| Lines 64-71
          BEGIN {
      
      
        Link Here | 
        
          | 64 |     import C4::Auth_with_ldap qw(checkpw_ldap); | 64 |     import C4::Auth_with_ldap qw(checkpw_ldap); | 
        
          | 65 |     } | 65 |     } | 
        
          | 66 |     if ($shib) { | 66 |     if ($shib) { | 
          
            
              | 67 |         import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); | 67 |         import C4::Auth_with_Shibboleth | 
            
              | 68 |         # Getting user login | 68 |           qw(checkpw_shib logout_shib login_shib_url get_login_shib); | 
            
              |  |  | 69 |  | 
            
              | 70 |         # Get shibboleth login attribute | 
        
          | 69 |         $shib_login = get_login_shib(); | 71 |         $shib_login = get_login_shib(); | 
        
          | 70 |     } | 72 |     } | 
        
          | 71 |     if ($cas) { | 73 |     if ($cas) { | 
  
    | Lines 296-301
          sub get_template_and_user {
      
      
        Link Here | 
        
          | 296 |     } | 298 |     } | 
        
          | 297 |     else {    # if this is an anonymous session, setup to display public lists... | 299 |     else {    # if this is an anonymous session, setup to display public lists... | 
        
          | 298 |  | 300 |  | 
            
              |  |  | 301 | 	# If shibboleth is enabled, and we have a shibboleth login attribute, | 
            
              | 302 | 	# but we are in an anonymouse session, we clearly have an invalid | 
            
              | 303 | 	# Shibboleth account. | 
            
              | 304 | 	if ( $shib && $shib_login ) { | 
            
              | 305 | 	    $template->param( invalidShibLogin => '1'); | 
            
              | 306 |         } | 
            
              | 307 |  | 
        
          | 299 |         $template->param( sessionID        => $sessionID ); | 308 |         $template->param( sessionID        => $sessionID ); | 
        
          | 300 |          | 309 |          | 
        
          | 301 |         my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); | 310 |         my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); | 
  
    | Lines 739-744
          sub checkauth {
      
      
        Link Here | 
        
          | 739 |         } | 748 |         } | 
        
          | 740 |         elsif ($logout) { | 749 |         elsif ($logout) { | 
        
          | 741 |             # voluntary logout the user | 750 |             # voluntary logout the user | 
            
              |  |  | 751 | 	    # check wether the user was using their shibboleth session or a local one | 
            
              | 752 |             my $shibSuccess = C4::Context->userenv->{'shibboleth'}; | 
        
          | 742 |             $session->delete(); | 753 |             $session->delete(); | 
        
          | 743 |             $session->flush; | 754 |             $session->flush; | 
        
          | 744 |             C4::Context->_unset_userenv($sessionID); | 755 |             C4::Context->_unset_userenv($sessionID); | 
  
    | Lines 750-757
          sub checkauth {
      
      
        Link Here | 
        
          | 750 |                 logout_cas($query); | 761 |                 logout_cas($query); | 
        
          | 751 |             } | 762 |             } | 
        
          | 752 |  | 763 |  | 
          
            
              | 753 |             # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) | 764 |             # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) | 
            
              | 754 |             if ( $shib and $shib_login and $type eq 'opac') { | 765 |             if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') { | 
        
          | 755 |             # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) | 766 |             # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) | 
        
          | 756 |                 logout_shib($query); | 767 |                 logout_shib($query); | 
        
          | 757 |             } | 768 |             } | 
  
    | Lines 824-843
          sub checkauth {
      
      
        Link Here | 
        
          | 824 |         } | 835 |         } | 
        
          | 825 |         if (   ( $cas && $query->param('ticket') ) | 836 |         if (   ( $cas && $query->param('ticket') ) | 
        
          | 826 |             || $userid | 837 |             || $userid | 
          
            
              | 827 |             || $shib | 838 |             || ( $shib && $shib_login ) | 
        
          | 828 |             || $pki_field ne 'None' | 839 |             || $pki_field ne 'None' | 
        
          | 829 |             || $persona ) | 840 |             || $persona ) | 
        
          | 830 |         { | 841 |         { | 
        
          | 831 |             my $password = $query->param('password'); | 842 |             my $password = $query->param('password'); | 
            
              |  |  | 843 | 	    my $shibSuccess = 0; | 
        
          | 832 |  | 844 |  | 
        
          | 833 |             my ( $return, $cardnumber ); | 845 |             my ( $return, $cardnumber ); | 
          
            
              | 834 |             if ($shib && $shib_login && $type eq 'opac' && !$password) { | 846 | 	    # If shib is enabled and we have a shib login, does the login match a valid koha user | 
            
              |  |  | 847 |             if ( $shib && $shib_login && $type eq 'opac' ) { | 
        
          | 835 |                 my $retuserid; | 848 |                 my $retuserid; | 
          
            
              | 836 |                 ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); | 849 | 		# Do not pass password here, else shib will not be checked in checkpw. | 
            
              |  |  | 850 |                 ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query ); | 
        
          | 837 |                 $userid = $retuserid; | 851 |                 $userid = $retuserid; | 
            
              |  |  | 852 | 		$shibSuccess = $return; | 
        
          | 838 |                 $info{'invalidShibLogin'} = 1 unless ($return); | 853 |                 $info{'invalidShibLogin'} = 1 unless ($return); | 
          
            
              | 839 |  | 854 |             } | 
            
              | 840 |             } elsif ( $cas && $query->param('ticket') ) { | 855 | 	    # If shib login and match were successfull, skip further login methods | 
            
              |  |  | 856 | 	    unless ( $shibSuccess ) { | 
            
              | 857 | 	    if ( $cas && $query->param('ticket') ) { | 
        
          | 841 |                 my $retuserid; | 858 |                 my $retuserid; | 
        
          | 842 |                 ( $return, $cardnumber, $retuserid ) = | 859 |                 ( $return, $cardnumber, $retuserid ) = | 
        
          | 843 |                   checkpw( $dbh, $userid, $password, $query ); | 860 |                   checkpw( $dbh, $userid, $password, $query ); | 
  
    | Lines 904-910
          sub checkauth {
      
      
        Link Here | 
        
          | 904 |                 ( $return, $cardnumber, $retuserid ) = | 921 |                 ( $return, $cardnumber, $retuserid ) = | 
        
          | 905 |                   checkpw( $dbh, $userid, $password, $query ); | 922 |                   checkpw( $dbh, $userid, $password, $query ); | 
        
          | 906 |                 $userid = $retuserid if ( $retuserid ); | 923 |                 $userid = $retuserid if ( $retuserid ); | 
          
            
              | 907 |         } | 924 | 		$info{'invalid_username_or_password'} = 1 unless ($return); | 
            
              |  |  | 925 |         } } | 
        
          | 908 |         if ($return) { | 926 |         if ($return) { | 
        
          | 909 |                #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); | 927 |                #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); | 
        
          | 910 |                 if ( $flags = haspermission(  $userid, $flagsrequired ) ) { | 928 |                 if ( $flags = haspermission(  $userid, $flagsrequired ) ) { | 
  
    | Lines 992-997
          sub checkauth {
      
      
        Link Here | 
        
          | 992 |                     $session->param('emailaddress',$emailaddress); | 1010 |                     $session->param('emailaddress',$emailaddress); | 
        
          | 993 |                     $session->param('ip',$session->remote_addr()); | 1011 |                     $session->param('ip',$session->remote_addr()); | 
        
          | 994 |                     $session->param('lasttime',time()); | 1012 |                     $session->param('lasttime',time()); | 
            
              |  |  | 1013 | 		    $session->param('shibboleth',$shibSuccess); | 
        
          | 995 |                     $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; | 1014 |                     $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; | 
        
          | 996 |                 } | 1015 |                 } | 
        
          | 997 |                 elsif ( $return == 2 ) { | 1016 |                 elsif ( $return == 2 ) { | 
  
    | Lines 1018-1024
          sub checkauth {
      
      
        Link Here | 
        
          | 1018 |                     $session->param('surname'),      $session->param('branch'), | 1037 |                     $session->param('surname'),      $session->param('branch'), | 
        
          | 1019 |                     $session->param('branchname'),   $session->param('flags'), | 1038 |                     $session->param('branchname'),   $session->param('flags'), | 
        
          | 1020 |                     $session->param('emailaddress'), $session->param('branchprinter'), | 1039 |                     $session->param('emailaddress'), $session->param('branchprinter'), | 
          
            
              | 1021 |                     $session->param('persona') | 1040 |                     $session->param('persona'),      $session->param('shibboleth') | 
        
          | 1022 |                 ); | 1041 |                 ); | 
        
          | 1023 |  | 1042 |  | 
        
          | 1024 |             } | 1043 |             } | 
  
    | Lines 1577-1583
          sub get_session {
      
      
        Link Here | 
        
          | 1577 |  | 1596 |  | 
        
          | 1578 | sub checkpw { | 1597 | sub checkpw { | 
        
          | 1579 |     my ( $dbh, $userid, $password, $query ) = @_; | 1598 |     my ( $dbh, $userid, $password, $query ) = @_; | 
            
              | 1580 |  |  |  | 
        
          | 1581 |     if ($ldap) { | 1599 |     if ($ldap) { | 
        
          | 1582 |         $debug and print STDERR "## checkpw - checking LDAP\n"; | 1600 |         $debug and print STDERR "## checkpw - checking LDAP\n"; | 
        
          | 1583 |         my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH | 1601 |         my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH | 
  
    | Lines 1594-1605
          sub checkpw {
      
      
        Link Here | 
        
          | 1594 |         return 0; | 1612 |         return 0; | 
        
          | 1595 |     } | 1613 |     } | 
        
          | 1596 |  | 1614 |  | 
          
            
              | 1597 |     # If we are in a shibboleth session (shibboleth is enabled and no password has been provided) | 1615 |     # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present) | 
            
              | 1598 |     if ($shib && !$password) { | 1616 |     # Check for password to asertain whether we want to be testing against shibboleth or another method this | 
            
              |  |  | 1617 |     # time around. | 
            
              | 1618 |     if ($shib && $shib_login && !$password) { | 
        
          | 1599 |  | 1619 |  | 
        
          | 1600 |         $debug and print STDERR "## checkpw - checking Shibboleth\n"; | 1620 |         $debug and print STDERR "## checkpw - checking Shibboleth\n"; | 
        
          | 1601 |         # In case of a Shibboleth authentication, we expect a shibboleth user attribute | 1621 |         # In case of a Shibboleth authentication, we expect a shibboleth user attribute | 
          
            
              | 1602 |         # (defined in the shibbolethLoginAttribute) tto contain the login of the | 1622 |         # (defined under shibboleth mapping in koha-conf.xml) to contain the login of the | 
        
          | 1603 |         # shibboleth-authenticated user | 1623 |         # shibboleth-authenticated user | 
        
          | 1604 |  | 1624 |  | 
        
          | 1605 |         # Then, we check if it matches a valid koha user | 1625 |         # Then, we check if it matches a valid koha user |