Attachment 62810 Details for Bug 18506 – BUG 18506 - Add xShibOnly preference for shibboleth

[patch] BUG 18506 - Add xShibOnly preference for shibboleth

BUG-18506---Add-xShibOnly-preference-for-shibbolet.patch (text/plain), 3.85 KB, created by Martin Renvoize (ashimema) on 2017-04-28 08:09:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2017-04-28 08:09:12 UTC

Size: 3.85 KB

patch

obsolete

>From 170b75e93e6999ed43025d11e8fa599e14e67e37 Mon Sep 17 00:00:00 2001
>From: PTFS Admin <hosting@ptfs-europe.com>
>Date: Wed, 26 Apr 2017 12:39:15 +0100
>Subject: [PATCH] BUG 18506 - Add xShibOnly preference for shibboleth
>
>This patch adds two system preferences to Koha, opacShibOnly and
>staffShibOnly, allowing users to restrict authentication to just
>one method, Shibboleth.
>
>A system preference was chosen over a configuration file update to
>allow for local override at the virtualhost level. In this way a
>hosting provider can setup a 'backdoor opac' for example to allow
>fallback to local logins for support operations.
>---
> C4/Auth.pm                                                         | 7 +++++++
> installer/data/mysql/atomicupdate/shibOnly.perl                    | 6 ++++++
> .../intranet-tmpl/prog/en/modules/admin/preferences/opac.pref      | 7 +++++++
> .../prog/en/modules/admin/preferences/staff_client.pref            | 7 +++++++
> 4 files changed, 27 insertions(+)
> create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 40b273a..cfc435b 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1297,6 +1297,13 @@ sub checkauth {
>     }
> 
>     if ($shib) {
>+        #If shibOnly is enabled just go ahead and redirect directly
>+        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
>+            my $redirect_url = login_shib_url( $query );
>+            print $query->redirect($redirect_url);
>+            safe_exit;
>+        }
>+        
>         $template->param(
>             shibbolethAuthentication => $shib,
>             shibbolethLoginUrl       => login_shib_url($query),
>diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl
>new file mode 100644
>index 0000000..9b67d0f
>--- /dev/null
>+++ b/installer/data/mysql/atomicupdate/shibOnly.perl
>@@ -0,0 +1,6 @@
>+$DBversion = 'XXX';  # will be replaced by the RM
>+if( CheckVersion( $DBversion ) ) {
>+    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
>+    SetVersion( $DBversion );
>+    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
>+}
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>index b6954ef..7194705 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>@@ -823,3 +823,10 @@ OPAC:
>             - "The patron should see the charge description as "
>             - pref: PayPalChargeDescription
>               class: long
>+    Authentication:
>+        -
>+            - pref: opacShibOnly
>+              choices:
>+                  yes: "Don't allow"
>+                  no: Allow
>+            - patrons to login by means other than shibboleth.
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>index e7da2e8..52654e2 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>@@ -155,3 +155,10 @@ Staff Client:
>                   yes: Show
>                   no: "Don't show"
>             - a search field pulldown for 'Search the catalog' boxes.
>+    Authentication:
>+        -
>+            - pref: staffShibOnly
>+              choices:
>+                  yes: "Don't allow"
>+                  no: Allow
>+            - staff to login by means other than shibboleth.
>-- 
>2.1.4

Actions: View | Diff | Splinter Review

Attachments on bug 18506: 62810 | 79050 | 79522 | 79524 | 79540 | 89423 | 89424 | 91011 | 91012 | 91013 | 92665 | 92680 | 92681 | 92682 | 92683 | 116250 | 116251 | 116253 | 116280 | 116281 | 116282 | 116290 | 116536 | 116537 | 116538 | 116540