Bugzilla – Attachment 25765 Details for
Bug 8446
Shibboleth authentication
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
MT8122: Adds Shibboleth authentication
MT8122-Adds-Shibboleth-authentication.patch (text/plain), 16.21 KB, created by
Martin Renvoize (ashimema)
on 2014-03-03 14:00:21 UTC
(
hide
)
Description:
MT8122: Adds Shibboleth authentication
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2014-03-03 14:00:21 UTC
Size:
16.21 KB
patch
obsolete
>From d63f49dfba11daa90041a5ac317a7b5139026da2 Mon Sep 17 00:00:00 2001 >From: Matthias Meusburger <matthias.meusburger@biblibre.com> >Date: Wed, 15 Feb 2012 14:57:02 +0100 >Subject: [PATCH] MT8122: Adds Shibboleth authentication > > - Use the shibbolethAuthentication syspref to enable Shibboleth authentication > - Configure the shibbolethLoginAttribute to specify which shibboleth user > attribute matches the koha login > - Make sure the OPACBaseURL is correctly set > >MT8122, Follow-up: Adds Shibboleth authentication > > - Fix logout bug: shibboleth logout now occurs only when > the session is a shibboleth one. > - Do some refactoring: getting shibboleth username is now > done in C4::Auth_with_Shibboleth.pm (get_login_shib function) > >MT8122, Follow-up: Adds Shibboleth authentication > > - Adds redirect to opac after logout > >MT8122, Follow-up: Adds Shibboleth authentication > > - Shibboleth is not compatible with basic http authentication > in C4/Auth.pm. This patch fixes that. > >MT8122, Follow-up: Adds Shibboleth authentication > > - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with > multiple vhosts. > >MT8122, Follow-up: Adds Shibboleth authentication > > - Adds missing protocol for $ENV{'SERVER_NAME'} > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> > >http://bugs.koha-community.org/show_bug.cgi?id=8446 >--- > C4/Auth.pm | 75 +++++++++++++-- > C4/Auth_with_Shibboleth.pm | 100 ++++++++++++++++++++ > installer/data/mysql/updatedatabase.pl | 8 ++ > .../prog/en/modules/admin/preferences/admin.pref | 11 +++ > koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt | 16 ++++ > koha-tmpl/opac-tmpl/prog/en/modules/opac-main.tt | 1 + > kohaversion.pl | 2 +- > opac/opac-main.pl | 2 + > opac/opac-user.pl | 3 + > 9 files changed, 209 insertions(+), 9 deletions(-) > create mode 100644 C4/Auth_with_Shibboleth.pm > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 44edf67..bc8c611 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -34,7 +34,7 @@ use POSIX qw/strftime/; > use List::MoreUtils qw/ any /; > > # use utf8; >-use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout); >+use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login); > > BEGIN { > sub psgi_env { any { /^psgi\./ } keys %ENV } >@@ -54,12 +54,19 @@ BEGIN { > %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); > $ldap = C4::Context->config('useldapserver') || 0; > $cas = C4::Context->preference('casAuthentication'); >+ $shib = C4::Context->preference('shibbolethAuthentication'); > $caslogout = C4::Context->preference('casLogout'); > require C4::Auth_with_cas; # no import >+ require C4::Auth_with_Shibboleth; > if ($ldap) { > require C4::Auth_with_ldap; > import C4::Auth_with_ldap qw(checkpw_ldap); > } >+ if ($shib) { >+ import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); >+ # Getting user login >+ $shib_login = get_login_shib(); >+ } > if ($cas) { > import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); > } >@@ -649,8 +656,18 @@ sub checkauth { > my $casparam = $query->param('cas'); > my $q_userid = $query->param('userid') // ''; > >- if ( $userid = $ENV{'REMOTE_USER'} ) { >- # Using Basic Authentication, no cookies required >+ # Basic authentication is incompatible with the use of Shibboleth, >+ # as Shibboleth may return REMOTE_USER as a Shibboleth attribute, >+ # and it may not be the attribute we want to use to match the koha login. >+ # >+ # Also, do not consider an empty REMOTE_USER. >+ # >+ # Finally, after those tests, we can assume (although if it would be better with >+ # a syspref) that if we get a REMOTE_USER, that's from basic authentication, >+ # and we can affect it to $userid. >+ if ( !$shib and $ENV{'REMOTE_USER'} ne '' and $userid = $ENV{'REMOTE_USER'} ) { >+ >+ # Using Basic Authentication, no cookies required > $cookie = $query->cookie( > -name => 'CGISESSID', > -value => '', >@@ -708,9 +725,15 @@ sub checkauth { > $sessionID = undef; > $userid = undef; > >- if ($cas and $caslogout) { >- logout_cas($query); >- } >+ if ($cas and $caslogout) { >+ logout_cas($query); >+ } >+ >+ # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) >+ if ( $shib and $shib_login and $type eq 'opac') { >+ # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) >+ logout_shib($query); >+ } > } > elsif ( !$lasttime || ($lasttime < time() - $timeout) ) { > # timed logout >@@ -780,13 +803,20 @@ sub checkauth { > } > if ( ( $cas && $query->param('ticket') ) > || $userid >+ || $shib > || $pki_field ne 'None' >- || $persona ) >+ || $persona ) > { > my $password = $query->param('password'); > > my ( $return, $cardnumber ); >- if ( $cas && $query->param('ticket') ) { >+ if ($shib && $shib_login && $type eq 'opac' && !$password) { >+ my $retuserid; >+ ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); >+ $userid = $retuserid; >+ $info{'invalidShibLogin'} = 1 unless ($return); >+ >+ } elsif ( $cas && $query->param('ticket') ) { > my $retuserid; > ( $return, $cardnumber, $retuserid ) = > checkpw( $dbh, $userid, $password, $query ); >@@ -1033,6 +1063,7 @@ sub checkauth { > login => 1, > INPUTS => \@inputs, > casAuthentication => C4::Context->preference("casAuthentication"), >+ shibbolethAuthentication => C4::Context->preference("shibbolethAuthentication"), > suggestion => C4::Context->preference("suggestion"), > virtualshelves => C4::Context->preference("virtualshelves"), > LibraryName => "" . C4::Context->preference("LibraryName"), >@@ -1104,6 +1135,12 @@ sub checkauth { > ); > } > >+ if ($shib) { >+ $template->param( >+ shibbolethLoginUrl => login_shib_url($query), >+ ); >+ } >+ > my $self_url = $query->url( -absolute => 1 ); > $template->param( > url => $self_url, >@@ -1536,6 +1573,28 @@ sub checkpw { > return 0; > } > >+ # If we are in a shibboleth session (shibboleth is enabled and no password has been provided) >+ if ($shib && !$password) { >+ >+ $debug and print STDERR "## checkpw - checking Shibboleth\n"; >+ # In case of a Shibboleth authentication, we expect a shibboleth user attribute >+ # (defined in the shibbolethLoginAttribute) tto contain the login of the >+ # shibboleth-authenticated user >+ >+ # Shibboleth attributes are mapped into http environmement variables, >+ # so we're getting the login of the user this way >+ my $attributename = C4::Context->preference('shibbolethLoginAttribute'); >+ my $attributevalue = $ENV{$attributename}; >+ >+ # Then, we check if it matches a valid koha user >+ if ($shib_login) { >+ my ( $retval, $retcard, $retuserid ) = C4::Auth_with_Shibboleth::checkpw_shib( $dbh, $shib_login ); # EXTERNAL AUTH >+ ($retval) and return ( $retval, $retcard, $retuserid ); >+ return 0; >+ } >+ } >+ >+ # INTERNAL AUTH > return checkpw_internal(@_) > } > >diff --git a/C4/Auth_with_Shibboleth.pm b/C4/Auth_with_Shibboleth.pm >new file mode 100644 >index 0000000..3b0a9fb >--- /dev/null >+++ b/C4/Auth_with_Shibboleth.pm >@@ -0,0 +1,100 @@ >+package C4::Auth_with_Shibboleth; >+ >+# Copyright 2011 BibLibre >+# >+# This file is part of Koha. >+# >+# Koha is free software; you can redistribute it and/or modify it under the >+# terms of the GNU General Public License as published by the Free Software >+# Foundation; either version 2 of the License, or (at your option) any later >+# version. >+# >+# Koha is distributed in the hope that it will be useful, but WITHOUT ANY >+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR >+# A PARTICULAR PURPOSE. See the GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License along >+# with Koha; if not, write to the Free Software Foundation, Inc., >+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. >+ >+use strict; >+use warnings; >+ >+use C4::Debug; >+use C4::Context; >+use C4::Utils qw( :all ); >+use CGI; >+ >+use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug); >+ >+BEGIN { >+ require Exporter; >+ $VERSION = 3.03; # set the version for version checking >+ $debug = $ENV{DEBUG}; >+ @ISA = qw(Exporter); >+ @EXPORT = qw(logout_shib login_shib_url checkpw_shib get_login_shib); >+} >+my $context = C4::Context->new() or die 'C4::Context->new failed'; >+my $protocol = "https://"; >+ >+# Logout from Shibboleth >+sub logout_shib { >+ my ($query) = @_; >+ my $uri = $protocol . $ENV{'SERVER_NAME'}; >+ print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" ); >+} >+ >+# Returns Shibboleth login URL with callback to the requesting URL >+sub login_shib_url { >+ >+ my ($query) = @_; >+ my $param = $protocol . $ENV{'SERVER_NAME'} . $query->script_name(); >+ my $uri = $protocol . $ENV{'SERVER_NAME'} . "/Shibboleth.sso/Login?target=$param"; >+ return $uri; >+} >+ >+# Returns shibboleth user login >+sub get_login_shib { >+ >+ # In case of a Shibboleth authentication, we expect a shibboleth user attribute (defined in the shibbolethLoginAttribute) >+ # to contain the login of the shibboleth-authenticated user >+ >+ # Shibboleth attributes are mapped into http environmement variables, >+ # so we're getting the login of the user this way >+ >+ my $shibbolethLoginAttribute = C4::Context->preference('shibbolethLoginAttribute'); >+ $debug and warn "shibbolethLoginAttribute value: $shibbolethLoginAttribute"; >+ $debug and warn "$shibbolethLoginAttribute value: " . $ENV{$shibbolethLoginAttribute}; >+ >+ return $ENV{$shibbolethLoginAttribute}; >+} >+ >+# Checks for password correctness >+# In our case : does the given username matches one of our users ? >+sub checkpw_shib { >+ $debug and warn "checkpw_shib"; >+ >+ my ( $dbh, $userid ) = @_; >+ my $retnumber; >+ $debug and warn "User Shibboleth-authenticated as: $userid"; >+ >+ # Does it match one of our users ? >+ my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?"); >+ $sth->execute($userid); >+ if ( $sth->rows ) { >+ $retnumber = $sth->fetchrow; >+ return ( 1, $retnumber, $userid ); >+ } >+ $sth = $dbh->prepare("select userid from borrowers where cardnumber=?"); >+ $sth->execute($userid); >+ if ( $sth->rows ) { >+ $retnumber = $sth->fetchrow; >+ return ( 1, $retnumber, $userid ); >+ } >+ >+ # If we reach this point, the user is not a valid koha user >+ $debug and warn "User $userid is not a valid Koha user"; >+ return 0; >+} >+ >+1; >diff --git a/installer/data/mysql/updatedatabase.pl b/installer/data/mysql/updatedatabase.pl >index c8e883f..30f066f 100755 >--- a/installer/data/mysql/updatedatabase.pl >+++ b/installer/data/mysql/updatedatabase.pl >@@ -8012,6 +8012,14 @@ if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) { > SetVersion($DBversion); > } > >+$DBversion = "XXX"; >+if (C4::Context->preference("Version") < TransformToNum($DBversion)) { >+ $dbh->do("INSERT INTO `systempreferences` (variable,value,options,explanation,type) VALUES('shibbolethAuthentication','','','Enable or disable Shibboleth authentication','YesNo')"); >+ $dbh->do("INSERT INTO `systempreferences` (variable,value,options,explanation,type) VALUES('shibbolethLoginAttribute','','','Which shibboleth user attribute should be used to match koha user login?','')"); >+ print "Upgrade to $DBversion done (Adds shibbolethAuthentication and shibbolethLoginAttribute preferences)\n"; >+ SetVersion ($DBversion); >+} >+ > =head1 FUNCTIONS > > =head2 TableExists($table) >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref >index 1215ac1..32665b2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref >@@ -105,6 +105,17 @@ Administration: > yes: Allow > no: "Don't Allow" > - Mozilla persona for login >+ Shibboleth Authentication: >+ - >+ - pref: shibbolethAuthentication >+ default: 0 >+ choices: >+ yes: Use >+ no: "Don't use" >+ - Shibboleth for login authentication. >+ - >+ - Which shibboleth user attribute should be used to match koha user login? >+ - pref: shibbolethLoginAttribute > Search Engine: > - > - pref: SearchEngine >diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt >index 7b8b8f9..7f23b2b 100644 >--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-auth.tt >@@ -46,6 +46,22 @@ > <p>You entered an incorrect username or password. Please try again! And remember, usernames and passwords are case sensitive.</p> > [% END %] > >+[% IF ( shibbolethAuthentication ) %] >+<h4>Shibboleth Login</h4> >+ >+[% IF ( invalidShibLogin ) %] >+<!-- This is what is displated if shibboleth login has failed --> >+<p>Sorry, the shibboleth login failed.</p> >+[% END %] >+ >+<p>If you have a shibboleth account, >+please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p> >+ >+<h4>Local Login</h4> >+<p>If you do not have a shibboleth account, but a local account, you can still log in : </p> >+ >+[% END %] >+ > [% IF ( casAuthentication ) %] > <h4>Cas login</h4> > >diff --git a/koha-tmpl/opac-tmpl/prog/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/prog/en/modules/opac-main.tt >index eb1e600..574a196 100644 >--- a/koha-tmpl/opac-tmpl/prog/en/modules/opac-main.tt >+++ b/koha-tmpl/opac-tmpl/prog/en/modules/opac-main.tt >@@ -47,6 +47,7 @@ > [% IF ( opacuserlogin ) %] > [% UNLESS ( loggedinusername ) %] > [% UNLESS ( casAuthentication ) %] >+ [% UNLESS ( shibbolethAuthentication ) %] > <div id="login" class="container clearfix"> > <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="auth"> > <input type="hidden" name="koha_login_context" value="opac" /> >diff --git a/kohaversion.pl b/kohaversion.pl >index 3b6df5d..3521663 100644 >--- a/kohaversion.pl >+++ b/kohaversion.pl >@@ -16,7 +16,7 @@ the kohaversion is divided in 4 parts : > use strict; > > sub kohaversion { >- our $VERSION = '3.15.00.019'; >+ our $VERSION = 'XXX'; > # version needs to be set this way > # so that it can be picked up by Makefile.PL > # during install >diff --git a/opac/opac-main.pl b/opac/opac-main.pl >index 7c6ee36..4a0702a 100755 >--- a/opac/opac-main.pl >+++ b/opac/opac-main.pl >@@ -43,6 +43,8 @@ $template->param( > casAuthentication => $casAuthentication, > ); > >+my $shibbolethAuthentication = C4::Context->preference('shibbolethAuthentication'); >+$template->param( shibbolethAuthentication => $shibbolethAuthentication); > > # display news > # use cookie setting for language, bug default to syspref if it's not set >diff --git a/opac/opac-user.pl b/opac/opac-user.pl >index 02002a3..8f67a4c 100755 >--- a/opac/opac-user.pl >+++ b/opac/opac-user.pl >@@ -71,6 +71,9 @@ for ( C4::Context->preference("OPACShowHoldQueueDetails") ) { > my $patronupdate = $query->param('patronupdate'); > my $canrenew = 1; > >+my $shibbolethAuthentication = C4::Context->preference('shibbolethAuthentication'); >+$template->param( shibbolethAuthentication => $shibbolethAuthentication ); >+ > # get borrower information .... > my ( $borr ) = GetMemberDetails( $borrowernumber ); > >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 8446
:
10841
|
22098
|
22107
|
22860
|
23224
|
23225
|
23226
|
25765
|
25766
|
26176
|
26177
|
26178
|
26187
|
26749
|
26750
|
26751
|
26752
|
26760
|
26761
|
26762
|
28892
|
28893
|
28894
|
28895
|
28896
|
28897
|
28898
|
28899
|
28900
|
28901
|
28902
|
28903
|
30017
|
30018
|
30019
|
30020
|
30021
|
30022
|
30023
|
30030
|
30031
|
30033
|
30283
|
30284
|
30285
|
30286
|
30335
|
30353
|
30354
|
30355
|
30356
|
30384
|
30594
|
30604
|
30605
|
30616
|
30617
|
30618
|
30619
|
30620
|
30621
|
30684
|
31407
|
31408
|
31836
|
31905
|
31906
|
31907
|
32125
|
32158
|
32162
|
32163
|
32164
|
32165
|
32166
|
32167
|
32168
|
32169
|
32170
|
32365
|
32366
|
32367
|
32368
|
32369
|
32370
|
32371
|
32372
|
32373
|
32374
|
32426
|
32427