Attachment #34906 for bug #13507

View | Details | Raw Unified | Return to bug 13507
Collapse All | Expand All




            $userid    = undef;

            if ($cas and $caslogout) {
                logout_cas($query, $type);
            }

            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)

        if ( $cas && $query->param('ticket') ) {
                my $retuserid;
                ( $return, $cardnumber, $retuserid ) =
                  checkpw( $dbh, $userid, $password, $query, $type );
                $userid = $retuserid;
                $info{'invalidCasLogin'} = 1 unless ($return);
            }

            else {
                my $retuserid;
                ( $return, $cardnumber, $retuserid ) =
                  checkpw( $dbh, $userid, $password, $query, $type );
                $userid = $retuserid if ( $retuserid );
        $info{'invalid_username_or_password'} = 1 unless ($return);
        } }

        my $casservers = C4::Auth_with_cas::getMultipleAuth();
        my @tmplservers;
        foreach my $key (keys %$casservers) {
        push @tmplservers, {name => $key, value => login_cas_url($query, $key, $type) . "?cas=$key" };
        }
        $template->param(
        casServersLoop => \@tmplservers
        );
    } else {
        $template->param(
            casServerUrl    => login_cas_url($query, undef, $type),
        );
    }


}

sub checkpw {
    my ( $dbh, $userid, $password, $query, $type ) = @_;
    $type = 'opac' unless $type;
    if ($ldap) {
        $debug and print STDERR "## checkpw - checking LDAP\n";
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH

    # In case of a CAS authentication, we use the ticket instead of the password
        my $ticket = $query->param('ticket');
        $query->delete('ticket'); # remove ticket to come back to original URL
        my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query, $type);    # EXTERNAL AUTH
        ($retval) and return ($retval,$retcard,$retuserid);
        return 0;
    }




use Authen::CAS::Client;
use CGI;
use FindBin;
use YAML;


use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);

my $context = C4::Context->new() or die 'C4::Context->new failed';
my $defaultcasserver;
my $casservers;
my $yamlauthfile = C4::Context->config('intranetdir') . "/C4/Auth_cas_servers.yaml";


# If there's a configuration for multiple cas servers, then we get it
if (multipleAuth()) {
    ($defaultcasserver, $casservers) = YAML::LoadFile($yamlauthfile);
    $defaultcasserver = $defaultcasserver->{'default'};
} else {
# Else, we fall back to casServerUrl syspref


# Is there a configuration file for multiple cas servers?
sub multipleAuth {
    return (-e qq($yamlauthfile));
}

# Returns configured CAS servers' list if multiple authentication is enabled


# Logout from CAS
sub logout_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
    print $query->redirect( $cas->logout_url($uri));
    print $query->redirect( $cas->logout_url(url => $uri));
}

# Login to CAS
sub login_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
    print $query->redirect( $cas->login_url($uri));
}

# Returns CAS login URL with callback to the requesting URL
sub login_cas_url {
    my ( $query, $key, $type ) = @_;
    my ( $cas, $uri ) = _get_cas_and_service( $query, $key, $type );
    return $cas->login_url($uri);
}


# In our case : is there a ticket, is it valid and does it match one of our users ?
sub checkpw_cas {
    $debug and warn "checkpw_cas";
    my ($dbh, $ticket, $query, $type) = @_;
    my $retnumber;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);

    # If we got a ticket
    if ($ticket) {

# Proxy CAS auth
sub check_api_auth_cas {
    $debug and warn "check_api_auth_cas";
    my ($dbh, $PT, $query, $type) = @_;
    my $retnumber;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);

    # If we have a Proxy Ticket
    if ($PT) {

sub _get_cas_and_service {
    my $query = shift;
    my $key   = shift;    # optional
    my $type  = shift; 

    my $uri = _url_with_get_params($query, $type);

    my $casparam = $defaultcasserver;
    $casparam = $query->param('cas') if defined $query->param('cas');

# This method replaces $query->url() which will give both GET and POST params
sub _url_with_get_params {
    my $query = shift;
    my $type = shift;

    my $uri_base_part = ($type eq 'opac') ?
                        C4::Context->preference('OPACBaseURL') . $query->script_name():
                        C4::Context->preference('staffClientBaseURL');

    my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
    my $uri_params_part = '';
    foreach ( $query->url_param() ) {
        # url_param() always returns parameters that were deleted by delete()





<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>
</form>

[% IF ( casAuthentication ) %]
<h4>Cas login</h4>

[% IF ( invalidCasLogin ) %]
<!-- This is what is displayed if cas login has failed -->
<p>Sorry, the CAS login failed.</p>
[% END %]

<p>If you have a <acronym title="Central Authentication Service">CAS</acronym> account,
[% IF ( casServerUrl ) %]
    please <a href="[% casServerUrl %]">click here to login</a>.<p>
[% END %]

[% IF ( casServersLoop ) %]
please choose against which one you would like to authenticate: </p>
<ul>
    [% FOREACH casServer IN casServersLoop %]
        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
    [% END %]
[% END %]
[% END %]

<!--<ul> -->
<!--	<li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->
<!-- </ul> -->
- 

Return to bug 13507

Lines 769-775 sub checkauth { Link Here

(-)a/C4/Auth.pm (-7 / +8 lines)
769	$userid = undef;	769	$userid = undef;
770		770
771	if ($cas and $caslogout) {	771	if ($cas and $caslogout) {
772	logout_cas($query);	772	logout_cas($query, $type);
773	}	773	}
774		774
775	# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)	775	# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
Lines 868-874 sub checkauth { Link Here
868	if ( $cas && $query->param('ticket') ) {	868	if ( $cas && $query->param('ticket') ) {
869	my $retuserid;	869	my $retuserid;
870	( $return, $cardnumber, $retuserid ) =	870	( $return, $cardnumber, $retuserid ) =
871	checkpw( $dbh, $userid, $password, $query );	871	checkpw( $dbh, $userid, $password, $query, $type );
872	$userid = $retuserid;	872	$userid = $retuserid;
873	$info{'invalidCasLogin'} = 1 unless ($return);	873	$info{'invalidCasLogin'} = 1 unless ($return);
874	}	874	}
Lines 930-936 sub checkauth { Link Here
930	else {	930	else {
931	my $retuserid;	931	my $retuserid;
932	( $return, $cardnumber, $retuserid ) =	932	( $return, $cardnumber, $retuserid ) =
933	checkpw( $dbh, $userid, $password, $query );	933	checkpw( $dbh, $userid, $password, $query, $type );
934	$userid = $retuserid if ( $retuserid );	934	$userid = $retuserid if ( $retuserid );
935	$info{'invalid_username_or_password'} = 1 unless ($return);	935	$info{'invalid_username_or_password'} = 1 unless ($return);
936	} }	936	} }
Lines 1169-1182 sub checkauth { Link Here
1169	my $casservers = C4::Auth_with_cas::getMultipleAuth();	1169	my $casservers = C4::Auth_with_cas::getMultipleAuth();
1170	my @tmplservers;	1170	my @tmplservers;
1171	foreach my $key (keys %$casservers) {	1171	foreach my $key (keys %$casservers) {
1172	push @tmplservers, {name => $key, value => login_cas_url($query, $key) . "?cas=$key" };	1172	push @tmplservers, {name => $key, value => login_cas_url($query, $key, $type) . "?cas=$key" };
1173	}	1173	}
1174	$template->param(	1174	$template->param(
1175	casServersLoop => \@tmplservers	1175	casServersLoop => \@tmplservers
1176	);	1176	);
1177	} else {	1177	} else {
1178	$template->param(	1178	$template->param(
1179	casServerUrl => login_cas_url($query),	1179	casServerUrl => login_cas_url($query, undef, $type),
1180	);	1180	);
1181	}	1181	}
1182		1182
Lines 1607-1613 sub get_session { Link Here
1607	}	1607	}
1608		1608
1609	sub checkpw {	1609	sub checkpw {
1610	my ( $dbh, $userid, $password, $query ) = @_;	1610	my ( $dbh, $userid, $password, $query, $type ) = @_;
		1611	$type = 'opac' unless $type;
1611	if ($ldap) {	1612	if ($ldap) {
1612	$debug and print STDERR "## checkpw - checking LDAP\n";	1613	$debug and print STDERR "## checkpw - checking LDAP\n";
1613	my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH	1614	my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH
Lines 1620-1626 sub checkpw { Link Here
1620	# In case of a CAS authentication, we use the ticket instead of the password	1621	# In case of a CAS authentication, we use the ticket instead of the password
1621	my $ticket = $query->param('ticket');	1622	my $ticket = $query->param('ticket');
1622	$query->delete('ticket'); # remove ticket to come back to original URL	1623	$query->delete('ticket'); # remove ticket to come back to original URL
1623	my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query); # EXTERNAL AUTH	1624	my ($retval,$retcard,$retuserid) = checkpw_cas($dbh, $ticket, $query, $type); # EXTERNAL AUTH
1624	($retval) and return ($retval,$retcard,$retuserid);	1625	($retval) and return ($retval,$retcard,$retuserid);
1625	return 0;	1626	return 0;
1626	}	1627	}

Lines 25-30 use C4::Context; Link Here

(-)a/C4/Auth_with_cas.pm (-15 / +21 lines)
25	use Authen::CAS::Client;	25	use Authen::CAS::Client;
26	use CGI;	26	use CGI;
27	use FindBin;	27	use FindBin;
		28	use YAML;
28		29
29		30
30	use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);	31	use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
Lines 39-50 BEGIN { Link Here
39	my $context = C4::Context->new() or die 'C4::Context->new failed';	40	my $context = C4::Context->new() or die 'C4::Context->new failed';
40	my $defaultcasserver;	41	my $defaultcasserver;
41	my $casservers;	42	my $casservers;
42	my $yamlauthfile = "../C4/Auth_cas_servers.yaml";	43	my $yamlauthfile = C4::Context->config('intranetdir') . "/C4/Auth_cas_servers.yaml";
43		44
44		45
45	# If there's a configuration for multiple cas servers, then we get it	46	# If there's a configuration for multiple cas servers, then we get it
46	if (multipleAuth()) {	47	if (multipleAuth()) {
47	($defaultcasserver, $casservers) = YAML::LoadFile(qq($FindBin::Bin/$yamlauthfile));	48	($defaultcasserver, $casservers) = YAML::LoadFile($yamlauthfile);
48	$defaultcasserver = $defaultcasserver->{'default'};	49	$defaultcasserver = $defaultcasserver->{'default'};
49	} else {	50	} else {
50	# Else, we fall back to casServerUrl syspref	51	# Else, we fall back to casServerUrl syspref
Lines 54-60 if (multipleAuth()) { Link Here
54		55
55	# Is there a configuration file for multiple cas servers?	56	# Is there a configuration file for multiple cas servers?
56	sub multipleAuth {	57	sub multipleAuth {
57	return (-e qq($FindBin::Bin/$yamlauthfile));	58	return (-e qq($yamlauthfile));
58	}	59	}
59		60
60	# Returns configured CAS servers' list if multiple authentication is enabled	61	# Returns configured CAS servers' list if multiple authentication is enabled
Lines 64-86 sub getMultipleAuth { Link Here
64		65
65	# Logout from CAS	66	# Logout from CAS
66	sub logout_cas {	67	sub logout_cas {
67	my ($query) = @_;	68	my ($query, $type) = @_;
68	my ( $cas, $uri ) = _get_cas_and_service($query);	69	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
69	print $query->redirect( $cas->logout_url($uri));	70	print $query->redirect( $cas->logout_url($uri));
70	print $query->redirect( $cas->logout_url(url => $uri));	71	print $query->redirect( $cas->logout_url(url => $uri));
71	}	72	}
72		73
73	# Login to CAS	74	# Login to CAS
74	sub login_cas {	75	sub login_cas {
75	my ($query) = @_;	76	my ($query, $type) = @_;
76	my ( $cas, $uri ) = _get_cas_and_service($query);	77	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
77	print $query->redirect( $cas->login_url($uri));	78	print $query->redirect( $cas->login_url($uri));
78	}	79	}
79		80
80	# Returns CAS login URL with callback to the requesting URL	81	# Returns CAS login URL with callback to the requesting URL
81	sub login_cas_url {	82	sub login_cas_url {
82	my ( $query, $key ) = @_;	83	my ( $query, $key, $type ) = @_;
83	my ( $cas, $uri ) = _get_cas_and_service( $query, $key );	84	my ( $cas, $uri ) = _get_cas_and_service( $query, $key, $type );
84	return $cas->login_url($uri);	85	return $cas->login_url($uri);
85	}	86	}
86		87
Lines 88-96 sub login_cas_url { Link Here
88	# In our case : is there a ticket, is it valid and does it match one of our users ?	89	# In our case : is there a ticket, is it valid and does it match one of our users ?
89	sub checkpw_cas {	90	sub checkpw_cas {
90	$debug and warn "checkpw_cas";	91	$debug and warn "checkpw_cas";
91	my ($dbh, $ticket, $query) = @_;	92	my ($dbh, $ticket, $query, $type) = @_;
92	my $retnumber;	93	my $retnumber;
93	my ( $cas, $uri ) = _get_cas_and_service($query);	94	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
94		95
95	# If we got a ticket	96	# If we got a ticket
96	if ($ticket) {	97	if ($ticket) {
Lines 136-144 sub checkpw_cas { Link Here
136	# Proxy CAS auth	137	# Proxy CAS auth
137	sub check_api_auth_cas {	138	sub check_api_auth_cas {
138	$debug and warn "check_api_auth_cas";	139	$debug and warn "check_api_auth_cas";
139	my ($dbh, $PT, $query) = @_;	140	my ($dbh, $PT, $query, $type) = @_;
140	my $retnumber;	141	my $retnumber;
141	my ( $cas, $uri ) = _get_cas_and_service($query);	142	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
142		143
143	# If we have a Proxy Ticket	144	# If we have a Proxy Ticket
144	if ($PT) {	145	if ($PT) {
Lines 184-191 sub check_api_auth_cas { Link Here
184	sub _get_cas_and_service {	185	sub _get_cas_and_service {
185	my $query = shift;	186	my $query = shift;
186	my $key = shift; # optional	187	my $key = shift; # optional
		188	my $type = shift;
187		189
188	my $uri = _url_with_get_params($query);	190	my $uri = _url_with_get_params($query, $type);
189		191
190	my $casparam = $defaultcasserver;	192	my $casparam = $defaultcasserver;
191	$casparam = $query->param('cas') if defined $query->param('cas');	193	$casparam = $query->param('cas') if defined $query->param('cas');
Lines 199-206 sub _get_cas_and_service { Link Here
199	# This method replaces $query->url() which will give both GET and POST params	201	# This method replaces $query->url() which will give both GET and POST params
200	sub _url_with_get_params {	202	sub _url_with_get_params {
201	my $query = shift;	203	my $query = shift;
		204	my $type = shift;
		205
		206	my $uri_base_part = ($type eq 'opac') ?
		207	C4::Context->preference('OPACBaseURL') . $query->script_name():
		208	C4::Context->preference('staffClientBaseURL');
202		209
203	my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
204	my $uri_params_part = '';	210	my $uri_params_part = '';
205	foreach ( $query->url_param() ) {	211	foreach ( $query->url_param() ) {
206	# url_param() always returns parameters that were deleted by delete()	212	# url_param() always returns parameters that were deleted by delete()

Lines 71-76 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-1 / +23 lines)
71		71
72	<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>	72	<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>
73	</form>	73	</form>
		74
		75	[% IF ( casAuthentication ) %]
		76	<h4>Cas login</h4>
		77
		78	[% IF ( invalidCasLogin ) %]
		79	<!-- This is what is displayed if cas login has failed -->
		80	<p>Sorry, the CAS login failed.</p>
		81	[% END %]
		82
		83	<p>If you have a <acronym title="Central Authentication Service">CAS</acronym> account,
		84	[% IF ( casServerUrl ) %]
		85	please <a href="[% casServerUrl %]">click here to login</a>.<p>
		86	[% END %]
		87
		88	[% IF ( casServersLoop ) %]
		89	please choose against which one you would like to authenticate: </p>
		90	<ul>
		91	[% FOREACH casServer IN casServersLoop %]
		92	<li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
		93	[% END %]
		94	[% END %]
		95	[% END %]
		96
74	<!--<ul> -->	97	<!--<ul> -->
75	<!-- <li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->	98	<!-- <li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->
76	<!-- </ul> -->	99	<!-- </ul> -->
77	-