Lines 58-71
BEGIN {
Link Here
|
58 |
$shib = C4::Context->config('useshibboleth') || 0; |
58 |
$shib = C4::Context->config('useshibboleth') || 0; |
59 |
$caslogout = C4::Context->preference('casLogout'); |
59 |
$caslogout = C4::Context->preference('casLogout'); |
60 |
require C4::Auth_with_cas; # no import |
60 |
require C4::Auth_with_cas; # no import |
61 |
require C4::Auth_with_Shibboleth; |
61 |
require C4::Auth_with_shibboleth; |
62 |
if ($ldap) { |
62 |
if ($ldap) { |
63 |
require C4::Auth_with_ldap; |
63 |
require C4::Auth_with_ldap; |
64 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
64 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
65 |
} |
65 |
} |
66 |
if ($shib) { |
66 |
if ($shib) { |
67 |
import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
67 |
import C4::Auth_with_shibboleth |
68 |
# Getting user login |
68 |
qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
|
|
69 |
|
70 |
# Get shibboleth login attribute |
69 |
$shib_login = get_login_shib(); |
71 |
$shib_login = get_login_shib(); |
70 |
} |
72 |
} |
71 |
if ($cas) { |
73 |
if ($cas) { |
Lines 296-301
sub get_template_and_user {
Link Here
|
296 |
} |
298 |
} |
297 |
else { # if this is an anonymous session, setup to display public lists... |
299 |
else { # if this is an anonymous session, setup to display public lists... |
298 |
|
300 |
|
|
|
301 |
# If shibboleth is enabled, and we're in an anonymous session, we should allow |
302 |
# the user to attemp login via shibboleth. |
303 |
if ( $shib ) { |
304 |
$template->param( shibbolethAuthentication => $shib, |
305 |
shibbolethLoginUrl => login_shib_url($in->{'query'}), |
306 |
); |
307 |
# If shibboleth is enabled and we have a shibboleth login attribute, |
308 |
# but we are in an anonymous session, then we clearly have an invalid |
309 |
# shibboleth koha account. |
310 |
if ( $shib_login ) { |
311 |
$template->param( invalidShibLogin => '1'); |
312 |
} |
313 |
} |
314 |
|
299 |
$template->param( sessionID => $sessionID ); |
315 |
$template->param( sessionID => $sessionID ); |
300 |
|
316 |
|
301 |
my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); |
317 |
my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); |
Lines 714-720
sub checkauth {
Link Here
|
714 |
$session->param('surname'), $session->param('branch'), |
730 |
$session->param('surname'), $session->param('branch'), |
715 |
$session->param('branchname'), $session->param('flags'), |
731 |
$session->param('branchname'), $session->param('flags'), |
716 |
$session->param('emailaddress'), $session->param('branchprinter'), |
732 |
$session->param('emailaddress'), $session->param('branchprinter'), |
717 |
$session->param('persona') |
733 |
$session->param('persona'), $session->param('shibboleth') |
718 |
); |
734 |
); |
719 |
C4::Context::set_shelves_userenv('bar',$session->param('barshelves')); |
735 |
C4::Context::set_shelves_userenv('bar',$session->param('barshelves')); |
720 |
C4::Context::set_shelves_userenv('pub',$session->param('pubshelves')); |
736 |
C4::Context::set_shelves_userenv('pub',$session->param('pubshelves')); |
Lines 726-732
sub checkauth {
Link Here
|
726 |
$sessiontype = $session->param('sessiontype') || ''; |
742 |
$sessiontype = $session->param('sessiontype') || ''; |
727 |
} |
743 |
} |
728 |
if ( ( $query->param('koha_login_context') && ($q_userid ne $s_userid) ) |
744 |
if ( ( $query->param('koha_login_context') && ($q_userid ne $s_userid) ) |
729 |
|| ( $cas && $query->param('ticket') ) ) { |
745 |
|| ( $cas && $query->param('ticket') ) || ( $shib && $shib_login && !$logout ) ) { |
730 |
#if a user enters an id ne to the id in the current session, we need to log them in... |
746 |
#if a user enters an id ne to the id in the current session, we need to log them in... |
731 |
#first we need to clear the anonymous session... |
747 |
#first we need to clear the anonymous session... |
732 |
$debug and warn "query id = $q_userid but session id = $s_userid"; |
748 |
$debug and warn "query id = $q_userid but session id = $s_userid"; |
Lines 739-744
sub checkauth {
Link Here
|
739 |
} |
755 |
} |
740 |
elsif ($logout) { |
756 |
elsif ($logout) { |
741 |
# voluntary logout the user |
757 |
# voluntary logout the user |
|
|
758 |
# check wether the user was using their shibboleth session or a local one |
759 |
my $shibSuccess = C4::Context->userenv->{'shibboleth'}; |
742 |
$session->delete(); |
760 |
$session->delete(); |
743 |
$session->flush; |
761 |
$session->flush; |
744 |
C4::Context->_unset_userenv($sessionID); |
762 |
C4::Context->_unset_userenv($sessionID); |
Lines 750-757
sub checkauth {
Link Here
|
750 |
logout_cas($query); |
768 |
logout_cas($query); |
751 |
} |
769 |
} |
752 |
|
770 |
|
753 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) |
771 |
# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) |
754 |
if ( $shib and $shib_login and $type eq 'opac') { |
772 |
if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') { |
755 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
773 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
756 |
logout_shib($query); |
774 |
logout_shib($query); |
757 |
} |
775 |
} |
Lines 824-843
sub checkauth {
Link Here
|
824 |
} |
842 |
} |
825 |
if ( ( $cas && $query->param('ticket') ) |
843 |
if ( ( $cas && $query->param('ticket') ) |
826 |
|| $userid |
844 |
|| $userid |
827 |
|| $shib |
845 |
|| ( $shib && $shib_login ) |
828 |
|| $pki_field ne 'None' |
846 |
|| $pki_field ne 'None' |
829 |
|| $persona ) |
847 |
|| $persona ) |
830 |
{ |
848 |
{ |
831 |
my $password = $query->param('password'); |
849 |
my $password = $query->param('password'); |
|
|
850 |
my $shibSuccess = 0; |
832 |
|
851 |
|
833 |
my ( $return, $cardnumber ); |
852 |
my ( $return, $cardnumber ); |
834 |
if ($shib && $shib_login && $type eq 'opac' && !$password) { |
853 |
# If shib is enabled and we have a shib login, does the login match a valid koha user |
|
|
854 |
if ( $shib && $shib_login && $type eq 'opac' ) { |
835 |
my $retuserid; |
855 |
my $retuserid; |
836 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); |
856 |
# Do not pass password here, else shib will not be checked in checkpw. |
|
|
857 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query ); |
837 |
$userid = $retuserid; |
858 |
$userid = $retuserid; |
|
|
859 |
$shibSuccess = $return; |
838 |
$info{'invalidShibLogin'} = 1 unless ($return); |
860 |
$info{'invalidShibLogin'} = 1 unless ($return); |
839 |
|
861 |
} |
840 |
} elsif ( $cas && $query->param('ticket') ) { |
862 |
# If shib login and match were successfull, skip further login methods |
|
|
863 |
unless ( $shibSuccess ) { |
864 |
if ( $cas && $query->param('ticket') ) { |
841 |
my $retuserid; |
865 |
my $retuserid; |
842 |
( $return, $cardnumber, $retuserid ) = |
866 |
( $return, $cardnumber, $retuserid ) = |
843 |
checkpw( $dbh, $userid, $password, $query ); |
867 |
checkpw( $dbh, $userid, $password, $query ); |
Lines 904-910
sub checkauth {
Link Here
|
904 |
( $return, $cardnumber, $retuserid ) = |
928 |
( $return, $cardnumber, $retuserid ) = |
905 |
checkpw( $dbh, $userid, $password, $query ); |
929 |
checkpw( $dbh, $userid, $password, $query ); |
906 |
$userid = $retuserid if ( $retuserid ); |
930 |
$userid = $retuserid if ( $retuserid ); |
907 |
} |
931 |
$info{'invalid_username_or_password'} = 1 unless ($return); |
|
|
932 |
} } |
908 |
if ($return) { |
933 |
if ($return) { |
909 |
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
934 |
#_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); |
910 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
935 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
Lines 992-997
sub checkauth {
Link Here
|
992 |
$session->param('emailaddress',$emailaddress); |
1017 |
$session->param('emailaddress',$emailaddress); |
993 |
$session->param('ip',$session->remote_addr()); |
1018 |
$session->param('ip',$session->remote_addr()); |
994 |
$session->param('lasttime',time()); |
1019 |
$session->param('lasttime',time()); |
|
|
1020 |
$session->param('shibboleth',$shibSuccess); |
995 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
1021 |
$debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; |
996 |
} |
1022 |
} |
997 |
elsif ( $return == 2 ) { |
1023 |
elsif ( $return == 2 ) { |
Lines 1018-1024
sub checkauth {
Link Here
|
1018 |
$session->param('surname'), $session->param('branch'), |
1044 |
$session->param('surname'), $session->param('branch'), |
1019 |
$session->param('branchname'), $session->param('flags'), |
1045 |
$session->param('branchname'), $session->param('flags'), |
1020 |
$session->param('emailaddress'), $session->param('branchprinter'), |
1046 |
$session->param('emailaddress'), $session->param('branchprinter'), |
1021 |
$session->param('persona') |
1047 |
$session->param('persona'), $session->param('shibboleth') |
1022 |
); |
1048 |
); |
1023 |
|
1049 |
|
1024 |
} |
1050 |
} |
Lines 1157-1162
sub checkauth {
Link Here
|
1157 |
|
1183 |
|
1158 |
if ($shib) { |
1184 |
if ($shib) { |
1159 |
$template->param( |
1185 |
$template->param( |
|
|
1186 |
shibbolethAuthentication => $shib, |
1160 |
shibbolethLoginUrl => login_shib_url($query), |
1187 |
shibbolethLoginUrl => login_shib_url($query), |
1161 |
); |
1188 |
); |
1162 |
} |
1189 |
} |
Lines 1577-1583
sub get_session {
Link Here
|
1577 |
|
1604 |
|
1578 |
sub checkpw { |
1605 |
sub checkpw { |
1579 |
my ( $dbh, $userid, $password, $query ) = @_; |
1606 |
my ( $dbh, $userid, $password, $query ) = @_; |
1580 |
|
|
|
1581 |
if ($ldap) { |
1607 |
if ($ldap) { |
1582 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1608 |
$debug and print STDERR "## checkpw - checking LDAP\n"; |
1583 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
1609 |
my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH |
Lines 1594-1610
sub checkpw {
Link Here
|
1594 |
return 0; |
1620 |
return 0; |
1595 |
} |
1621 |
} |
1596 |
|
1622 |
|
1597 |
# If we are in a shibboleth session (shibboleth is enabled and no password has been provided) |
1623 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present) |
1598 |
if ($shib && !$password) { |
1624 |
# Check for password to asertain whether we want to be testing against shibboleth or another method this |
|
|
1625 |
# time around. |
1626 |
if ($shib && $shib_login && !$password) { |
1599 |
|
1627 |
|
1600 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1628 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1601 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1629 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1602 |
# (defined in the shibbolethLoginAttribute) tto contain the login of the |
1630 |
# (defined under shibboleth mapping in koha-conf.xml) to contain the login of the |
1603 |
# shibboleth-authenticated user |
1631 |
# shibboleth-authenticated user |
1604 |
|
1632 |
|
1605 |
# Then, we check if it matches a valid koha user |
1633 |
# Then, we check if it matches a valid koha user |
1606 |
if ($shib_login) { |
1634 |
if ($shib_login) { |
1607 |
my ( $retval, $retcard, $retuserid ) = C4::Auth_with_Shibboleth::checkpw_shib( $dbh, $shib_login ); # EXTERNAL AUTH |
1635 |
my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib( $dbh, $shib_login ); # EXTERNAL AUTH |
1608 |
($retval) and return ( $retval, $retcard, $retuserid ); |
1636 |
($retval) and return ( $retval, $retcard, $retuserid ); |
1609 |
return 0; |
1637 |
return 0; |
1610 |
} |
1638 |
} |