Bugzilla – Attachment 26752 Details for
Bug 8446
Shibboleth authentication
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
BUG8446, Follow up: Improve local login fallback
BUG8446-Follow-up-Improve-local-login-fallback.patch (text/plain), 13.34 KB, created by
Martin Renvoize (ashimema)
on 2014-04-02 08:03:35 UTC
(
hide
)
Description:
BUG8446, Follow up: Improve local login fallback
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2014-04-02 08:03:35 UTC
Size:
13.34 KB
patch
obsolete
>From e55bfd92514609784a205ee52d5b474fec0710c4 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Tue, 1 Apr 2014 12:15:40 +0000 >Subject: [PATCH] BUG8446, Follow up: Improve local login fallback > >- Local fallback was not very well implimented, this patch adds > better handling for such cases allowing clearer failure messages >- This patch also adds the ability to use single sign on via the > top bar menu in the bootstrap theme. > >BUG8446, Follow up: Adds perldoc documentation > >- Add some documentation to the Auth_with_Shibboleth module > including some guidance as to configuration. >--- > C4/Auth.pm | 50 ++++++++---- > C4/Auth_with_Shibboleth.pm | 83 ++++++++++++++++++++ > .../opac-tmpl/bootstrap/en/includes/masthead.inc | 13 ++- > .../opac-tmpl/bootstrap/en/modules/opac-auth.tt | 14 ++-- > opac/opac-main.pl | 8 +- > 5 files changed, 145 insertions(+), 23 deletions(-) > >diff --git a/C4/Auth.pm b/C4/Auth.pm >index 1df90d5..75d6d21 100644 >--- a/C4/Auth.pm >+++ b/C4/Auth.pm >@@ -63,8 +63,10 @@ BEGIN { > import C4::Auth_with_ldap qw(checkpw_ldap); > } > if ($shib) { >- import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib); >- # Getting user login >+ import C4::Auth_with_Shibboleth >+ qw(checkpw_shib logout_shib login_shib_url get_login_shib); >+ >+ # Get shibboleth login attribute > $shib_login = get_login_shib(); > } > if ($cas) { >@@ -288,6 +290,13 @@ sub get_template_and_user { > } > else { # if this is an anonymous session, setup to display public lists... > >+ # If shibboleth is enabled, and we have a shibboleth login attribute, >+ # but we are in an anonymouse session, we clearly have an invalid >+ # Shibboleth account. >+ if ( $shib && $shib_login ) { >+ $template->param( invalidShibLogin => '1'); >+ } >+ > $template->param( sessionID => $sessionID ); > > my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD'); >@@ -718,6 +727,8 @@ sub checkauth { > } > elsif ($logout) { > # voluntary logout the user >+ # check wether the user was using their shibboleth session or a local one >+ my $shibSuccess = C4::Context->userenv->{'shibboleth'}; > $session->delete(); > $session->flush; > C4::Context->_unset_userenv($sessionID); >@@ -729,8 +740,8 @@ sub checkauth { > logout_cas($query); > } > >- # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set) >- if ( $shib and $shib_login and $type eq 'opac') { >+ # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) >+ if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') { > # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) > logout_shib($query); > } >@@ -803,20 +814,26 @@ sub checkauth { > } > if ( ( $cas && $query->param('ticket') ) > || $userid >- || $shib >+ || ( $shib && $shib_login ) > || $pki_field ne 'None' > || $persona ) > { > my $password = $query->param('password'); >+ my $shibSuccess = 0; > > my ( $return, $cardnumber ); >- if ($shib && $shib_login && $type eq 'opac' && !$password) { >+ # If shib is enabled and we have a shib login, does the login match a valid koha user >+ if ( $shib && $shib_login && $type eq 'opac' ) { > my $retuserid; >- ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query ); >+ # Do not pass password here, else shib will not be checked in checkpw. >+ ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query ); > $userid = $retuserid; >+ $shibSuccess = $return; > $info{'invalidShibLogin'} = 1 unless ($return); >- >- } elsif ( $cas && $query->param('ticket') ) { >+ } >+ # If shib login and match were successfull, skip further login methods >+ unless ( $shibSuccess ) { >+ if ( $cas && $query->param('ticket') ) { > my $retuserid; > ( $return, $cardnumber, $retuserid ) = > checkpw( $dbh, $userid, $password, $query ); >@@ -883,7 +900,8 @@ sub checkauth { > ( $return, $cardnumber, $retuserid ) = > checkpw( $dbh, $userid, $password, $query ); > $userid = $retuserid if ( $retuserid ); >- } >+ $info{'invalid_username_or_password'} = 1 unless ($return); >+ } } > if ($return) { > #_session_log(sprintf "%20s from %16s logged in at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime)); > if ( $flags = haspermission( $userid, $flagsrequired ) ) { >@@ -971,6 +989,7 @@ sub checkauth { > $session->param('emailaddress',$emailaddress); > $session->param('ip',$session->remote_addr()); > $session->param('lasttime',time()); >+ $session->param('shibboleth',$shibSuccess); > $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ; > } > elsif ( $return == 2 ) { >@@ -997,7 +1016,7 @@ sub checkauth { > $session->param('surname'), $session->param('branch'), > $session->param('branchname'), $session->param('flags'), > $session->param('emailaddress'), $session->param('branchprinter'), >- $session->param('persona') >+ $session->param('persona'), $session->param('shibboleth') > ); > > } >@@ -1557,7 +1576,6 @@ sub get_session { > > sub checkpw { > my ( $dbh, $userid, $password, $query ) = @_; >- > if ($ldap) { > $debug and print STDERR "## checkpw - checking LDAP\n"; > my ($retval,$retcard,$retuserid) = checkpw_ldap(@_); # EXTERNAL AUTH >@@ -1573,12 +1591,14 @@ sub checkpw { > return 0; > } > >- # If we are in a shibboleth session (shibboleth is enabled and no password has been provided) >- if ($shib && !$password) { >+ # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present) >+ # Check for password to asertain whether we want to be testing against shibboleth or another method this >+ # time around. >+ if ($shib && $shib_login && !$password) { > > $debug and print STDERR "## checkpw - checking Shibboleth\n"; > # In case of a Shibboleth authentication, we expect a shibboleth user attribute >- # (defined in the shibbolethLoginAttribute) tto contain the login of the >+ # (defined under shibboleth mapping in koha-conf.xml) to contain the login of the > # shibboleth-authenticated user > > # Then, we check if it matches a valid koha user >diff --git a/C4/Auth_with_Shibboleth.pm b/C4/Auth_with_Shibboleth.pm >index 5c6c6b3..8dd3083 100644 >--- a/C4/Auth_with_Shibboleth.pm >+++ b/C4/Auth_with_Shibboleth.pm >@@ -105,3 +105,86 @@ sub checkpw_shib { > } > > 1; >+__END__ >+ >+=head1 NAME >+ >+C4::Auth_with_shibboleth >+ >+=head1 SYNOPSIS >+ >+use C4::Auth_with_shibboleth >+ >+=head1 DESCRIPTION >+ >+This module is specific to Shibboleth authentication in koha and relies heavily upon the native shibboleth service provider package in your operating system. >+ >+=head1 CONFIGURATION >+ >+To use this type of authentication these additional packages are required: >+ >+=over >+ >+=item * >+ >+libapache2-mod-shib2 >+ >+=item * >+ >+libshibsp5:amd64 >+ >+=item * >+ >+shibboleth-sp2-schemas >+ >+=back >+ >+We let the native shibboleth service provider packages handle all the complexities of shibboleth negotiation for use and configuring this is beyond the scope of this documentation; But to sum up, you will need to: >+ >+=over >+ >+=item 1. >+ >+Create some metadata for your koha instance (if you're in a single instance setup then the default metadata available at https://youraddress.com/Shibboleth.sso/Metadata should be adequate) >+ >+=item 2. >+ >+Swap metadata with your Identidy Provider (IdP) >+ >+=item 3. >+ >+Map their attributes to what you want to see in koha >+ >+=item 4. >+ >+Tell apache that we wish to allow koha to authenticate via shibboleth; This is as simple as adding the below to your virtualhost config: >+ >+=begin text >+ >+<Location /> >+ AuthType shibboleth >+ Require shibboleth >+</Location> >+ >+=end text >+ >+=item 5. >+ >+Configure koha to listen for shibboleth environment variables; To do this we add <useshibboleth>1</useshibboleth> for the koha-conf.xml file >+ >+=item 6. >+ >+Map shibboleth attributes to koha fields in koha-conf.xml. >+ >+<shibboleth> >+ <mapping> >+ <userid match="1" default="">eduPersonID</userid> >+ <categorycode default=""></categorycode> >+ </mapping> >+</shibboleth> >+ >+=back >+ >+=head1 FUNCTIONS >+ >+=cut >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >index 1edc244..ac40f11 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc >@@ -272,6 +272,17 @@ > </div> > <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth"> > <div class="modal-body"> >+ [% IF ( shibbolethAuthentication ) %] >+ [% IF ( invalidShibLogin ) %] >+ <!-- This is what is displayed if shibboleth login has failed to match a koha user --> >+ <div class="alert alert-info"> >+ <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p> >+ </div> >+ [% ELSE %] >+ <h4>Shibboleth Login</h4> >+ <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p> >+ <h4>Local Login</h4> >+ [% END %] > <input type="hidden" name="koha_login_context" value="opac" /> > <fieldset class="brief"> > <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" /> >@@ -284,4 +295,4 @@ > <a href="#" data-dismiss="modal" aria-hidden="true" class="cancel">Cancel</a> > </div> > </form> <!-- /#auth --> >- </div> <!-- /#modalAuth --> >\ No newline at end of file >+ </div> <!-- /#modalAuth --> >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index a1cf15e..67401c3 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -58,18 +58,20 @@ > [% END %] > > [% IF ( shibbolethAuthentication ) %] >- <h4>Shibboleth Login</h4> > > [% IF ( invalidShibLogin ) %] >- <!-- This is what is displated if shibboleth login has failed --> >- <p>Sorry, the Shibboleth login failed.</p> >- [% END %] >+ <!-- This is what is displayed if shibboleth login has failed to match a koha user --> >+ <div class="alert alert-info"> >+ <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p> >+ </div> >+ [% ELSE %] >+ <h4>Shibboleth Login</h4> > > <p>If you have a Shibboleth account, > please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p> >- >+ [% END %] > <h4>Local Login</h4> >- <p>If you do not have a Shibboleth account, but a local account, you can still log in : </p> >+ <p>If you do not have a Shibboleth account, but a local account, you can still log in: </p> > > [% END %] > >diff --git a/opac/opac-main.pl b/opac/opac-main.pl >index fb9de41..741727d 100755 >--- a/opac/opac-main.pl >+++ b/opac/opac-main.pl >@@ -20,6 +20,7 @@ use strict; > use warnings; > use CGI; > use C4::Auth; # get_template_and_user >+use C4::Auth_with_Shibboleth qw( login_shib_url ); > use C4::Output; > use C4::NewsChannels; # get_opac_news > use C4::Languages qw(getTranslatedLanguages accept_language); >@@ -43,7 +44,12 @@ $template->param( > casAuthentication => $casAuthentication, > ); > >-$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') ); >+if ( C4::Context->config('useshibboleth') ) { >+ $template->param( >+ shibbolethAuthentication => C4::Context->config('useshibboleth'), >+ shibbolethLoginUrl => C4::Auth_with_Shibboleth::login_shib_url($input) >+ ); >+}; > > # display news > # use cookie setting for language, bug default to syspref if it's not set >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 8446
:
10841
|
22098
|
22107
|
22860
|
23224
|
23225
|
23226
|
25765
|
25766
|
26176
|
26177
|
26178
|
26187
|
26749
|
26750
|
26751
|
26752
|
26760
|
26761
|
26762
|
28892
|
28893
|
28894
|
28895
|
28896
|
28897
|
28898
|
28899
|
28900
|
28901
|
28902
|
28903
|
30017
|
30018
|
30019
|
30020
|
30021
|
30022
|
30023
|
30030
|
30031
|
30033
|
30283
|
30284
|
30285
|
30286
|
30335
|
30353
|
30354
|
30355
|
30356
|
30384
|
30594
|
30604
|
30605
|
30616
|
30617
|
30618
|
30619
|
30620
|
30621
|
30684
|
31407
|
31408
|
31836
|
31905
|
31906
|
31907
|
32125
|
32158
|
32162
|
32163
|
32164
|
32165
|
32166
|
32167
|
32168
|
32169
|
32170
|
32365
|
32366
|
32367
|
32368
|
32369
|
32370
|
32371
|
32372
|
32373
|
32374
|
32426
|
32427