Attachment #36341 for bug #13507

View | Details | Raw Unified | Return to bug 13507
Collapse All | Expand All




            $sessionID = undef;
            $userid    = undef;

            if ($cas and $caslogout) {
                logout_cas($query, $type);
            }

            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)

                if ( $cas && $query->param('ticket') ) {
                    my $retuserid;
                    ( $return, $cardnumber, $retuserid ) =
                      checkpw( $dbh, $userid, $password, $query, $type );
                    $userid = $retuserid;
                    $info{'invalidCasLogin'} = 1 unless ($return);
                }

                else {
                    my $retuserid;
                    ( $return, $cardnumber, $retuserid ) =
                      checkpw( $dbh, $userid, $password, $query, $type );
                    $userid = $retuserid if ($retuserid);
                    $info{'invalid_username_or_password'} = 1 unless ($return);
                }

            my $casservers = C4::Auth_with_cas::getMultipleAuth();
            my @tmplservers;
            foreach my $key ( keys %$casservers ) {
                push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
            }
            $template->param(
                casServersLoop => \@tmplservers
            );
        } else {
            $template->param(
                casServerUrl => login_cas_url($query, undef, $type),
            );
        }


}

sub checkpw {
    my ( $dbh, $userid, $password, $query, $type ) = @_;
    $type = 'opac' unless $type;
    if ($ldap) {
        $debug and print STDERR "## checkpw - checking LDAP\n";
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH

        # In case of a CAS authentication, we use the ticket instead of the password
        my $ticket = $query->param('ticket');
        $query->delete('ticket');                                   # remove ticket to come back to original URL
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
        ($retval) and return ( $retval, $retcard, $retuserid );
        return 0;
    }




use Authen::CAS::Client;
use CGI qw ( -utf8 );
use FindBin;
use YAML;


use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);

my $context = C4::Context->new() or die 'C4::Context->new failed';
my $defaultcasserver;
my $casservers;
my $yamlauthfile = C4::Context->config('intranetdir') . "/C4/Auth_cas_servers.yaml";


# If there's a configuration for multiple cas servers, then we get it
if (multipleAuth()) {
    ($defaultcasserver, $casservers) = YAML::LoadFile($yamlauthfile);
    $defaultcasserver = $defaultcasserver->{'default'};
} else {
# Else, we fall back to casServerUrl syspref


# Is there a configuration file for multiple cas servers?
sub multipleAuth {
    return (-e qq($yamlauthfile));
}

# Returns configured CAS servers' list if multiple authentication is enabled


# Logout from CAS
sub logout_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
    print $query->redirect( $cas->logout_url($uri));
    print $query->redirect( $cas->logout_url(url => $uri));
}

# Login to CAS
sub login_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
    print $query->redirect( $cas->login_url($uri));
}

# Returns CAS login URL with callback to the requesting URL
sub login_cas_url {
    my ( $query, $key, $type ) = @_;
    my ( $cas, $uri ) = _get_cas_and_service( $query, $key, $type );
    return $cas->login_url($uri);
}


# In our case : is there a ticket, is it valid and does it match one of our users ?
sub checkpw_cas {
    $debug and warn "checkpw_cas";
    my ($dbh, $ticket, $query, $type) = @_;
    my $retnumber;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);

    # If we got a ticket
    if ($ticket) {

# Proxy CAS auth
sub check_api_auth_cas {
    $debug and warn "check_api_auth_cas";
    my ($dbh, $PT, $query, $type) = @_;
    my $retnumber;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);

    # If we have a Proxy Ticket
    if ($PT) {

sub _get_cas_and_service {
    my $query = shift;
    my $key   = shift;    # optional
    my $type  = shift;

    my $uri = _url_with_get_params($query, $type);

    my $casparam = $defaultcasserver;
    $casparam = $query->param('cas') if defined $query->param('cas');

# This method replaces $query->url() which will give both GET and POST params
sub _url_with_get_params {
    my $query = shift;
    my $type = shift;

    my $uri_base_part = ($type eq 'opac') ?
                        C4::Context->preference('OPACBaseURL') . $query->script_name():
                        C4::Context->preference('staffClientBaseURL');

    my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
    my $uri_params_part = '';
    foreach ( $query->url_param() ) {
        # url_param() always returns parameters that were deleted by delete()





<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>
</form>

[% IF ( casAuthentication ) %]
<h4>Cas login</h4>

[% IF ( invalidCasLogin ) %]
<!-- This is what is displayed if cas login has failed -->
<p>Sorry, the CAS login failed.</p>
[% END %]

<p>If you have a <acronym title="Central Authentication Service">CAS</acronym> account,
[% IF ( casServerUrl ) %]
    please <a href="[% casServerUrl %]">click here to login</a>.<p>
[% END %]

[% IF ( casServersLoop ) %]
please choose against which one you would like to authenticate: </p>
<ul>
    [% FOREACH casServer IN casServersLoop %]
        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
    [% END %]
[% END %]
[% END %]

<!--<ul> -->
<!--	<li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->
<!-- </ul> -->
- 

Return to bug 13507

Lines 795-802 sub checkauth { Link Here

(-)a/C4/Auth.pm (-8 / +9 lines)
795	$sessionID = undef;	795	$sessionID = undef;
796	$userid = undef;	796	$userid = undef;
797		797
798	if ( $cas and $caslogout ) {	798	if ($cas and $caslogout) {
799	logout_cas($query);	799	logout_cas($query, $type);
800	}	800	}
801		801
802	# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)	802	# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
Lines 903-909 sub checkauth { Link Here
903	if ( $cas && $query->param('ticket') ) {	903	if ( $cas && $query->param('ticket') ) {
904	my $retuserid;	904	my $retuserid;
905	( $return, $cardnumber, $retuserid ) =	905	( $return, $cardnumber, $retuserid ) =
906	checkpw( $dbh, $userid, $password, $query );	906	checkpw( $dbh, $userid, $password, $query, $type );
907	$userid = $retuserid;	907	$userid = $retuserid;
908	$info{'invalidCasLogin'} = 1 unless ($return);	908	$info{'invalidCasLogin'} = 1 unless ($return);
909	}	909	}
Lines 964-970 sub checkauth { Link Here
964	else {	964	else {
965	my $retuserid;	965	my $retuserid;
966	( $return, $cardnumber, $retuserid ) =	966	( $return, $cardnumber, $retuserid ) =
967	checkpw( $dbh, $userid, $password, $query );	967	checkpw( $dbh, $userid, $password, $query, $type );
968	$userid = $retuserid if ($retuserid);	968	$userid = $retuserid if ($retuserid);
969	$info{'invalid_username_or_password'} = 1 unless ($return);	969	$info{'invalid_username_or_password'} = 1 unless ($return);
970	}	970	}
Lines 1217-1230 sub checkauth { Link Here
1217	my $casservers = C4::Auth_with_cas::getMultipleAuth();	1217	my $casservers = C4::Auth_with_cas::getMultipleAuth();
1218	my @tmplservers;	1218	my @tmplservers;
1219	foreach my $key ( keys %$casservers ) {	1219	foreach my $key ( keys %$casservers ) {
1220	push @tmplservers, { name => $key, value => login_cas_url( $query, $key ) . "?cas=$key" };	1220	push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
1221	}	1221	}
1222	$template->param(	1222	$template->param(
1223	casServersLoop => \@tmplservers	1223	casServersLoop => \@tmplservers
1224	);	1224	);
1225	} else {	1225	} else {
1226	$template->param(	1226	$template->param(
1227	casServerUrl => login_cas_url($query),	1227	casServerUrl => login_cas_url($query, undef, $type),
1228	);	1228	);
1229	}	1229	}
1230		1230
Lines 1671-1677 sub get_session { Link Here
1671	}	1671	}
1672		1672
1673	sub checkpw {	1673	sub checkpw {
1674	my ( $dbh, $userid, $password, $query ) = @_;	1674	my ( $dbh, $userid, $password, $query, $type ) = @_;
		1675	$type = 'opac' unless $type;
1675	if ($ldap) {	1676	if ($ldap) {
1676	$debug and print STDERR "## checkpw - checking LDAP\n";	1677	$debug and print STDERR "## checkpw - checking LDAP\n";
1677	my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_); # EXTERNAL AUTH	1678	my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_); # EXTERNAL AUTH
Lines 1685-1691 sub checkpw { Link Here
1685	# In case of a CAS authentication, we use the ticket instead of the password	1686	# In case of a CAS authentication, we use the ticket instead of the password
1686	my $ticket = $query->param('ticket');	1687	my $ticket = $query->param('ticket');
1687	$query->delete('ticket'); # remove ticket to come back to original URL	1688	$query->delete('ticket'); # remove ticket to come back to original URL
1688	my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query ); # EXTERNAL AUTH	1689	my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type ); # EXTERNAL AUTH
1689	($retval) and return ( $retval, $retcard, $retuserid );	1690	($retval) and return ( $retval, $retcard, $retuserid );
1690	return 0;	1691	return 0;
1691	}	1692	}

Lines 25-30 use C4::Context; Link Here

(-)a/C4/Auth_with_cas.pm (-15 / +21 lines)
25	use Authen::CAS::Client;	25	use Authen::CAS::Client;
26	use CGI qw ( -utf8 );	26	use CGI qw ( -utf8 );
27	use FindBin;	27	use FindBin;
		28	use YAML;
28		29
29		30
30	use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);	31	use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
Lines 39-50 BEGIN { Link Here
39	my $context = C4::Context->new() or die 'C4::Context->new failed';	40	my $context = C4::Context->new() or die 'C4::Context->new failed';
40	my $defaultcasserver;	41	my $defaultcasserver;
41	my $casservers;	42	my $casservers;
42	my $yamlauthfile = "../C4/Auth_cas_servers.yaml";	43	my $yamlauthfile = C4::Context->config('intranetdir') . "/C4/Auth_cas_servers.yaml";
43		44
44		45
45	# If there's a configuration for multiple cas servers, then we get it	46	# If there's a configuration for multiple cas servers, then we get it
46	if (multipleAuth()) {	47	if (multipleAuth()) {
47	($defaultcasserver, $casservers) = YAML::LoadFile(qq($FindBin::Bin/$yamlauthfile));	48	($defaultcasserver, $casservers) = YAML::LoadFile($yamlauthfile);
48	$defaultcasserver = $defaultcasserver->{'default'};	49	$defaultcasserver = $defaultcasserver->{'default'};
49	} else {	50	} else {
50	# Else, we fall back to casServerUrl syspref	51	# Else, we fall back to casServerUrl syspref
Lines 54-60 if (multipleAuth()) { Link Here
54		55
55	# Is there a configuration file for multiple cas servers?	56	# Is there a configuration file for multiple cas servers?
56	sub multipleAuth {	57	sub multipleAuth {
57	return (-e qq($FindBin::Bin/$yamlauthfile));	58	return (-e qq($yamlauthfile));
58	}	59	}
59		60
60	# Returns configured CAS servers' list if multiple authentication is enabled	61	# Returns configured CAS servers' list if multiple authentication is enabled
Lines 64-86 sub getMultipleAuth { Link Here
64		65
65	# Logout from CAS	66	# Logout from CAS
66	sub logout_cas {	67	sub logout_cas {
67	my ($query) = @_;	68	my ($query, $type) = @_;
68	my ( $cas, $uri ) = _get_cas_and_service($query);	69	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
69	print $query->redirect( $cas->logout_url($uri));	70	print $query->redirect( $cas->logout_url($uri));
70	print $query->redirect( $cas->logout_url(url => $uri));	71	print $query->redirect( $cas->logout_url(url => $uri));
71	}	72	}
72		73
73	# Login to CAS	74	# Login to CAS
74	sub login_cas {	75	sub login_cas {
75	my ($query) = @_;	76	my ($query, $type) = @_;
76	my ( $cas, $uri ) = _get_cas_and_service($query);	77	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
77	print $query->redirect( $cas->login_url($uri));	78	print $query->redirect( $cas->login_url($uri));
78	}	79	}
79		80
80	# Returns CAS login URL with callback to the requesting URL	81	# Returns CAS login URL with callback to the requesting URL
81	sub login_cas_url {	82	sub login_cas_url {
82	my ( $query, $key ) = @_;	83	my ( $query, $key, $type ) = @_;
83	my ( $cas, $uri ) = _get_cas_and_service( $query, $key );	84	my ( $cas, $uri ) = _get_cas_and_service( $query, $key, $type );
84	return $cas->login_url($uri);	85	return $cas->login_url($uri);
85	}	86	}
86		87
Lines 88-96 sub login_cas_url { Link Here
88	# In our case : is there a ticket, is it valid and does it match one of our users ?	89	# In our case : is there a ticket, is it valid and does it match one of our users ?
89	sub checkpw_cas {	90	sub checkpw_cas {
90	$debug and warn "checkpw_cas";	91	$debug and warn "checkpw_cas";
91	my ($dbh, $ticket, $query) = @_;	92	my ($dbh, $ticket, $query, $type) = @_;
92	my $retnumber;	93	my $retnumber;
93	my ( $cas, $uri ) = _get_cas_and_service($query);	94	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
94		95
95	# If we got a ticket	96	# If we got a ticket
96	if ($ticket) {	97	if ($ticket) {
Lines 136-144 sub checkpw_cas { Link Here
136	# Proxy CAS auth	137	# Proxy CAS auth
137	sub check_api_auth_cas {	138	sub check_api_auth_cas {
138	$debug and warn "check_api_auth_cas";	139	$debug and warn "check_api_auth_cas";
139	my ($dbh, $PT, $query) = @_;	140	my ($dbh, $PT, $query, $type) = @_;
140	my $retnumber;	141	my $retnumber;
141	my ( $cas, $uri ) = _get_cas_and_service($query);	142	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
142		143
143	# If we have a Proxy Ticket	144	# If we have a Proxy Ticket
144	if ($PT) {	145	if ($PT) {
Lines 184-191 sub check_api_auth_cas { Link Here
184	sub _get_cas_and_service {	185	sub _get_cas_and_service {
185	my $query = shift;	186	my $query = shift;
186	my $key = shift; # optional	187	my $key = shift; # optional
		188	my $type = shift;
187		189
188	my $uri = _url_with_get_params($query);	190	my $uri = _url_with_get_params($query, $type);
189		191
190	my $casparam = $defaultcasserver;	192	my $casparam = $defaultcasserver;
191	$casparam = $query->param('cas') if defined $query->param('cas');	193	$casparam = $query->param('cas') if defined $query->param('cas');
Lines 199-206 sub _get_cas_and_service { Link Here
199	# This method replaces $query->url() which will give both GET and POST params	201	# This method replaces $query->url() which will give both GET and POST params
200	sub _url_with_get_params {	202	sub _url_with_get_params {
201	my $query = shift;	203	my $query = shift;
		204	my $type = shift;
		205
		206	my $uri_base_part = ($type eq 'opac') ?
		207	C4::Context->preference('OPACBaseURL') . $query->script_name():
		208	C4::Context->preference('staffClientBaseURL');
202		209
203	my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
204	my $uri_params_part = '';	210	my $uri_params_part = '';
205	foreach ( $query->url_param() ) {	211	foreach ( $query->url_param() ) {
206	# url_param() always returns parameters that were deleted by delete()	212	# url_param() always returns parameters that were deleted by delete()

Lines 71-76 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-1 / +23 lines)
71		71
72	<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>	72	<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>
73	</form>	73	</form>
		74
		75	[% IF ( casAuthentication ) %]
		76	<h4>Cas login</h4>
		77
		78	[% IF ( invalidCasLogin ) %]
		79	<!-- This is what is displayed if cas login has failed -->
		80	<p>Sorry, the CAS login failed.</p>
		81	[% END %]
		82
		83	<p>If you have a <acronym title="Central Authentication Service">CAS</acronym> account,
		84	[% IF ( casServerUrl ) %]
		85	please <a href="[% casServerUrl %]">click here to login</a>.<p>
		86	[% END %]
		87
		88	[% IF ( casServersLoop ) %]
		89	please choose against which one you would like to authenticate: </p>
		90	<ul>
		91	[% FOREACH casServer IN casServersLoop %]
		92	<li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
		93	[% END %]
		94	[% END %]
		95	[% END %]
		96
74	<!--<ul> -->	97	<!--<ul> -->
75	<!-- <li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->	98	<!-- <li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->
76	<!-- </ul> -->	99	<!-- </ul> -->
77	-