|
Lines 745-751
sub _timeout_syspref {
Link Here
|
| 745 |
sub checkauth { |
745 |
sub checkauth { |
| 746 |
my $query = shift; |
746 |
my $query = shift; |
| 747 |
$debug and warn "Checking Auth"; |
747 |
$debug and warn "Checking Auth"; |
| 748 |
|
|
|
| 749 |
# $authnotrequired will be set for scripts which will run without authentication |
748 |
# $authnotrequired will be set for scripts which will run without authentication |
| 750 |
my $authnotrequired = shift; |
749 |
my $authnotrequired = shift; |
| 751 |
my $flagsrequired = shift; |
750 |
my $flagsrequired = shift; |
|
Lines 765-771
sub checkauth {
Link Here
|
| 765 |
my $logout = $query->param('logout.x'); |
764 |
my $logout = $query->param('logout.x'); |
| 766 |
|
765 |
|
| 767 |
my $anon_search_history; |
766 |
my $anon_search_history; |
| 768 |
|
767 |
my $cas_ticket = ''; |
| 769 |
# This parameter is the name of the CAS server we want to authenticate against, |
768 |
# This parameter is the name of the CAS server we want to authenticate against, |
| 770 |
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml |
769 |
# when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml |
| 771 |
my $casparam = $query->param('cas'); |
770 |
my $casparam = $query->param('cas'); |
|
Lines 903-910
sub checkauth {
Link Here
|
| 903 |
} |
902 |
} |
| 904 |
} |
903 |
} |
| 905 |
} |
904 |
} |
|
|
905 |
elsif ($logout && $cas) { |
| 906 |
# We got a cas single logout request from a cas server; |
| 907 |
my $ticket = $query->param('cas_ticket'); |
| 908 |
# We've been called as part of the single logout destroy the session associated with the cas ticket |
| 909 |
my $storage_method = C4::Context->preference('SessionStorage'); |
| 910 |
my $dsn; |
| 911 |
my $dsn_options; |
| 912 |
# shift this to a function make get_session use the function too |
| 913 |
my $dbh = C4::Context->dbh; |
| 914 |
if ( $storage_method eq 'mysql' ) { |
| 915 |
$dsn = "driver:MySQL;serializer:yaml;id:md5"; |
| 916 |
$dsn_options = { Handle => $dbh }; |
| 917 |
} |
| 918 |
elsif ( $storage_method eq 'Pg' ) { |
| 919 |
$dsn = "driver:PostgreSQL;serializer:yaml;id:md5"; |
| 920 |
$dsn_options = { Handle => $dbh }; |
| 921 |
} |
| 922 |
elsif ( $storage_method eq 'memcached' && Koha::Caches->get_instance->memcached_cache ) { |
| 923 |
$dsn = "driver:memcached;serializer:yaml;id:md5"; |
| 924 |
my $memcached = Koha::Caches->get_instance()->memcached_cache; |
| 925 |
$dsn_options = { Memcached => $memcached }; |
| 926 |
} |
| 927 |
else { |
| 928 |
$dsn = "driver:File;serializer:yaml;id:md5"; |
| 929 |
my $dir = File::Spec->tmpdir; |
| 930 |
my $instance = C4::Context->config( 'database' ); #actually for packages not exactly the instance name, but generally safer to leave it as it is |
| 931 |
$dsn_options = { Directory => "$dir/cgisess_$instance" }; |
| 932 |
} |
| 933 |
my $success = CGI::Session->find( $dsn, sub {delete_cas_session(@_, $ticket)}, $dsn_options ); |
| 934 |
sub delete_cas_session { |
| 935 |
my $session = shift; |
| 936 |
my $ticket = shift; |
| 937 |
if ($session->param('cas_ticket') && $session->param('cas_ticket') eq $ticket ) { |
| 938 |
$session->delete; |
| 939 |
$session->flush; |
| 940 |
} |
| 941 |
} |
| 942 |
} |
| 906 |
unless ( $userid || $sessionID ) { |
943 |
unless ( $userid || $sessionID ) { |
| 907 |
|
|
|
| 908 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
944 |
#we initiate a session prior to checking for a username to allow for anonymous sessions... |
| 909 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
945 |
my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; |
| 910 |
|
946 |
|
|
Lines 935-941
sub checkauth {
Link Here
|
| 935 |
{ |
971 |
{ |
| 936 |
my $password = $query->param('password'); |
972 |
my $password = $query->param('password'); |
| 937 |
my $shibSuccess = 0; |
973 |
my $shibSuccess = 0; |
| 938 |
|
|
|
| 939 |
my ( $return, $cardnumber ); |
974 |
my ( $return, $cardnumber ); |
| 940 |
|
975 |
|
| 941 |
# If shib is enabled and we have a shib login, does the login match a valid koha user |
976 |
# If shib is enabled and we have a shib login, does the login match a valid koha user |
|
Lines 953-959
sub checkauth {
Link Here
|
| 953 |
unless ($shibSuccess) { |
988 |
unless ($shibSuccess) { |
| 954 |
if ( $cas && $query->param('ticket') ) { |
989 |
if ( $cas && $query->param('ticket') ) { |
| 955 |
my $retuserid; |
990 |
my $retuserid; |
| 956 |
( $return, $cardnumber, $retuserid ) = |
991 |
( $return, $cardnumber, $retuserid, $cas_ticket ) = |
| 957 |
checkpw( $dbh, $userid, $password, $query, $type ); |
992 |
checkpw( $dbh, $userid, $password, $query, $type ); |
| 958 |
$userid = $retuserid; |
993 |
$userid = $retuserid; |
| 959 |
$info{'invalidCasLogin'} = 1 unless ($return); |
994 |
$info{'invalidCasLogin'} = 1 unless ($return); |
|
Lines 1013-1019
sub checkauth {
Link Here
|
| 1013 |
} |
1048 |
} |
| 1014 |
else { |
1049 |
else { |
| 1015 |
my $retuserid; |
1050 |
my $retuserid; |
| 1016 |
( $return, $cardnumber, $retuserid ) = |
1051 |
( $return, $cardnumber, $retuserid, $cas_ticket ) = |
| 1017 |
checkpw( $dbh, $q_userid, $password, $query, $type ); |
1052 |
checkpw( $dbh, $q_userid, $password, $query, $type ); |
| 1018 |
$userid = $retuserid if ($retuserid); |
1053 |
$userid = $retuserid if ($retuserid); |
| 1019 |
$info{'invalid_username_or_password'} = 1 unless ($return); |
1054 |
$info{'invalid_username_or_password'} = 1 unless ($return); |
|
Lines 1139-1144
sub checkauth {
Link Here
|
| 1139 |
$session->param( 'ip', $session->remote_addr() ); |
1174 |
$session->param( 'ip', $session->remote_addr() ); |
| 1140 |
$session->param( 'lasttime', time() ); |
1175 |
$session->param( 'lasttime', time() ); |
| 1141 |
} |
1176 |
} |
|
|
1177 |
$session->param('cas_ticket', $cas_ticket) if $cas_ticket; |
| 1142 |
C4::Context->set_userenv( |
1178 |
C4::Context->set_userenv( |
| 1143 |
$session->param('number'), $session->param('id'), |
1179 |
$session->param('number'), $session->param('id'), |
| 1144 |
$session->param('cardnumber'), $session->param('firstname'), |
1180 |
$session->param('cardnumber'), $session->param('firstname'), |
|
Lines 1370-1378
Possible return values in C<$status> are:
Link Here
|
| 1370 |
=cut |
1406 |
=cut |
| 1371 |
|
1407 |
|
| 1372 |
sub check_api_auth { |
1408 |
sub check_api_auth { |
|
|
1409 |
|
| 1373 |
my $query = shift; |
1410 |
my $query = shift; |
| 1374 |
my $flagsrequired = shift; |
1411 |
my $flagsrequired = shift; |
| 1375 |
|
|
|
| 1376 |
my $dbh = C4::Context->dbh; |
1412 |
my $dbh = C4::Context->dbh; |
| 1377 |
my $timeout = _timeout_syspref(); |
1413 |
my $timeout = _timeout_syspref(); |
| 1378 |
|
1414 |
|
|
Lines 1466-1472
sub check_api_auth {
Link Here
|
| 1466 |
# new login |
1502 |
# new login |
| 1467 |
my $userid = $query->param('userid'); |
1503 |
my $userid = $query->param('userid'); |
| 1468 |
my $password = $query->param('password'); |
1504 |
my $password = $query->param('password'); |
| 1469 |
my ( $return, $cardnumber ); |
1505 |
my ( $return, $cardnumber, $cas_ticket ); |
| 1470 |
|
1506 |
|
| 1471 |
# Proxy CAS auth |
1507 |
# Proxy CAS auth |
| 1472 |
if ( $cas && $query->param('PT') ) { |
1508 |
if ( $cas && $query->param('PT') ) { |
|
Lines 1475-1481
sub check_api_auth {
Link Here
|
| 1475 |
|
1511 |
|
| 1476 |
# In case of a CAS authentication, we use the ticket instead of the password |
1512 |
# In case of a CAS authentication, we use the ticket instead of the password |
| 1477 |
my $PT = $query->param('PT'); |
1513 |
my $PT = $query->param('PT'); |
| 1478 |
( $return, $cardnumber, $userid ) = check_api_auth_cas( $dbh, $PT, $query ); # EXTERNAL AUTH |
1514 |
( $return, $cardnumber, $userid, $cas_ticket ) = check_api_auth_cas( $dbh, $PT, $query ); # EXTERNAL AUTH |
| 1479 |
} else { |
1515 |
} else { |
| 1480 |
|
1516 |
|
| 1481 |
# User / password auth |
1517 |
# User / password auth |
|
Lines 1484-1490
sub check_api_auth {
Link Here
|
| 1484 |
# caller did something wrong, fail the authenticateion |
1520 |
# caller did something wrong, fail the authenticateion |
| 1485 |
return ( "failed", undef, undef ); |
1521 |
return ( "failed", undef, undef ); |
| 1486 |
} |
1522 |
} |
| 1487 |
( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query ); |
1523 |
my $newuserid; |
|
|
1524 |
( $return, $cardnumber, $newuserid, $cas_ticket ) = checkpw( $dbh, $userid, $password, $query ); |
| 1488 |
} |
1525 |
} |
| 1489 |
|
1526 |
|
| 1490 |
if ( $return and haspermission( $userid, $flagsrequired ) ) { |
1527 |
if ( $return and haspermission( $userid, $flagsrequired ) ) { |
|
Lines 1582-1587
sub check_api_auth {
Link Here
|
| 1582 |
$session->param( 'ip', $session->remote_addr() ); |
1619 |
$session->param( 'ip', $session->remote_addr() ); |
| 1583 |
$session->param( 'lasttime', time() ); |
1620 |
$session->param( 'lasttime', time() ); |
| 1584 |
} |
1621 |
} |
|
|
1622 |
$session->param( 'cas_ticket', $cas_ticket); |
| 1585 |
C4::Context->set_userenv( |
1623 |
C4::Context->set_userenv( |
| 1586 |
$session->param('number'), $session->param('id'), |
1624 |
$session->param('number'), $session->param('id'), |
| 1587 |
$session->param('cardnumber'), $session->param('firstname'), |
1625 |
$session->param('cardnumber'), $session->param('firstname'), |
|
Lines 1788-1796
sub checkpw {
Link Here
|
| 1788 |
# In case of a CAS authentication, we use the ticket instead of the password |
1826 |
# In case of a CAS authentication, we use the ticket instead of the password |
| 1789 |
my $ticket = $query->param('ticket'); |
1827 |
my $ticket = $query->param('ticket'); |
| 1790 |
$query->delete('ticket'); # remove ticket to come back to original URL |
1828 |
$query->delete('ticket'); # remove ticket to come back to original URL |
| 1791 |
my ( $retval, $retcard, $retuserid ) = checkpw_cas( $dbh, $ticket, $query, $type ); # EXTERNAL AUTH |
1829 |
my ( $retval, $retcard, $retuserid, $cas_ticket ) = checkpw_cas( $dbh, $ticket, $query, $type ); # EXTERNAL AUTH |
| 1792 |
if ( $retval ) { |
1830 |
if ( $retval ) { |
| 1793 |
@return = ( $retval, $retcard, $retuserid ); |
1831 |
@return = ( $retval, $retcard, $retuserid, $cas_ticket ); |
|
|
1832 |
} else { |
| 1833 |
@return = (0); |
| 1794 |
} |
1834 |
} |
| 1795 |
$passwd_ok = $retval; |
1835 |
$passwd_ok = $retval; |
| 1796 |
} |
1836 |
} |