Attachment 30373 Details for Bug 12027 – BUG 12027: Added shibboleth authentication to the staff client

[patch] BUG 12027: Added shibboleth authentication to the staff client

BUG-12027-Added-shibboleth-authentication-to-the-s.patch (text/plain), 5.73 KB, created by Martin Renvoize (ashimema) on 2014-07-31 06:23:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2014-07-31 06:23:47 UTC

Size: 5.73 KB

patch

obsolete

>From f283d04b9a30b5a2841cd15f253a67dd290c17db Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Thu, 31 Jul 2014 06:21:55 +0000
>Subject: [PATCH] BUG 12027: Added shibboleth authentication to the staff
> client
>
>- This patch adds shibboleth authentication to the staff client.
>- Depending upon how your url structure works, you may or may not need a
>  second native shibboleth service provider profile configured for this
>  to work.
>---
> C4/Auth.pm                                      |    5 ++--
> C4/Auth_with_shibboleth.pm                      |   35 +++++++++++++++++------
> koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt |    8 ++++++
> 3 files changed, 36 insertions(+), 12 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 788e3ea..2c631d0 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -769,8 +769,7 @@ sub checkauth {
>             }
> 
>             # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
>-            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
>-            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
>+            if ( $shib and $shib_login and $shibSuccess) {
>                 logout_shib($query);
>             }
>         }
>@@ -851,7 +850,7 @@ sub checkauth {
> 
>             my ( $return, $cardnumber );
> 	    # If shib is enabled and we have a shib login, does the login match a valid koha user
>-            if ( $shib && $shib_login && $type eq 'opac' ) {
>+            if ( $shib && $shib_login ) {
>                 my $retuserid;
> 		# Do not pass password here, else shib will not be checked in checkpw.
>                 ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
>diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm
>index 1936c48..741b46b 100644
>--- a/C4/Auth_with_shibboleth.pm
>+++ b/C4/Auth_with_shibboleth.pm
>@@ -36,28 +36,28 @@ BEGIN {
>     @ISA     = qw(Exporter);
>     @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
> }
>-my $context = C4::Context->new() or die 'C4::Context->new failed';
>+
> my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
> my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
> my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml';
>-my $protocol = "https://";
> 
> # Logout from Shibboleth
> sub logout_shib {
>     my ($query) = @_;
>-    my $uri = $protocol . C4::Context->preference('OPACBaseURL');
>+    my $uri = _get_uri();
>     print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
> }
> 
> # Returns Shibboleth login URL with callback to the requesting URL
> sub login_shib_url {
>-
>     my ($query) = @_;
>-    my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name();
>+    my $interface = C4::Context->interface;
>+    $debug and warn "shibboleth interface: " . $interface;
>+    my $param = _get_uri() . $query->script_name();
>     if ( $query->query_string() ) {
>         $param = $param . '%3F' . $query->query_string();
>     }
>-    my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param";
>+    my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param";
>     return $uri;
> }
> 
>@@ -75,7 +75,8 @@ sub get_login_shib {
>     $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
>     $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
> 
>-    return $ENV{$shibbolethMatchAttribute} || '';
>+    my @attribute = split(';',$ENV{$shibbolethMatchAttribute});
>+    return $attribute[0] || '';
> }
> 
> # Checks for password correctness
>@@ -84,7 +85,7 @@ sub checkpw_shib {
>     $debug and warn "checkpw_shib";
> 
>     my ( $dbh, $match ) = @_;
>-    my $retnumber;
>+    my ( $retnumber, $userid );
>     $debug and warn "User Shibboleth-authenticated as: $match";
> 
>     # Does the given shibboleth attribute value ($match) match a valid koha user ?
>@@ -101,11 +102,27 @@ sub checkpw_shib {
>     if ( $shib->{'autocreate'} ) {
>         return _autocreate( $dbh, $shib, $match );
>     } else {
>-        $debug and warn "User $userid is not a valid Koha user";
>+        $debug and warn "User $match is not a valid Koha user";
>         return 0;
>     }
> }
> 
>+sub _get_uri {
>+
>+    my $protocol = "https://";
>+    my $interface = C4::Context->interface;
>+    $debug and warn "shibboleth interface: " . $interface;
>+
>+    my $return;
>+    if ( $interface eq 'intranet' ) {
>+        $return = $protocol . C4::Context->preference('staffClientBaseURL');
>+        return $return;
>+    } else {
>+        $return = $protocol . C4::Context->preference('OPACBaseURL');
>+        return $return;
>+    }
>+}
>+
> sub _autocreate {
>     my ( $dbh, $shib, $match ) = @_;
> 
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
>index 5f97758..035c049 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
>@@ -42,6 +42,14 @@
> <div id="login_error"><strong>Error: </strong>Invalid username or password</div>
> [% END %]
> 
>+[% IF (shibbolethAuthentication) %]
>+
>+[% IF (invalidShibLogin ) %]
>+<div id="login_error"><Strong>Error: </strong>Shibboleth login failed</div>
>+[% END %]
>+<p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here</a> to login.</p>
>+[% END %]
>+
> 
> <form action="[% url %]" method="post" name="loginform" id="loginform">
>     <input type="hidden" name="koha_login_context" value="intranet" />
>-- 
>1.7.10.4

Actions: View | Diff | Splinter Review

Attachments on bug 12027: 30373 | 30374 | 30375 | 30377 | 35553 | 35554 | 43371 | 43372 | 62523 | 62524 | 62823 | 62824 | 62825 | 73152 | 75868 | 79416 | 79417 | 79418 | 79419