Lines 46-54
use LWP::UserAgent;
Link Here
|
46 |
use HTTP::Request::Common qw{ POST }; |
46 |
use HTTP::Request::Common qw{ POST }; |
47 |
use JSON; |
47 |
use JSON; |
48 |
|
48 |
|
49 |
my $scope = "openid email"; |
49 |
my $scope = 'openid email'; |
50 |
my $host = C4::Context->preference('OPACBaseURL') // ''; |
50 |
my $host = C4::Context->preference('OPACBaseURL') // q{}; |
51 |
my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain') // ''; |
51 |
my $restricttodomain = C4::Context->preference('GoogleOAuth2Domain') // q{}; |
52 |
|
52 |
|
53 |
# protocol is assumed in OPACBaseURL see bug 5010. |
53 |
# protocol is assumed in OPACBaseURL see bug 5010. |
54 |
my $redirecturl = $host . '/cgi-bin/koha/svc/auth/googleoauth2'; |
54 |
my $redirecturl = $host . '/cgi-bin/koha/svc/auth/googleoauth2'; |
Lines 56-80
my $issuer = 'accounts.google.com';
Link Here
|
56 |
my $clientid = C4::Context->preference('GoogleOAuth2ClientID'); |
56 |
my $clientid = C4::Context->preference('GoogleOAuth2ClientID'); |
57 |
my $clientsecret = C4::Context->preference('GoogleOAuth2ClientSecret'); |
57 |
my $clientsecret = C4::Context->preference('GoogleOAuth2ClientSecret'); |
58 |
|
58 |
|
59 |
my $query = new CGI; |
59 |
my $query = CGI->new; |
60 |
|
60 |
|
61 |
sub loginfailed { |
61 |
sub loginfailed { |
62 |
my $query = shift; |
62 |
my $cgi_query = shift; |
63 |
my $reason = shift; |
63 |
my $reason = shift; |
64 |
$query->delete('code'); |
64 |
$cgi_query->delete('code'); |
65 |
$query->param( 'OAuth2Failed' => $reason ); |
65 |
$cgi_query->param( 'OAuth2Failed' => $reason ); |
66 |
my ( $template, $borrowernumber, $cookie ) = get_template_and_user( |
66 |
my ( $template, $borrowernumber, $cookie ) = get_template_and_user( |
67 |
{ |
67 |
{ |
68 |
template_name => 'opac-user.tt', |
68 |
template_name => 'opac-user.tt', |
69 |
query => $query, |
69 |
query => $cgi_query, |
70 |
type => 'opac', |
70 |
type => 'opac', |
71 |
authnotrequired => 0, |
71 |
authnotrequired => 0, |
72 |
flagsrequired => { borrow => 1 }, |
|
|
73 |
} |
72 |
} |
74 |
); |
73 |
); |
75 |
$template->param( 'invalidOAuth2Login' => $reason ); |
74 |
$template->param( 'invalidOAuth2Login' => $reason ); |
76 |
$template->param( 'loginprompt' => 1 ); |
75 |
$template->param( 'loginprompt' => 1 ); |
77 |
output_html_with_http_headers $query, $cookie, $template->output; |
76 |
output_html_with_http_headers $cgi_query, $cookie, $template->output; |
|
|
77 |
return; |
78 |
} |
78 |
} |
79 |
|
79 |
|
80 |
if ( defined $query->param('error') ) { |
80 |
if ( defined $query->param('error') ) { |
Lines 94-100
elsif ( defined $query->param('code') ) {
Link Here
|
94 |
client_secret => $clientsecret, |
94 |
client_secret => $clientsecret, |
95 |
redirect_uri => $redirecturl, |
95 |
redirect_uri => $redirecturl, |
96 |
grant_type => 'authorization_code', |
96 |
grant_type => 'authorization_code', |
97 |
$scope => $scope |
97 |
$scope => $scope |
98 |
] |
98 |
] |
99 |
); |
99 |
); |
100 |
my $response = $ua->request($request)->decoded_content; |
100 |
my $response = $ua->request($request)->decoded_content; |
Lines 111-121
elsif ( defined $query->param('code') ) {
Link Here
|
111 |
&& exists( $json->{'email'} ) ) |
111 |
&& exists( $json->{'email'} ) ) |
112 |
{ |
112 |
{ |
113 |
my $email = $json->{'email'}; |
113 |
my $email = $json->{'email'}; |
114 |
my ( $userid, $cookie, $sessionID ) = |
114 |
my ( $userid, $cookie, $session_id ) = |
115 |
checkauth( $query, 1, { borrow => 1 }, 'opac', $email ); |
115 |
checkauth( $query, 1, { }, 'opac', $email ); |
116 |
if ($userid) { # A valid user has logged in |
116 |
if ($userid) { # A valid user has logged in |
117 |
if ( ( $restricttodomain ne '' ) |
117 |
if ( ( $restricttodomain ne q{} ) |
118 |
&& ( index( $email, $restricttodomain ) == -1 ) ) |
118 |
&& ( index( $email, $restricttodomain ) < 0 ) ) |
119 |
{ |
119 |
{ |
120 |
loginfailed( $query, |
120 |
loginfailed( $query, |
121 |
'The email you have used is not valid for this library. Email addresses should conclude with ' |
121 |
'The email you have used is not valid for this library. Email addresses should conclude with ' |
Lines 148-169
elsif ( defined $query->param('code') ) {
Link Here
|
148 |
|
148 |
|
149 |
} |
149 |
} |
150 |
else { |
150 |
else { |
151 |
my $prompt = ''; |
151 |
my $prompt = $query->param('reauthenticate') // q{}; |
152 |
$prompt = $query->param('reauthenticate') |
|
|
153 |
unless not( defined $query->param('reauthenticate') ); |
154 |
|
152 |
|
155 |
my $authorisationurl = |
153 |
my $authorisationurl = |
156 |
'https://accounts.google.com/o/oauth2/auth?' |
154 |
'https://accounts.google.com/o/oauth2/auth?' |
157 |
. 'response_type=code&' |
155 |
. 'response_type=code&' |
158 |
. 'redirect_uri=' |
156 |
. 'redirect_uri=' |
159 |
. escape($redirecturl) . '&' |
157 |
. escape($redirecturl) . q{&} |
160 |
. 'client_id=' |
158 |
. 'client_id=' |
161 |
. escape($clientid) . '&' |
159 |
. escape($clientid) . q{&} |
162 |
. 'scope=' |
160 |
. 'scope=' |
163 |
. escape($scope) . '&'; |
161 |
. escape($scope) . q{&}; |
164 |
if ( $query->param('reauthenticate') ) { |
162 |
if ( $prompt || ( defined $prompt && length $prompt > 0 ) ) { |
165 |
$authorisationurl .= |
163 |
$authorisationurl .= 'prompt=' . escape($prompt); |
166 |
'prompt=' . escape( $query->param('reauthenticate') ); |
|
|
167 |
} |
164 |
} |
168 |
print $query->redirect($authorisationurl); |
165 |
print $query->redirect($authorisationurl); |
169 |
} |
166 |
} |
170 |
- |
|
|