Attachment #37431 for bug #13507

View | Details | Raw Unified | Return to bug 13507
Collapse All | Expand All




            $sessionID = undef;
            $userid    = undef;

            if ($cas and $caslogout) {
                logout_cas($query, $type);
            }

            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)

                if ( $cas && $query->param('ticket') ) {
                    my $retuserid;
                    ( $return, $cardnumber, $retuserid ) =
                      checkpw( $dbh, $userid, $password, $query, $type );
                    $userid = $retuserid;
                    $info{'invalidCasLogin'} = 1 unless ($return);
                }

                else {
                    my $retuserid;
                    ( $return, $cardnumber, $retuserid ) =
                      checkpw( $dbh, $userid, $password, $query, $type );
                    $userid = $retuserid if ($retuserid);
                    $info{'invalid_username_or_password'} = 1 unless ($return);
                }

            my $casservers = C4::Auth_with_cas::getMultipleAuth();
            my @tmplservers;
            foreach my $key ( keys %$casservers ) {
                push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
            }
            $template->param(
                casServersLoop => \@tmplservers
            );
        } else {
            $template->param(
                casServerUrl => login_cas_url($query, undef, $type),
            );
        }


}

sub checkpw {
    my ( $dbh, $userid, $password, $query, $type ) = @_;
    $type = 'opac' unless $type;
    if ($ldap) {
        $debug and print STDERR "## checkpw - checking LDAP\n";
        my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_);    # EXTERNAL AUTH

        # In case of a CAS authentication, we use the ticket instead of the password
        my $ticket = $query->param('ticket');
        $query->delete('ticket');                                   # remove ticket to come back to original URL
        my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type );    # EXTERNAL AUTH
        ($retval) and return ( $retval, $retcard, $retuserid );
        return 0;
    }




use Authen::CAS::Client;
use CGI qw ( -utf8 );
use FindBin;
use YAML;


use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);

my $context = C4::Context->new() or die 'C4::Context->new failed';
my $defaultcasserver;
my $casservers;
my $yamlauthfile = C4::Context->config('intranetdir') . "/C4/Auth_cas_servers.yaml";


# If there's a configuration for multiple cas servers, then we get it
if (multipleAuth()) {
    ($defaultcasserver, $casservers) = YAML::LoadFile($yamlauthfile);
    $defaultcasserver = $defaultcasserver->{'default'};
} else {
# Else, we fall back to casServerUrl syspref


# Is there a configuration file for multiple cas servers?
sub multipleAuth {
    return (-e qq($yamlauthfile));
}

# Returns configured CAS servers' list if multiple authentication is enabled


# Logout from CAS
sub logout_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
    print $query->redirect( $cas->logout_url($uri));
    print $query->redirect( $cas->logout_url(url => $uri));
}

# Login to CAS
sub login_cas {
    my ($query, $type) = @_;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
    print $query->redirect( $cas->login_url($uri));
}

# Returns CAS login URL with callback to the requesting URL
sub login_cas_url {
    my ( $query, $key, $type ) = @_;
    my ( $cas, $uri ) = _get_cas_and_service( $query, $key, $type );
    return $cas->login_url($uri);
}


# In our case : is there a ticket, is it valid and does it match one of our users ?
sub checkpw_cas {
    $debug and warn "checkpw_cas";
    my ($dbh, $ticket, $query, $type) = @_;
    my $retnumber;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);

    # If we got a ticket
    if ($ticket) {

# Proxy CAS auth
sub check_api_auth_cas {
    $debug and warn "check_api_auth_cas";
    my ($dbh, $PT, $query, $type) = @_;
    my $retnumber;
    my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);

    # If we have a Proxy Ticket
    if ($PT) {

sub _get_cas_and_service {
    my $query = shift;
    my $key   = shift;    # optional
    my $type  = shift;

    my $uri = _url_with_get_params($query, $type);

    my $casparam = $defaultcasserver;
    $casparam = $query->param('cas') if defined $query->param('cas');

# This method replaces $query->url() which will give both GET and POST params
sub _url_with_get_params {
    my $query = shift;
    my $type = shift;

    my $uri_base_part = ($type eq 'opac') ?
                        C4::Context->preference('OPACBaseURL') . $query->script_name():
                        C4::Context->preference('staffClientBaseURL');

    my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
    my $uri_params_part = '';
    foreach ( $query->url_param() ) {
        # url_param() always returns parameters that were deleted by delete()





<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>
</form>
[% IF ( casAuthentication ) %]
<h4>Cas login</h4>

[% IF ( invalidCasLogin ) %]
<!-- This is what is displayed if cas login has failed -->
<p>Sorry, the CAS login failed.</p>
[% END %]

<p>If you have a <acronym title="Central Authentication Service">CAS</acronym> account,
[% IF ( casServerUrl ) %]
    please <a href="[% casServerUrl %]">click here to login</a>.<p>
[% END %]

[% IF ( casServersLoop ) %]
please choose against which one you would like to authenticate: </p>
<ul>
    [% FOREACH casServer IN casServersLoop %]
        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
    [% END %]
[% END %]
[% END %]

[% IF ( nopermission ) %]
    <p><a href="javascript:window.history.back()">[Previous page]</a>
    <a href="/">[Main page]</a></p>
[% END %]


<!--<ul> -->
<!--	<li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->
<!-- </ul> -->
- 

Return to bug 13507

Lines 799-806 sub checkauth { Link Here

(-)a/C4/Auth.pm (-8 / +9 lines)
799	$sessionID = undef;	799	$sessionID = undef;
800	$userid = undef;	800	$userid = undef;
801		801
802	if ( $cas and $caslogout ) {	802	if ($cas and $caslogout) {
803	logout_cas($query);	803	logout_cas($query, $type);
804	}	804	}
805		805
806	# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)	806	# If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
Lines 907-913 sub checkauth { Link Here
907	if ( $cas && $query->param('ticket') ) {	907	if ( $cas && $query->param('ticket') ) {
908	my $retuserid;	908	my $retuserid;
909	( $return, $cardnumber, $retuserid ) =	909	( $return, $cardnumber, $retuserid ) =
910	checkpw( $dbh, $userid, $password, $query );	910	checkpw( $dbh, $userid, $password, $query, $type );
911	$userid = $retuserid;	911	$userid = $retuserid;
912	$info{'invalidCasLogin'} = 1 unless ($return);	912	$info{'invalidCasLogin'} = 1 unless ($return);
913	}	913	}
Lines 968-974 sub checkauth { Link Here
968	else {	968	else {
969	my $retuserid;	969	my $retuserid;
970	( $return, $cardnumber, $retuserid ) =	970	( $return, $cardnumber, $retuserid ) =
971	checkpw( $dbh, $userid, $password, $query );	971	checkpw( $dbh, $userid, $password, $query, $type );
972	$userid = $retuserid if ($retuserid);	972	$userid = $retuserid if ($retuserid);
973	$info{'invalid_username_or_password'} = 1 unless ($return);	973	$info{'invalid_username_or_password'} = 1 unless ($return);
974	}	974	}
Lines 1222-1235 sub checkauth { Link Here
1222	my $casservers = C4::Auth_with_cas::getMultipleAuth();	1222	my $casservers = C4::Auth_with_cas::getMultipleAuth();
1223	my @tmplservers;	1223	my @tmplservers;
1224	foreach my $key ( keys %$casservers ) {	1224	foreach my $key ( keys %$casservers ) {
1225	push @tmplservers, { name => $key, value => login_cas_url( $query, $key ) . "?cas=$key" };	1225	push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" };
1226	}	1226	}
1227	$template->param(	1227	$template->param(
1228	casServersLoop => \@tmplservers	1228	casServersLoop => \@tmplservers
1229	);	1229	);
1230	} else {	1230	} else {
1231	$template->param(	1231	$template->param(
1232	casServerUrl => login_cas_url($query),	1232	casServerUrl => login_cas_url($query, undef, $type),
1233	);	1233	);
1234	}	1234	}
1235		1235
Lines 1676-1682 sub get_session { Link Here
1676	}	1676	}
1677		1677
1678	sub checkpw {	1678	sub checkpw {
1679	my ( $dbh, $userid, $password, $query ) = @_;	1679	my ( $dbh, $userid, $password, $query, $type ) = @_;
		1680	$type = 'opac' unless $type;
1680	if ($ldap) {	1681	if ($ldap) {
1681	$debug and print STDERR "## checkpw - checking LDAP\n";	1682	$debug and print STDERR "## checkpw - checking LDAP\n";
1682	my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_); # EXTERNAL AUTH	1683	my ( $retval, $retcard, $retuserid ) = checkpw_ldap(@_); # EXTERNAL AUTH
Lines 1690-1696 sub checkpw { Link Here
1690	# In case of a CAS authentication, we use the ticket instead of the password	1691	# In case of a CAS authentication, we use the ticket instead of the password
1691	my $ticket = $query->param('ticket');	1692	my $ticket = $query->param('ticket');
1692	$query->delete('ticket'); # remove ticket to come back to original URL	1693	$query->delete('ticket'); # remove ticket to come back to original URL
1693	my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query ); # EXTERNAL AUTH	1694	my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type ); # EXTERNAL AUTH
1694	($retval) and return ( $retval, $retcard, $retuserid );	1695	($retval) and return ( $retval, $retcard, $retuserid );
1695	return 0;	1696	return 0;
1696	}	1697	}

Lines 25-30 use C4::Context; Link Here

(-)a/C4/Auth_with_cas.pm (-15 / +21 lines)
25	use Authen::CAS::Client;	25	use Authen::CAS::Client;
26	use CGI qw ( -utf8 );	26	use CGI qw ( -utf8 );
27	use FindBin;	27	use FindBin;
		28	use YAML;
28		29
29		30
30	use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);	31	use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
Lines 39-50 BEGIN { Link Here
39	my $context = C4::Context->new() or die 'C4::Context->new failed';	40	my $context = C4::Context->new() or die 'C4::Context->new failed';
40	my $defaultcasserver;	41	my $defaultcasserver;
41	my $casservers;	42	my $casservers;
42	my $yamlauthfile = "../C4/Auth_cas_servers.yaml";	43	my $yamlauthfile = C4::Context->config('intranetdir') . "/C4/Auth_cas_servers.yaml";
43		44
44		45
45	# If there's a configuration for multiple cas servers, then we get it	46	# If there's a configuration for multiple cas servers, then we get it
46	if (multipleAuth()) {	47	if (multipleAuth()) {
47	($defaultcasserver, $casservers) = YAML::LoadFile(qq($FindBin::Bin/$yamlauthfile));	48	($defaultcasserver, $casservers) = YAML::LoadFile($yamlauthfile);
48	$defaultcasserver = $defaultcasserver->{'default'};	49	$defaultcasserver = $defaultcasserver->{'default'};
49	} else {	50	} else {
50	# Else, we fall back to casServerUrl syspref	51	# Else, we fall back to casServerUrl syspref
Lines 54-60 if (multipleAuth()) { Link Here
54		55
55	# Is there a configuration file for multiple cas servers?	56	# Is there a configuration file for multiple cas servers?
56	sub multipleAuth {	57	sub multipleAuth {
57	return (-e qq($FindBin::Bin/$yamlauthfile));	58	return (-e qq($yamlauthfile));
58	}	59	}
59		60
60	# Returns configured CAS servers' list if multiple authentication is enabled	61	# Returns configured CAS servers' list if multiple authentication is enabled
Lines 64-86 sub getMultipleAuth { Link Here
64		65
65	# Logout from CAS	66	# Logout from CAS
66	sub logout_cas {	67	sub logout_cas {
67	my ($query) = @_;	68	my ($query, $type) = @_;
68	my ( $cas, $uri ) = _get_cas_and_service($query);	69	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
69	print $query->redirect( $cas->logout_url($uri));	70	print $query->redirect( $cas->logout_url($uri));
70	print $query->redirect( $cas->logout_url(url => $uri));	71	print $query->redirect( $cas->logout_url(url => $uri));
71	}	72	}
72		73
73	# Login to CAS	74	# Login to CAS
74	sub login_cas {	75	sub login_cas {
75	my ($query) = @_;	76	my ($query, $type) = @_;
76	my ( $cas, $uri ) = _get_cas_and_service($query);	77	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
77	print $query->redirect( $cas->login_url($uri));	78	print $query->redirect( $cas->login_url($uri));
78	}	79	}
79		80
80	# Returns CAS login URL with callback to the requesting URL	81	# Returns CAS login URL with callback to the requesting URL
81	sub login_cas_url {	82	sub login_cas_url {
82	my ( $query, $key ) = @_;	83	my ( $query, $key, $type ) = @_;
83	my ( $cas, $uri ) = _get_cas_and_service( $query, $key );	84	my ( $cas, $uri ) = _get_cas_and_service( $query, $key, $type );
84	return $cas->login_url($uri);	85	return $cas->login_url($uri);
85	}	86	}
86		87
Lines 88-96 sub login_cas_url { Link Here
88	# In our case : is there a ticket, is it valid and does it match one of our users ?	89	# In our case : is there a ticket, is it valid and does it match one of our users ?
89	sub checkpw_cas {	90	sub checkpw_cas {
90	$debug and warn "checkpw_cas";	91	$debug and warn "checkpw_cas";
91	my ($dbh, $ticket, $query) = @_;	92	my ($dbh, $ticket, $query, $type) = @_;
92	my $retnumber;	93	my $retnumber;
93	my ( $cas, $uri ) = _get_cas_and_service($query);	94	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
94		95
95	# If we got a ticket	96	# If we got a ticket
96	if ($ticket) {	97	if ($ticket) {
Lines 136-144 sub checkpw_cas { Link Here
136	# Proxy CAS auth	137	# Proxy CAS auth
137	sub check_api_auth_cas {	138	sub check_api_auth_cas {
138	$debug and warn "check_api_auth_cas";	139	$debug and warn "check_api_auth_cas";
139	my ($dbh, $PT, $query) = @_;	140	my ($dbh, $PT, $query, $type) = @_;
140	my $retnumber;	141	my $retnumber;
141	my ( $cas, $uri ) = _get_cas_and_service($query);	142	my ( $cas, $uri ) = _get_cas_and_service($query, undef, $type);
142		143
143	# If we have a Proxy Ticket	144	# If we have a Proxy Ticket
144	if ($PT) {	145	if ($PT) {
Lines 184-191 sub check_api_auth_cas { Link Here
184	sub _get_cas_and_service {	185	sub _get_cas_and_service {
185	my $query = shift;	186	my $query = shift;
186	my $key = shift; # optional	187	my $key = shift; # optional
		188	my $type = shift;
187		189
188	my $uri = _url_with_get_params($query);	190	my $uri = _url_with_get_params($query, $type);
189		191
190	my $casparam = $defaultcasserver;	192	my $casparam = $defaultcasserver;
191	$casparam = $query->param('cas') if defined $query->param('cas');	193	$casparam = $query->param('cas') if defined $query->param('cas');
Lines 199-206 sub _get_cas_and_service { Link Here
199	# This method replaces $query->url() which will give both GET and POST params	201	# This method replaces $query->url() which will give both GET and POST params
200	sub _url_with_get_params {	202	sub _url_with_get_params {
201	my $query = shift;	203	my $query = shift;
		204	my $type = shift;
		205
		206	my $uri_base_part = ($type eq 'opac') ?
		207	C4::Context->preference('OPACBaseURL') . $query->script_name():
		208	C4::Context->preference('staffClientBaseURL');
202		209
203	my $uri_base_part = C4::Context->preference('OPACBaseURL') . $query->script_name();
204	my $uri_params_part = '';	210	my $uri_params_part = '';
205	foreach ( $query->url_param() ) {	211	foreach ( $query->url_param() ) {
206	# url_param() always returns parameters that were deleted by delete()	212	# url_param() always returns parameters that were deleted by delete()

Lines 68-78 Link Here

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-1 / +23 lines)
68		68
69	<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>	69	<p class="submit"><input id="submit" type="submit" value="Login" tabindex="4" /></p>
70	</form>	70	</form>
		71	[% IF ( casAuthentication ) %]
		72	<h4>Cas login</h4>
		73
		74	[% IF ( invalidCasLogin ) %]
		75	<!-- This is what is displayed if cas login has failed -->
		76	<p>Sorry, the CAS login failed.</p>
		77	[% END %]
		78
		79	<p>If you have a <acronym title="Central Authentication Service">CAS</acronym> account,
		80	[% IF ( casServerUrl ) %]
		81	please <a href="[% casServerUrl %]">click here to login</a>.<p>
		82	[% END %]
		83
		84	[% IF ( casServersLoop ) %]
		85	please choose against which one you would like to authenticate: </p>
		86	<ul>
		87	[% FOREACH casServer IN casServersLoop %]
		88	<li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
		89	[% END %]
		90	[% END %]
		91	[% END %]
		92
71	[% IF ( nopermission ) %]	93	[% IF ( nopermission ) %]
72	<p><a href="javascript:window.history.back()">[Previous page]</a>	94	<p><a href="javascript:window.history.back()">[Previous page]</a>
73	<a href="/">[Main page]</a></p>	95	<a href="/">[Main page]</a></p>
74	[% END %]	96	[% END %]
75		97
		98
76	<!--<ul> -->	99	<!--<ul> -->
77	<!-- <li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->	100	<!-- <li><a href="/cgi-bin/koha/lostpassword.pl" title="Password lost and found">Lost your password?</a></li> -->
78	<!-- </ul> -->	101	<!-- </ul> -->
79	-