|
Lines 64-71
BEGIN {
Link Here
|
| 64 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
64 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
| 65 |
} |
65 |
} |
| 66 |
if ($shib) { |
66 |
if ($shib) { |
| 67 |
import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
67 |
import C4::Auth_with_Shibboleth |
| 68 |
# Getting user login |
68 |
qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
|
|
69 |
|
| 70 |
# Get shibboleth login attribute |
| 69 |
$shib_login = get_login_shib(); |
71 |
$shib_login = get_login_shib(); |
| 70 |
} |
72 |
} |
| 71 |
if ($cas) { |
73 |
if ($cas) { |
|
Lines 296-301
sub get_template_and_user {
Link Here
|
| 296 |
} |
298 |
} |
| 297 |
else { # if this is an anonymous session, setup to display public lists... |
299 |
else { # if this is an anonymous session, setup to display public lists... |
| 298 |
|
300 |
|
|
|
301 |
# If shibboleth is enabled, and we have a shibboleth login attribute, |
| 302 |
# but we are in an anonymouse session, we clearly have an invalid |
| 303 |
# Shibboleth account. |
| 304 |
if ( $shib && $shib_login ) { |
| 305 |
$template->param( invalidShibLogin => '1'); |
| 306 |
} |
| 307 |
|
| 299 |
$template->param( sessionID => $sessionID ); |
308 |
$template->param( sessionID => $sessionID ); |
| 300 |
|
309 |
|
| 301 |
my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); |
310 |
my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); |
|
Lines 739-744
sub checkauth {
Link Here
|
| 739 |
} |
748 |
} |
| 740 |
elsif ($logout) { |
749 |
elsif ($logout) { |
| 741 |
# voluntary logout the user |
750 |
# voluntary logout the user |
|
|
751 |
# check wether the user was using their shibboleth session or a local one |
| 752 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
| 742 |
$session->delete(); |
753 |
$session->delete(); |
| 743 |
$session->flush; |
754 |
$session->flush; |
| 744 |
C4::Context->_unset_userenv($sessionID); |
755 |
C4::Context->_unset_userenv($sessionID); |
|
Lines 750-757
sub checkauth {
Link Here
|
| 750 |
logout_cas($query); |
761 |
logout_cas($query); |
| 751 |
} |
762 |
} |
| 752 |
|
763 |
|
| 753 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) |
764 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
| 754 |
if ( $shib and $shib_login and $type eq 'opac') { |
765 |
if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') { |
| 755 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
766 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
| 756 |
logout_shib($query); |
767 |
logout_shib($query); |
| 757 |
} |
768 |
} |
|
Lines 824-843
sub checkauth {
Link Here
|
| 824 |
} |
835 |
} |
| 825 |
if ( ( $cas && $query->param('ticket') ) |
836 |
if ( ( $cas && $query->param('ticket') ) |
| 826 |
|| $userid |
837 |
|| $userid |
| 827 |
|| $shib |
838 |
|| ( $shib && $shib_login ) |
| 828 |
|| $pki_field ne 'None' |
839 |
|| $pki_field ne 'None' |
| 829 |
|| $persona ) |
840 |
|| $persona ) |
| 830 |
{ |
841 |
{ |
| 831 |
my $password = $query->param('password'); |
842 |
my $password = $query->param('password'); |
|
|
843 |
my $shibSuccess = 0; |
| 832 |
|
844 |
|
| 833 |
my ( $return, $cardnumber ); |
845 |
my ( $return, $cardnumber ); |
| 834 |
if ($shib && $shib_login && $type eq 'opac' && !$password) { |
846 |
# If shib is enabled and we have a shib login, does the login match a valid koha user |
|
|
847 |
if ( $shib && $shib_login && $type eq 'opac' ) { |
| 835 |
my $retuserid; |
848 |
my $retuserid; |
| 836 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); |
849 |
# Do not pass password here, else shib will not be checked in checkpw. |
|
|
850 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query ); |
| 837 |
$userid = $retuserid; |
851 |
$userid = $retuserid; |
|
|
852 |
$shibSuccess = $return; |
| 838 |
$info{'invalidShibLogin'} = 1 unless ($return); |
853 |
$info{'invalidShibLogin'} = 1 unless ($return); |
| 839 |
|
854 |
} |
| 840 |
} elsif ( $cas && $query->param('ticket') ) { |
855 |
# If shib login and match were successfull, skip further login methods |
|
|
856 |
unless ( $shibSuccess ) { |
| 857 |
if ( $cas && $query->param('ticket') ) { |
| 841 |
my $retuserid; |
858 |
my $retuserid; |
| 842 |
( $return, $cardnumber, $retuserid ) = |
859 |
( $return, $cardnumber, $retuserid ) = |
| 843 |
checkpw( $dbh, $userid, $password, $query ); |
860 |
checkpw( $dbh, $userid, $password, $query ); |
|
Lines 904-910
sub checkauth {
Link Here
|
| 904 |
( $return, $cardnumber, $retuserid ) = |
921 |
( $return, $cardnumber, $retuserid ) = |
| 905 |
checkpw( $dbh, $userid, $password, $query ); |
922 |
checkpw( $dbh, $userid, $password, $query ); |
| 906 |
$userid = $retuserid if ( $retuserid ); |
923 |
$userid = $retuserid if ( $retuserid ); |
| 907 |
} |
924 |
$info{'invalid_username_or_password'} = 1 unless ($return); |
|
|
925 |
} } |
| 908 |
if ($return) { |
926 |
if ($return) { |
| 909 |
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
927 |
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
| 910 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
928 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
|
Lines 992-997
sub checkauth {
Link Here
|
| 992 |
$session->param('emailaddress',$emailaddress); |
1010 |
$session->param('emailaddress',$emailaddress); |
| 993 |
$session->param('ip',$session->remote_addr()); |
1011 |
$session->param('ip',$session->remote_addr()); |
| 994 |
$session->param('lasttime',time()); |
1012 |
$session->param('lasttime',time()); |
|
|
1013 |
$session->param('shibboleth',$shibSuccess); |
| 995 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
1014 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
| 996 |
} |
1015 |
} |
| 997 |
elsif ( $return == 2 ) { |
1016 |
elsif ( $return == 2 ) { |
|
Lines 1018-1024
sub checkauth {
Link Here
|
| 1018 |
$session->param('surname'), $session->param('branch'), |
1037 |
$session->param('surname'), $session->param('branch'), |
| 1019 |
$session->param('branchname'), $session->param('flags'), |
1038 |
$session->param('branchname'), $session->param('flags'), |
| 1020 |
$session->param('emailaddress'), $session->param('branchprinter'), |
1039 |
$session->param('emailaddress'), $session->param('branchprinter'), |
| 1021 |
$session->param('persona') |
1040 |
$session->param('persona'), $session->param('shibboleth') |
| 1022 |
); |
1041 |
); |
| 1023 |
|
1042 |
|
| 1024 |
} |
1043 |
} |
|
Lines 1577-1583
sub get_session {
Link Here
|
| 1577 |
|
1596 |
|
| 1578 |
sub checkpw { |
1597 |
sub checkpw { |
| 1579 |
my ( $dbh, $userid, $password, $query ) = @_; |
1598 |
my ( $dbh, $userid, $password, $query ) = @_; |
| 1580 |
|
|
|
| 1581 |
if ($ldap) { |
1599 |
if ($ldap) { |
| 1582 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1600 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
| 1583 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
1601 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
|
Lines 1594-1605
sub checkpw {
Link Here
|
| 1594 |
return 0; |
1612 |
return 0; |
| 1595 |
} |
1613 |
} |
| 1596 |
|
1614 |
|
| 1597 |
# If we are in a shibboleth session (shibboleth is enabled and no password has been provided) |
1615 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present) |
| 1598 |
if ($shib && !$password) { |
1616 |
# Check for password to asertain whether we want to be testing against shibboleth or another method this |
|
|
1617 |
# time around. |
| 1618 |
if ($shib && $shib_login && !$password) { |
| 1599 |
|
1619 |
|
| 1600 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1620 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
| 1601 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1621 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
| 1602 |
# (defined in the shibbolethLoginAttribute) tto contain the login of the |
1622 |
# (defined under shibboleth mapping in koha-conf.xml) to contain the login of the |
| 1603 |
# shibboleth-authenticated user |
1623 |
# shibboleth-authenticated user |
| 1604 |
|
1624 |
|
| 1605 |
# Then, we check if it matches a valid koha user |
1625 |
# Then, we check if it matches a valid koha user |