Lines 36-42
use POSIX qw/strftime/;
Link Here
|
36 |
use List::MoreUtils qw/ any /; |
36 |
use List::MoreUtils qw/ any /; |
37 |
|
37 |
|
38 |
# use utf8; |
38 |
# use utf8; |
39 |
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); |
39 |
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login); |
40 |
|
40 |
|
41 |
BEGIN { |
41 |
BEGIN { |
42 |
sub psgi_env { any { /^psgi\./ } keys %ENV } |
42 |
sub psgi_env { any { /^psgi\./ } keys %ENV } |
Lines 55-66
BEGIN {
Link Here
|
55 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
55 |
%EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); |
56 |
$ldap = C4::Context->config('useldapserver') || 0; |
56 |
$ldap = C4::Context->config('useldapserver') || 0; |
57 |
$cas = C4::Context->preference('casAuthentication'); |
57 |
$cas = C4::Context->preference('casAuthentication'); |
|
|
58 |
$shib = C4::Context->preference('shibbolethAuthentication'); |
58 |
$caslogout = C4::Context->preference('casLogout'); |
59 |
$caslogout = C4::Context->preference('casLogout'); |
59 |
require C4::Auth_with_cas; # no import |
60 |
require C4::Auth_with_cas; # no import |
|
|
61 |
require C4::Auth_with_Shibboleth; |
60 |
if ($ldap) { |
62 |
if ($ldap) { |
61 |
require C4::Auth_with_ldap; |
63 |
require C4::Auth_with_ldap; |
62 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
64 |
import C4::Auth_with_ldap qw(checkpw_ldap); |
63 |
} |
65 |
} |
|
|
66 |
if ($shib) { |
67 |
import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); |
68 |
# Getting user login |
69 |
$shib_login = get_login_shib(); |
70 |
} |
64 |
if ($cas) { |
71 |
if ($cas) { |
65 |
import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); |
72 |
import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); |
66 |
} |
73 |
} |
Lines 669-676
sub checkauth {
Link Here
|
669 |
my $casparam = $query->param('cas'); |
676 |
my $casparam = $query->param('cas'); |
670 |
my $q_userid = $query->param('userid') // ''; |
677 |
my $q_userid = $query->param('userid') // ''; |
671 |
|
678 |
|
672 |
if ( $userid = $ENV{'REMOTE_USER'} ) { |
679 |
# Basic authentication is incompatible with the use of Shibboleth, |
673 |
# Using Basic Authentication, no cookies required |
680 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
|
|
681 |
# and it may not be the attribute we want to use to match the koha login. |
682 |
# |
683 |
# Also, do not consider an empty REMOTE_USER. |
684 |
# |
685 |
# Finally, after those tests, we can assume (although if it would be better with |
686 |
# a syspref) that if we get a REMOTE_USER, that's from basic authentication, |
687 |
# and we can affect it to $userid. |
688 |
if ( !$shib and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { |
689 |
|
690 |
# Using Basic Authentication, no cookies required |
674 |
$cookie = $query->cookie( |
691 |
$cookie = $query->cookie( |
675 |
-name => 'CGISESSID', |
692 |
-name => 'CGISESSID', |
676 |
-value => '', |
693 |
-value => '', |
Lines 728-736
sub checkauth {
Link Here
|
728 |
$sessionID = undef; |
745 |
$sessionID = undef; |
729 |
$userid = undef; |
746 |
$userid = undef; |
730 |
|
747 |
|
731 |
if ($cas and $caslogout) { |
748 |
if ($cas and $caslogout) { |
732 |
logout_cas($query); |
749 |
logout_cas($query); |
733 |
} |
750 |
} |
|
|
751 |
|
752 |
# If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) |
753 |
if ( $shib and $shib_login and $type eq 'opac') { |
754 |
# (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) |
755 |
logout_shib($query); |
756 |
} |
734 |
} |
757 |
} |
735 |
elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { |
758 |
elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { |
736 |
# timed logout |
759 |
# timed logout |
Lines 800-812
sub checkauth {
Link Here
|
800 |
} |
823 |
} |
801 |
if ( ( $cas && $query->param('ticket') ) |
824 |
if ( ( $cas && $query->param('ticket') ) |
802 |
|| $userid |
825 |
|| $userid |
|
|
826 |
|| $shib |
803 |
|| $pki_field ne 'None' |
827 |
|| $pki_field ne 'None' |
804 |
|| $persona ) |
828 |
|| $persona ) |
805 |
{ |
829 |
{ |
806 |
my $password = $query->param('password'); |
830 |
my $password = $query->param('password'); |
807 |
|
831 |
|
808 |
my ( $return, $cardnumber ); |
832 |
my ( $return, $cardnumber ); |
809 |
if ( $cas && $query->param('ticket') ) { |
833 |
if ($shib && $shib_login && $type eq 'opac' && !$password) { |
|
|
834 |
my $retuserid; |
835 |
( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); |
836 |
$userid = $retuserid; |
837 |
$info{'invalidShibLogin'} = 1 unless ($return); |
838 |
|
839 |
} elsif ( $cas && $query->param('ticket') ) { |
810 |
my $retuserid; |
840 |
my $retuserid; |
811 |
( $return, $cardnumber, $retuserid ) = |
841 |
( $return, $cardnumber, $retuserid ) = |
812 |
checkpw( $dbh, $userid, $password, $query ); |
842 |
checkpw( $dbh, $userid, $password, $query ); |
Lines 1053-1058
sub checkauth {
Link Here
|
1053 |
login => 1, |
1083 |
login => 1, |
1054 |
INPUTS => \@inputs, |
1084 |
INPUTS => \@inputs, |
1055 |
casAuthentication => C4::Context->preference("casAuthentication"), |
1085 |
casAuthentication => C4::Context->preference("casAuthentication"), |
|
|
1086 |
shibbolethAuthentication => C4::Context->preference("shibbolethAuthentication"), |
1056 |
suggestion => C4::Context->preference("suggestion"), |
1087 |
suggestion => C4::Context->preference("suggestion"), |
1057 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1088 |
virtualshelves => C4::Context->preference("virtualshelves"), |
1058 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
1089 |
LibraryName => "" . C4::Context->preference("LibraryName"), |
Lines 1123-1128
sub checkauth {
Link Here
|
1123 |
); |
1154 |
); |
1124 |
} |
1155 |
} |
1125 |
|
1156 |
|
|
|
1157 |
if ($shib) { |
1158 |
$template->param( |
1159 |
shibbolethLoginUrl => login_shib_url($query), |
1160 |
); |
1161 |
} |
1162 |
|
1126 |
my $self_url = $query->url( -absolute => 1 ); |
1163 |
my $self_url = $query->url( -absolute => 1 ); |
1127 |
$template->param( |
1164 |
$template->param( |
1128 |
url => $self_url, |
1165 |
url => $self_url, |
Lines 1557-1562
sub checkpw {
Link Here
|
1557 |
return 0; |
1594 |
return 0; |
1558 |
} |
1595 |
} |
1559 |
|
1596 |
|
|
|
1597 |
# If we are in a shibboleth session (shibboleth is enabled and no password has been provided) |
1598 |
if ($shib && !$password) { |
1599 |
|
1600 |
$debug and print STDERR "## checkpw - checking Shibboleth\n"; |
1601 |
# In case of a Shibboleth authentication, we expect a shibboleth user attribute |
1602 |
# (defined in the shibbolethLoginAttribute) tto contain the login of the |
1603 |
# shibboleth-authenticated user |
1604 |
|
1605 |
# Shibboleth attributes are mapped into http environmement variables, |
1606 |
# so we're getting the login of the user this way |
1607 |
my $attributename = C4::Context->preference('shibbolethLoginAttribute'); |
1608 |
my $attributevalue = $ENV{$attributename}; |
1609 |
|
1610 |
# Then, we check if it matches a valid koha user |
1611 |
if ($shib_login) { |
1612 |
my ( $retval, $retcard, $retuserid ) = C4::Auth_with_Shibboleth::checkpw_shib( $dbh, $shib_login ); # EXTERNAL AUTH |
1613 |
($retval) and return ( $retval, $retcard, $retuserid ); |
1614 |
return 0; |
1615 |
} |
1616 |
} |
1617 |
|
1618 |
# INTERNAL AUTH |
1560 |
return checkpw_internal(@_) |
1619 |
return checkpw_internal(@_) |
1561 |
} |
1620 |
} |
1562 |
|
1621 |
|