
                elsif ( $return == 2 ) {
Lines 1018-1024 sub checkauth { Link Here
1018
                    $session->param('surname'),      $session->param('branch'),
1037
                    $session->param('surname'),      $session->param('branch'),
1019
                    $session->param('branchname'),   $session->param('flags'),
1038
                    $session->param('branchname'),   $session->param('flags'),
1020
                    $session->param('emailaddress'), $session->param('branchprinter'),
1039
                    $session->param('emailaddress'), $session->param('branchprinter'),
1021
                    $session->param('persona')
1040
                    $session->param('persona'),      $session->param('shibboleth')
1022
                );
1041
                );
1023
1042
1024
            }
1043
            }
Lines 1577-1583 sub get_session { Link Here
1577
1596
1578
sub checkpw {
1597
sub checkpw {
1579
    my ( $dbh, $userid, $password, $query ) = @_;
1598
    my ( $dbh, $userid, $password, $query ) = @_;
1580
1581
    if ($ldap) {
1599
    if ($ldap) {
1582
        $debug and print STDERR "## checkpw - checking LDAP\n";
1600
        $debug and print STDERR "## checkpw - checking LDAP\n";
1583
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
1601
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
Lines 1594-1605 sub checkpw { Link Here
1594
        return 0;
1612
        return 0;
1595
    }
1613
    }
1596
1614
1597
    # If we are in a shibboleth session (shibboleth is enabled and no password has been provided)
1615
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1598
    if ($shib && !$password) {
1616
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1617
    # time around.
1618
    if ($shib && $shib_login && !$password) {
1599
1619
1600
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1620
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1601
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1621
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1602
        # (defined in the shibbolethLoginAttribute) tto contain the login of the
1622
        # (defined under shibboleth mapping in koha-conf.xml) to contain the login of the
1603
        # shibboleth-authenticated user
1623
        # shibboleth-authenticated user
1604
1624
1605
        # Then, we check if it matches a valid koha user
1625
        # Then, we check if it matches a valid koha user
(-)a/C4/Auth_with_Shibboleth.pm (+83 lines)
Lines 105-107 sub checkpw_shib { Link Here
105
}
105
}
106
106
107
1;
107
1;
108
__END__
109
110
=head1 NAME
111
112
C4::Auth_with_shibboleth
113
114
=head1 SYNOPSIS
115
116
use C4::Auth_with_shibboleth
117
118
=head1 DESCRIPTION
119
120
This module is specific to Shibboleth authentication in koha and relies heavily upon the native shibboleth service provider package in your operating system.
121
122
=head1 CONFIGURATION
123
124
To use this type of authentication these additional packages are required:
125
126
=over
127
128
=item *
129
130
libapache2-mod-shib2
131
132
=item *
133
134
libshibsp5:amd64
135
136
=item *
137
138
shibboleth-sp2-schemas
139
140
=back
141
142
We let the native shibboleth service provider packages handle all the complexities of shibboleth negotiation for use and configuring this is beyond the scope of this documentation; But to sum up, you will need to:
143
144
=over
145
146
=item 1.
147
148
Create some metadata for your koha instance (if you're in a single instance setup then the default metadata available at https://youraddress.com/Shibboleth.sso/Metadata should be adequate)
149
150
=item 2.
151
152
Swap metadata with your Identidy Provider (IdP)
153
154
=item 3.
155
156
Map their attributes to what you want to see in koha
157
158
=item 4.
159
160
Tell apache that we wish to allow koha to authenticate via shibboleth; This is as simple as adding the below to your virtualhost config:
161
162
=begin text
163
164
<Location />
165
  AuthType shibboleth
166
  Require shibboleth
167
</Location>
168
169
=end text
170
171
=item 5.
172
173
Configure koha to listen for shibboleth environment variables; To do this we add <useshibboleth>1</useshibboleth> for the koha-conf.xml file
174
175
=item 6.
176
177
Map shibboleth attributes to koha fields in koha-conf.xml.
178
179
<shibboleth>
180
  <mapping>
181
    <userid match="1" default="">eduPersonID</userid>
182
    <categorycode default=""></categorycode>
183
  </mapping>
184
</shibboleth>
185
186
=back
187
188
=head1 FUNCTIONS
189
190
=cut
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (+12 lines)
Lines 281-286 Link Here
281
        </div>
281
        </div>
282
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
282
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
283
            <div class="modal-body">
283
            <div class="modal-body">
284
                    [% IF ( shibbolethAuthentication ) %]
285
                    [% IF ( invalidShibLogin ) %]
286
                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
287
                    <div class="alert alert-info">
288
                        <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
289
                    </div>
290
                    [% ELSE %]
291
                    <h4>Shibboleth Login</h4>
292
                    <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
293
                    <h4>Local Login</h4>
294
                    [% END %]
295
		    [% END %]
284
                    <input type="hidden" name="koha_login_context" value="opac" />
296
                    <input type="hidden" name="koha_login_context" value="opac" />
285
                    <fieldset class="brief">
297
                    <fieldset class="brief">
286
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
298
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-6 / +8 lines)
Lines 58-75 Link Here
58
                            [% END %]
58
                            [% END %]
59
59
60
                            [% IF ( shibbolethAuthentication ) %]
60
                            [% IF ( shibbolethAuthentication ) %]
61
                                <h4>Shibboleth Login</h4>
62
61
63
                                [% IF ( invalidShibLogin ) %]
62
                                [% IF ( invalidShibLogin ) %]
64
                                <!-- This is what is displated if shibboleth login has failed -->
63
                                <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
65
                                <p>Sorry, the Shibboleth login failed.</p>
64
                                <div class="alert alert-info">
66
                                [% END %]
65
                                    <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
66
                                </div>
67
                                [% ELSE %]
68
                                <h4>Shibboleth Login</h4>
67
69
68
                                <p>If you have a Shibboleth account,
70
                                <p>If you have a Shibboleth account,
69
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
71
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
70
72
                                [% END %]
71
                                <h4>Local Login</h4>
73
                                <h4>Local Login</h4>
72
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in : </p>
74
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in: </p>
73
75
74
                            [% END %]
76
                            [% END %]
75
77
(-)a/opac/opac-main.pl (-2 / +7 lines)
Lines 21-26 Link Here
21
use Modern::Perl;
21
use Modern::Perl;
22
use CGI;
22
use CGI;
23
use C4::Auth;    # get_template_and_user
23
use C4::Auth;    # get_template_and_user
24
use C4::Auth_with_Shibboleth qw( login_shib_url );
24
use C4::Output;
25
use C4::Output;
25
use C4::NewsChannels;    # GetNewsToDisplay
26
use C4::NewsChannels;    # GetNewsToDisplay
26
use C4::Languages qw(getTranslatedLanguages accept_language);
27
use C4::Languages qw(getTranslatedLanguages accept_language);
Lines 44-50 $template->param( Link Here
44
    casAuthentication   => $casAuthentication,
45
    casAuthentication   => $casAuthentication,
45
);
46
);
46
47
47
$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') );
48
if ( C4::Context->config('useshibboleth') ) {
49
    $template->param(
50
        shibbolethAuthentication => C4::Context->config('useshibboleth'),
51
        shibbolethLoginUrl => C4::Auth_with_Shibboleth::login_shib_url($input)
52
    );
53
};
48
54
49
# display news
55
# display news
50
# use cookie setting for language, bug default to syspref if it's not set
56
# use cookie setting for language, bug default to syspref if it's not set
51
- 

Return to bug 8446