Bugzilla – Attachment 189241 Details for
Bug 39224
Move Shibboleth config from koha-conf to the DB
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication
Bug-39224-replace-deprecated-shibboleth-sysprefs-w.patch (text/plain), 16.91 KB, created by
Jacob O'Mara
on 2025-11-06 22:12:00 UTC
(
hide
)
Description:
Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication
Filename:
MIME Type:
Creator:
Jacob O'Mara
Created:
2025-11-06 22:12:00 UTC
Size:
16.91 KB
patch
obsolete
>From 3ec16b07e38cfc9f93bb182a1ede02ea46381389 Mon Sep 17 00:00:00 2001 >From: Jacob O'Mara <Jacob.omara@openfifth.co.uk> >Date: Tue, 4 Nov 2025 15:22:22 +0000 >Subject: [PATCH] Bug 39224: replace deprecated shibboleth sysprefs with > ShibbolethAuthentication > >- Remove OPACShibOnly and staffShibOnly sysprefs (now in >shibboleth_config table) >- Add ShibbolethAuthentication syspref to replace useshibboleth XML >config >- Update to check syspref instead of XML >- Only show Shibboleth configuration link when ShibbolethAuthentication >is enabled >--- > C4/Auth.pm | 9 ++++++--- > installer/data/mysql/mandatory/sysprefs.sql | 3 +-- > koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc | 2 +- > .../intranet-tmpl/prog/en/modules/admin/admin-home.tt | 4 ++++ > .../prog/en/modules/admin/preferences/admin.pref | 9 +++++++++ > .../prog/en/modules/admin/preferences/opac.pref | 6 ------ > .../en/modules/admin/preferences/staff_interface.pref | 8 +------- > koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc | 4 ++-- > koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 8 ++++---- > opac/opac-user.pl | 2 +- > 10 files changed, 29 insertions(+), 26 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 9bd841eec06..3a49df795b0 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -197,7 +197,7 @@ sub get_template_and_user { > my $cookie_mgr = Koha::CookieManager->new; > > # Get shibboleth login attribute >- my $shib = C4::Context->config('useshibboleth') && shib_ok(); >+ my $shib = C4::Context->preference('ShibbolethAuthentication') && shib_ok(); > my $shib_login = $shib ? get_login_shib() : undef; > > C4::Context->interface( $in->{type} ); >@@ -448,6 +448,7 @@ sub get_template_and_user { > $template->param( > shibbolethAuthentication => $shib, > shibbolethLoginUrl => login_shib_url( $in->{'query'} ), >+ shibbolethOnly => get_force_sso_setting( $in->{'type'} ), > ); > > # If shibboleth is enabled and we have a shibboleth login attribute, >@@ -843,7 +844,7 @@ sub checkauth { > my $query = shift; > > # Get shibboleth login attribute >- my $shib = C4::Context->config('useshibboleth') && shib_ok(); >+ my $shib = C4::Context->preference('ShibbolethAuthentication') && shib_ok(); > my $shib_login = $shib ? get_login_shib() : undef; > > # $authnotrequired will be set for scripts which will run without authentication >@@ -1492,6 +1493,7 @@ sub checkauth { > script_name => get_script_name(), > casAuthentication => C4::Context->preference("casAuthentication"), > shibbolethAuthentication => $shib, >+ shibbolethOnly => get_force_sso_setting($type), > suggestion => C4::Context->preference("suggestion"), > virtualshelves => C4::Context->preference("virtualshelves"), > LibraryName => "" . C4::Context->preference("LibraryName"), >@@ -1589,6 +1591,7 @@ sub checkauth { > $template->param( > shibbolethAuthentication => $shib, > shibbolethLoginUrl => login_shib_url($query), >+ shibbolethOnly => get_force_sso_setting($type), > ); > } > >@@ -2060,7 +2063,7 @@ sub checkpw { > $type = 'opac' unless $type; > > # Get shibboleth login attribute >- my $shib = C4::Context->config('useshibboleth') && shib_ok(); >+ my $shib = C4::Context->preference('ShibbolethAuthentication') && shib_ok(); > my $shib_login = $shib ? get_login_shib() : undef; > > my $anonymous_patron = C4::Context->preference('AnonymousPatron'); >diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql >index b47f27df977..4387a4e5fe6 100644 >--- a/installer/data/mysql/mandatory/sysprefs.sql >+++ b/installer/data/mysql/mandatory/sysprefs.sql >@@ -567,7 +567,6 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` > ('opacSerialDefaultTab','subscriptions','holdings|serialcollection|subscriptions|titlenotes','Define the default tab for serials in OPAC.','Choice'), > ('OPACSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the OPAC','Integer'), > ('OPACShelfBrowser','1','','Enable/disable Shelf Browser on item details page. WARNING: this feature is very resource consuming on collections with large numbers of items.','YesNo'), >-('OPACShibOnly','0','','If ON enables shibboleth only authentication for the opac','YesNo'), > ('OPACShowCheckoutName','0','','Displays in the OPAC the name of patron who has checked out the material. WARNING: Most sites should leave this off. It is intended for corporate or special sites which need to track who has the item.','YesNo'), > ('OPACShowHoldQueueDetails','none','none|priority|holds|holds_priority','Show holds details in OPAC','Choice'), > ('OPACShowLibraries', '1', '', 'If enabled, a link is shown in the OPAC pointing to a page with library information', 'YesNo'), >@@ -745,6 +744,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` > ('ShelfBrowserUsesCcode','1','0','Use the item collection code when finding items for the shelf browser.','YesNo'), > ('ShelfBrowserUsesHomeBranch','1','1','Use the item home branch when finding items for the shelf browser.','YesNo'), > ('ShelfBrowserUsesLocation','1','1','Use the item location when finding items for the shelf browser.','YesNo'), >+('ShibbolethAuthentication','0','','Enable or disable Shibboleth authentication integration','YesNo'), > ('ShowAllCheckins', '0', '', 'Show all checkins', 'YesNo'), > ('ShowComponentRecords', 'nowhere', 'nowhere|staff|opac|both','In which record detail pages to show list of the component records, as linked via 773','Choice'), > ('ShowHeadingUse', '0', NULL, 'Show whether MARC21 authority record contains an established heading that conforms to descriptive cataloguing rules, and can therefore be used as a main/added entry, or subject, or series title', 'YesNo'), >@@ -776,7 +776,6 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` > ('StaffLoginRestrictLibraryByIP','0',NULL,'If ON, IP authentication is enabled, blocking access to the staff interface from unauthorized IP addresses based on branch','YesNo'), > ('StaffSearchResultsDisplayBranch','holdingbranch','holdingbranch|homebranch','Controls the display of the home or holding branch for staff search results','Choice'), > ('StaffSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the staff interface','Integer'), >-('staffShibOnly','0','','If ON enables shibboleth only authentication for the staff client','YesNo'), > ('StaticHoldsQueueWeight','0',NULL,'Specify a list of library location codes separated by commas -- the list of codes will be traversed and weighted with first values given higher weight for holds fulfillment -- alternatively, if RandomizeHoldsQueueWeight is set, the list will be randomly selective','Integer'), > ('StatisticsFields','location|itype|ccode', NULL, 'Define Fields (from the items table) used for statistics members','Free'), > ('StockRotation','0',NULL,'If ON, enables the stock rotation module','YesNo'), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc >index 7d7e710d060..2116d9b645d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc >@@ -40,7 +40,7 @@ > <li><a href="/cgi-bin/koha/admin/branch_transfer_limits.pl">Library transfer limits</a></li> > <li><a href="/cgi-bin/koha/admin/transport-cost-matrix.pl">Transport cost matrix</a></li> > [% END %] >- [% IF ( CAN_user_parameters_manage_identity_providers ) %] >+ [% IF ( CAN_user_parameters_manage_identity_providers && Koha.Preference('ShibbolethAuthentication') ) %] > <li><a href="/cgi-bin/koha/shibboleth/shibboleth.pl">Shibboleth configuration</a></li> > [% END %] > [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt >index bf92a4c1f8c..9d2d6dfe7c1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt >@@ -109,6 +109,10 @@ > <dt><a href="/cgi-bin/koha/admin/transport-cost-matrix.pl">Transport cost matrix</a></dt> > <dd>Define transport costs between branches</dd> > [% END %] >+ [% IF ( CAN_user_parameters_manage_identity_providers && Koha.Preference('ShibbolethAuthentication') ) %] >+ <dt><a href="/cgi-bin/koha/shibboleth/shibboleth.pl">Shibboleth configuration</a></dt> >+ <dd>Configure Shibboleth authentication settings, field mappings, and SSO options</dd> >+ [% END %] > [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %] > <dt><a href="/cgi-bin/koha/admin/item_circulation_alerts.pl">Item circulation alerts</a></dt> > <dd>Define rules for check-in and checkout notifications for combinations of libraries, patron categories, and item types</dd> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref >index eac9b14907b..23f3b715c18 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref >@@ -155,6 +155,15 @@ Administration: > 0: "Don't force" > - "library selection when logging into the staff interface." > >+ Shibboleth authentication: >+ - >+ - "Use Shibboleth for login authentication: " >+ - pref: ShibbolethAuthentication >+ default: 0 >+ choices: >+ 1: "Yes" >+ 0: "No" >+ > CAS authentication: > - > - "Use CAS for login authentication: " >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref >index 8b4769c17e2..cf3e178279d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref >@@ -1015,9 +1015,3 @@ OPAC: > - "fields (separate values with |). Tabs appear in the order listed.<br/>" > - "<em>Currently supported values</em>: Item types (<strong>itemtypes</strong>), Collection, (<strong>ccode</strong>) and Shelving location (<strong>loc</strong>)." > Authentication: >- - >- - pref: OPACShibOnly >- choices: >- 1: "Don't allow" >- 0: Allow >- - patrons to login by means other than Shibboleth. >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref >index 8dd0817a3a8..cadf43ccb97 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref >@@ -204,16 +204,10 @@ Staff interface: > - 'records when downloading from the reports module.<br>NOTE: Only a positive value will enforce a limit. A specific limit in the report overrides this setting.' > > Authentication: >- - >- - pref: staffShibOnly >- choices: >- 1: "Don't allow" >- 0: Allow >- - staff to login by means other than shibboleth. > - > - pref: TwoFactorAuthentication > choices: > "enforced": Enforce > "enabled": Enable > "disabled": "Don't enable" >- - two-factor authentication (2FA) for staff members. >\ No newline at end of file >+ - two-factor authentication (2FA) for staff members. >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >index c136dfeb29a..98b6935f947 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >@@ -135,8 +135,8 @@ > </a> > <a tabindex="0" role="menuitem" class="logout js-hide" href="/cgi-bin/koha/opac-main.pl?logout.x=1"><i class="fa fa-fw fa-sign-out" aria-hidden="true"></i> Log out</a> > [% ELSE %] >- [% IF Koha.Preference('casAuthentication') %] >- [%# CAS authentication is too complicated for modal window %] >+ [% IF Koha.Preference('casAuthentication') || shibbolethOnly %] >+ [%# CAS authentication and Shibboleth force SSO are too complicated for modal window %] > <a class="nav-link login-link" href="/cgi-bin/koha/opac-user.pl" aria-label="Log in to your account" > ><i class="fa fa-user fa-icon-black fa-fw" aria-hidden="true"></i> <span class="userlabel">Log in to your account</span></a > > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 6d6c135cc1a..be5f6c8fcd5 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -97,7 +97,7 @@ > <!-- This is what is displayed if shibboleth login has failed to match a koha user --> > <div class="alert alert-info"> > <p aria-live="assertive" role="alert" class="shib_invalid">Sorry, your Shibboleth identity does not match a valid library identity.</p> >- [% UNLESS ( Koha.Preference('OPACShibOnly') ) %] >+ [% UNLESS ( shibbolethOnly ) %] > [% IF ( casAuthentication ) %] > [% IF ( invalidCasLogin ) %] > <!-- This is what is displayed if cas login has failed --> >@@ -114,7 +114,7 @@ > <h2 class="shib_title">Shibboleth login</h2> > <p><a class="shib_url" href="[% shibbolethLoginUrl | $raw %]">Log in using a Shibboleth account.</a></p> > [% END # /IF invalidShibLogin %] >- [% UNLESS ( Koha.Preference('OPACShibOnly') ) %] >+ [% UNLESS ( shibbolethOnly ) %] > [% IF ( casAuthentication ) %] > <h2 class="cas_title">CAS login</h2> > <p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p> >@@ -125,7 +125,7 @@ > [% END %] > [% END # /IF shibbolethAuthentication %] > >- [% UNLESS ( Koha.Preference('OPACShibOnly') ) %] >+ [% UNLESS ( shibbolethOnly ) %] > [% IF ( casAuthentication ) %] > [% IF ( shibbolethAuthentication ) %] > [% IF ( casServerUrl ) %] >@@ -227,7 +227,7 @@ > [% ELSE %] > <p>You must contact the library to reset your password</p> > [% END %] >- [% ELSIF !Koha.Preference('OPACShibOnly') or SCO_login or SCI_login %] >+ [% ELSIF !shibbolethOnly or SCO_login or SCI_login %] > [% SET form_action = script_name %] > [% IF SCO_login %] > [% form_action = "/cgi-bin/koha/sco/sco-main.pl" %] >diff --git a/opac/opac-user.pl b/opac/opac-user.pl >index e0671b33aa5..d12d14643b8 100755 >--- a/opac/opac-user.pl >+++ b/opac/opac-user.pl >@@ -82,7 +82,7 @@ for ( C4::Context->preference("OPACShowHoldQueueDetails") ) { > my $patronupdate = $query->param('patronupdate'); > my $canrenew = 1; > >-$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') ); >+$template->param( shibbolethAuthentication => C4::Context->preference('ShibbolethAuthentication') ); > > # get borrower information .... > my $patron = Koha::Patrons->find($borrowernumber); >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 39224
:
189234
|
189235
|
189236
|
189237
|
189238
|
189239
|
189240
| 189241 |
189242
|
189243
|
189244