|
Line 0
Link Here
|
|
|
1 |
package C4::Auth_with_sip; |
| 2 |
|
| 3 |
# Copyright 2017 Kyle M Hall |
| 4 |
# |
| 5 |
# This file is part of Koha. |
| 6 |
# |
| 7 |
# Koha is free software; you can redistribute it and/or modify it |
| 8 |
# under the terms of the GNU General Public License as published by |
| 9 |
# the Free Software Foundation; either version 3 of the License, or |
| 10 |
# (at your option) any later version. |
| 11 |
# |
| 12 |
# Koha is distributed in the hope that it will be useful, but |
| 13 |
# WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 |
# GNU General Public License for more details. |
| 16 |
# |
| 17 |
# You should have received a copy of the GNU General Public License |
| 18 |
# along with Koha; if not, see <http://www.gnu.org/licenses>. |
| 19 |
|
| 20 |
use Modern::Perl; |
| 21 |
|
| 22 |
use C4::Context; |
| 23 |
use C4::Members qw(AddMember); |
| 24 |
use C4::Members::Messaging; |
| 25 |
|
| 26 |
use Koha::SIP::Client; |
| 27 |
use Koha::Patrons; |
| 28 |
use Koha::Patron::Categories; |
| 29 |
|
| 30 |
use vars qw( @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS ); |
| 31 |
|
| 32 |
BEGIN { |
| 33 |
require Exporter; |
| 34 |
@ISA = qw(Exporter); |
| 35 |
@EXPORT = qw(checkpw_sip); |
| 36 |
} |
| 37 |
|
| 38 |
my $sip = C4::Context->config("sip_servers") |
| 39 |
or die 'No "sip_servers" in server hash from KOHA_CONF: ' . $ENV{KOHA_CONF}; |
| 40 |
|
| 41 |
my @sip_servers = $sip->{id} ? $sip : map { $sip->{sip_server}->{$_} } |
| 42 |
keys %{ $sip->{sip_server} }; |
| 43 |
|
| 44 |
@sip_servers = sort { $a->{precedence} cmp $b->{precedence} } @sip_servers; |
| 45 |
|
| 46 |
=head1 checkpw_sip |
| 47 |
|
| 48 |
my ( $success, $cardnumber, $userid ) = checkpw_sip( $userid, $password ); |
| 49 |
|
| 50 |
Checks the given user id and password against a set of SIP servers. Returns |
| 51 |
$success if the credentials were verified, along with the cardnumber and userid |
| 52 |
to be used for the patron. |
| 53 |
|
| 54 |
=cut |
| 55 |
|
| 56 |
sub checkpw_sip { |
| 57 |
my ( $userid, $password ) = @_; |
| 58 |
|
| 59 |
my $server = select_server( $userid, \@sip_servers ); |
| 60 |
|
| 61 |
return 0 unless $server; |
| 62 |
|
| 63 |
my $sip_patron; |
| 64 |
$sip_patron = fetch_patron( $userid, $password, $server ); |
| 65 |
|
| 66 |
return 0 |
| 67 |
unless $sip_patron |
| 68 |
&& $sip_patron->{BL} eq 'Y' |
| 69 |
&& $sip_patron->{CQ} eq 'Y'; |
| 70 |
|
| 71 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
| 72 |
|
| 73 |
my $patron_hashref; |
| 74 |
if ( ( $patron && $server->{update} ) |
| 75 |
|| ( !$patron && $server->{replicate} ) ) |
| 76 |
{ |
| 77 |
$patron_hashref = sip_to_koha_patron( $sip_patron, $server, $userid ); |
| 78 |
} |
| 79 |
|
| 80 |
if ($patron) { |
| 81 |
$patron->update_password( $userid, $password ) |
| 82 |
if $server->{update_password}; |
| 83 |
|
| 84 |
if ( $server->{update} ) { # A1, B1 |
| 85 |
$patron->set($patron_hashref); |
| 86 |
$patron->store(); |
| 87 |
} |
| 88 |
else { # C1, D1 |
| 89 |
return ( 1, $patron->cardnumber, $patron->userid ); |
| 90 |
} |
| 91 |
} |
| 92 |
elsif ( $server->{replicate} ) { # A2, C2 |
| 93 |
$patron_hashref->{password} = $password; |
| 94 |
$patron_hashref->{cardnumber} //= $userid; |
| 95 |
|
| 96 |
my $borrowernumber = C4::Members::AddMember(%$patron_hashref) |
| 97 |
or die "AddMember failed"; |
| 98 |
|
| 99 |
C4::Members::Messaging::SetMessagingPreferencesFromDefaults( |
| 100 |
{ |
| 101 |
borrowernumber => $borrowernumber, |
| 102 |
categorycode => $patron_hashref->{categorycode} |
| 103 |
} |
| 104 |
); |
| 105 |
} |
| 106 |
else { |
| 107 |
return 0; # B2, D2 |
| 108 |
} |
| 109 |
} |
| 110 |
|
| 111 |
=head1 sip_to_koha_patron |
| 112 |
|
| 113 |
my $patron_hashref = sip_to_koha_patron( $sip_patron_hashref, $sip_server, $patron_cardnumber ); |
| 114 |
|
| 115 |
Returns a Koha-style patron hashref derived from a SIP patron information response hashref and a server mapping definition. |
| 116 |
|
| 117 |
=cut |
| 118 |
|
| 119 |
sub sip_to_koha_patron { |
| 120 |
my $sip_patron = shift; |
| 121 |
my $server = shift; |
| 122 |
my $cardnumber = shift; |
| 123 |
|
| 124 |
my $patron_hashref = { cardnumber => $cardnumber, userid => $cardnumber }; |
| 125 |
|
| 126 |
my $mapping = $server->{mapping}; |
| 127 |
|
| 128 |
foreach my $key ( keys %$mapping ) { |
| 129 |
my $data = $sip_patron->{ $mapping->{$key}->{is} }; |
| 130 |
unless ( defined $data ) { |
| 131 |
$data = $mapping->{$key}->{content}; |
| 132 |
} |
| 133 |
|
| 134 |
$patron_hashref->{$key} = $data; |
| 135 |
} |
| 136 |
|
| 137 |
# Fall back to default patron category if the supplied one doesn't exit |
| 138 |
my $patron_category = |
| 139 |
Koha::Patron::Categories->find( $patron_hashref->{categorycode} ); |
| 140 |
unless ($patron_category) { |
| 141 |
my $default = $mapping->{categorycode}->{content}; |
| 142 |
$patron_hashref->{categorycode} = $default; |
| 143 |
} |
| 144 |
|
| 145 |
return $patron_hashref; |
| 146 |
} |
| 147 |
|
| 148 |
=head1 sip_message_to_hashref |
| 149 |
|
| 150 |
my $sip_patron_hashref = sip_message_to_hashref( $sip_patron_information_response ); |
| 151 |
|
| 152 |
Converts a raw SIP patron response message to a more useful hashref of fixed and variable fields. |
| 153 |
|
| 154 |
=cut |
| 155 |
|
| 156 |
sub sip_message_to_hashref { |
| 157 |
my ($data) = @_; |
| 158 |
|
| 159 |
my @parts = split( /\|/, $data ); |
| 160 |
|
| 161 |
my $fixed_fields = shift(@parts); |
| 162 |
my $patron_status_field = substr( $fixed_fields, 2, 14 ); |
| 163 |
my $patron_status; |
| 164 |
$patron_status->{charge_privileges_denied} = |
| 165 |
substr( $patron_status_field, 0, 1 ); |
| 166 |
$patron_status->{renewal_privileges_denied} = |
| 167 |
substr( $patron_status_field, 1, 1 ); |
| 168 |
$patron_status->{recall_privileges_denied} = |
| 169 |
substr( $patron_status_field, 2, 1 ); |
| 170 |
$patron_status->{hold_privileges_denied} = |
| 171 |
substr( $patron_status_field, 3, 1 ); |
| 172 |
$patron_status->{card_reported_lost} = substr( $patron_status_field, 4, 1 ); |
| 173 |
$patron_status->{too_many_items_charged} = |
| 174 |
substr( $patron_status_field, 5, 1 ); |
| 175 |
$patron_status->{too_many_items_overdue} = |
| 176 |
substr( $patron_status_field, 6, 1 ); |
| 177 |
$patron_status->{too_many_renewals} = substr( $patron_status_field, 7, 1 ); |
| 178 |
$patron_status->{too_many_claims_of_items_returned} = |
| 179 |
substr( $patron_status_field, 8, 1 ); |
| 180 |
$patron_status->{too_many_items_lost} = |
| 181 |
substr( $patron_status_field, 9, 1 ); |
| 182 |
$patron_status->{excessive_outstanding_fines} = |
| 183 |
substr( $patron_status_field, 10, 1 ); |
| 184 |
$patron_status->{excessive_outstanding_fees} = |
| 185 |
substr( $patron_status_field, 11, 1 ); |
| 186 |
$patron_status->{recall_overdue} = substr( $patron_status_field, 12, 1 ); |
| 187 |
$patron_status->{too_many_items_billed} = |
| 188 |
substr( $patron_status_field, 13, 1 ); |
| 189 |
|
| 190 |
my $hold_items_count = substr( $fixed_fields, 37, 4 ); |
| 191 |
|
| 192 |
pop(@parts); |
| 193 |
|
| 194 |
my %fields = map { substr( $_, 0, 2 ) => substr( $_, 2 ) } @parts; |
| 195 |
$fields{patron_status} = $patron_status; |
| 196 |
$fields{hold_items_count} = $hold_items_count; |
| 197 |
|
| 198 |
return \%fields; |
| 199 |
} |
| 200 |
|
| 201 |
=head1 select_server |
| 202 |
|
| 203 |
my $server = select_server( $userid, \@sip_servers ); |
| 204 |
|
| 205 |
Selects the correct SIP server to be checked for a given userid |
| 206 |
and a set of ordered SIP servers. |
| 207 |
|
| 208 |
=cut |
| 209 |
|
| 210 |
sub select_server { |
| 211 |
my ( $userid, $sip_servers ) = @_; |
| 212 |
|
| 213 |
foreach my $server (@$sip_servers) { |
| 214 |
my $prefix = $server->{prefix}; |
| 215 |
|
| 216 |
# First server without prefix we come across is an automatic match |
| 217 |
return $server unless $prefix; |
| 218 |
|
| 219 |
# If cardnumber starts with the server prefix, we have a match |
| 220 |
my $match = substr( $userid, 0, length($prefix) ) eq $prefix; |
| 221 |
return $server if $match; |
| 222 |
} |
| 223 |
} |
| 224 |
|
| 225 |
=head1 fetch_patron |
| 226 |
|
| 227 |
my $response = fetch_patron( $userid, $password, $server ); |
| 228 |
|
| 229 |
Returns a raw patron information response for a given user id, password, and server. |
| 230 |
|
| 231 |
=cut |
| 232 |
|
| 233 |
sub fetch_patron { |
| 234 |
my ( $userid, $password, $server ) = @_; |
| 235 |
|
| 236 |
my $prefix = $server->{prefix}; |
| 237 |
|
| 238 |
# If a cardnumber prefix is set for this server, strip it off the userid |
| 239 |
if ($prefix) { |
| 240 |
my $prefix_length = length($prefix); |
| 241 |
$userid = substr( $userid, $prefix_length ); |
| 242 |
} |
| 243 |
|
| 244 |
my $host = $server->{host}; |
| 245 |
my $port = $server->{port}; |
| 246 |
my $sip_user = $server->{userid}; |
| 247 |
my $sip_pass = $server->{password}; |
| 248 |
my $location = $server->{location}; |
| 249 |
my $terminator = $server->{terminator}; |
| 250 |
|
| 251 |
# Initial Login |
| 252 |
my $client = Koha::SIP::Client->new( |
| 253 |
{ |
| 254 |
host => $host, # sip server ip |
| 255 |
port => $port, # sip server port |
| 256 |
sip_user => $sip_user, # sip user |
| 257 |
sip_pass => $sip_pass, # sip password |
| 258 |
location => $location, # sip location code |
| 259 |
terminator => $terminator, # CR or CRLF |
| 260 |
} |
| 261 |
); |
| 262 |
|
| 263 |
my $response = $client->send( { message => 'login' } ); |
| 264 |
|
| 265 |
# Incorrect userid/password for SIP server login attempt |
| 266 |
unless ( substr( $response, 0, 3 ) eq '941' ) { |
| 267 |
return -1; |
| 268 |
} |
| 269 |
|
| 270 |
# Patron Information request |
| 271 |
$response = $client->send( |
| 272 |
{ |
| 273 |
message => 'patron_information', |
| 274 |
patron => $userid, |
| 275 |
password => $password, |
| 276 |
} |
| 277 |
); |
| 278 |
|
| 279 |
$response = sip_message_to_hashref($response); |
| 280 |
|
| 281 |
return $response; |
| 282 |
} |
| 283 |
|
| 284 |
1; |
| 285 |
__END__ |
| 286 |
|
| 287 |
=head1 NAME |
| 288 |
|
| 289 |
C4::Auth_with_sip - Authenticates Koha users against external SIP servers |
| 290 |
|
| 291 |
=head1 SYNOPSIS |
| 292 |
|
| 293 |
use C4::Auth_with_sip; |
| 294 |
|
| 295 |
=head1 Configuration |
| 296 |
|
| 297 |
This module is specific to SIP authentication. It requires one or more working external SIP servers. |
| 298 |
|
| 299 |
To use it: |
| 300 |
* Add a sip_servers block in KOHA_CONF |
| 301 |
* Establish field mapping in <mapping> element to map SIP2 field codes to Koha field names |
| 302 |
|
| 303 |
Make sure that ALL required fields are populated by your LDAP database (and mapped in KOHA_CONF). |
| 304 |
|
| 305 |
=head1 KOHA_CONF and field mapping |
| 306 |
|
| 307 |
Example XML stanza for LDAP configuration in KOHA_CONF. |
| 308 |
|
| 309 |
<config> |
| 310 |
<use_sip>1</use_sip> <!-- enables / disables the entire auth by SIP feature --> |
| 311 |
|
| 312 |
<sip_servers> |
| 313 |
<sip_server id="sip_server1"> |
| 314 |
<precedence>1</precedence> <!-- precedence is used to set the order in which sip servers will be checked for use --> |
| 315 |
|
| 316 |
<host>sip.example.com</host> |
| 317 |
<port>6001</port> |
| 318 |
<userid>koha_sip</userid> |
| 319 |
<password>PASSWORD</password> |
| 320 |
<location>LOC</location> |
| 321 |
|
| 322 |
<prefix>MPL</prefix> |
| 323 |
|
| 324 |
<replicate>1</replicate> <!-- add new users from SIP to Koha database --> |
| 325 |
<update>1</update> <!-- update existing users in Koha database --> |
| 326 |
<update_password>1</update_password> <!-- set to 0 if you don't want SIP passwords synced to the local database --> |
| 327 |
|
| 328 |
<mapping> <!-- match koha SQL field names to your SIP field names --> |
| 329 |
<surname is="AE" ></surname> <!-- Set surname to AE, no default --> |
| 330 |
<branchcode is="" >MPL</branchcode> <!-- Set branch code to MPL, always --> |
| 331 |
<categorycode is="PC" >PT</categorycode> <!-- Set patron category to PC, default to PT if not set or invalid --> |
| 332 |
<email is="BE" ></email> <!-- Set email to BE, no default --> |
| 333 |
</mapping> |
| 334 |
</sip_server> |
| 335 |
</sip_servers> |
| 336 |
</config> |
| 337 |
|
| 338 |
The <mapping> subelements establish the relationship between database table columns and SIP fields. |
| 339 |
The element name is the database table column, with the "is" being set to the SIP field name. |
| 340 |
Optionally, any content between the element tags is taken as a default value. |
| 341 |
|
| 342 |
=head1 CONFIGURATION |
| 343 |
|
| 344 |
Once a user has been accepted by the LDAP server, there are several possibilities for how Koha will behave, depending on |
| 345 |
your configuration and the presence of a matching Koha user in your local DB: |
| 346 |
|
| 347 |
LOCAL |
| 348 |
USER |
| 349 |
OPTION UPDATE REPLICATE EXISTS? RESULT |
| 350 |
A1 1 1 1 OK : We're updating them anyway. |
| 351 |
A2 1 1 0 OK : We're adding them anyway. |
| 352 |
B1 1 0 1 OK : We update them. |
| 353 |
B2 1 0 0 FAIL: We cannot add new user. |
| 354 |
C1 0 1 1 OK : We do nothing. (Except possibly update password) |
| 355 |
C2 0 1 0 OK : We add the new user. |
| 356 |
D1 0 0 1 OK : We do nothing. (Except possibly update password) |
| 357 |
D2 0 0 0 FAIL: We cannot add new user. |
| 358 |
|
| 359 |
Note: failure here just means that Koha will fallback to checking the local DB. That is, a given user could login with |
| 360 |
their SIP password OR their local one. If this is a problem, then you should enable update and supply a mapping for |
| 361 |
password. Then the local value will be updated at successful LDAP login and the passwords will be synced. |
| 362 |
|
| 363 |
If you choose NOT to update local users, the borrowers table will not be affected at all. |
| 364 |
Note that this means that patron passwords may appear to change if LDAP is ever disabled, because |
| 365 |
the local table never contained the SIP values. |
| 366 |
|
| 367 |
=head2 replicate |
| 368 |
|
| 369 |
If this tag is set to true, then the patron record in Koha will be created based on the recieved |
| 370 |
values from the SIP server if the patron does not exists in the database already. |
| 371 |
|
| 372 |
=head2 update |
| 373 |
|
| 374 |
If this tag is set to true, then the patron record in Koha will be updated based on the |
| 375 |
values recieved from the SIP server if a matching patron already exists. |
| 376 |
|
| 377 |
=head2 update_password |
| 378 |
|
| 379 |
If this tag is set to a true value, then the user's SIP password |
| 380 |
will be stored (hashed) in the local Koha database. If you don't want this |
| 381 |
to happen, then set the value of this to '0'. Note that if passwords are not |
| 382 |
stored locally, and the connection to the SIP server fails, then the users |
| 383 |
will not be able to log in at all. |
| 384 |
|
| 385 |
This option works independently of 'update' and 'replicate'. |
| 386 |
|
| 387 |
=cut |