Attachment 79522 Details for Bug 18506 – BUG 18506 - Add xShibOnly preference for shibboleth

[patch] BUG 18506 - Add xShibOnly preference for shibboleth

BUG-18506---Add-xShibOnly-preference-for-shibbolet.patch (text/plain), 3.85 KB, created by Martin Renvoize (ashimema) on 2018-09-27 15:02:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2018-09-27 15:02:22 UTC

Size: 3.85 KB

patch

obsolete

>From e9b332e541021596661354c850d6df003d973e13 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Wed, 26 Apr 2017 12:39:15 +0100
>Subject: [PATCH] BUG 18506 - Add xShibOnly preference for shibboleth
>
>This patch adds two system preferences to Koha, opacShibOnly and
>staffShibOnly, allowing users to restrict authentication to just
>one method, Shibboleth.
>
>A system preference was chosen over a configuration file update to
>allow for local override at the virtualhost level. In this way a
>hosting provider can setup a 'backdoor opac' for example to allow
>fallback to local logins for support operations.
>---
> C4/Auth.pm                                                 | 7 +++++++
> installer/data/mysql/atomicupdate/shibOnly.perl            | 6 ++++++
> .../prog/en/modules/admin/preferences/opac.pref            | 7 +++++++
> .../prog/en/modules/admin/preferences/staff_client.pref    | 7 +++++++
> 4 files changed, 27 insertions(+)
> create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 243aada413..d22ca0e729 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1328,6 +1328,13 @@ sub checkauth {
>     }
> 
>     if ($shib) {
>+        #If shibOnly is enabled just go ahead and redirect directly
>+        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
>+            my $redirect_url = login_shib_url( $query );
>+            print $query->redirect($redirect_url);
>+            safe_exit;
>+        }
>+
>         $template->param(
>             shibbolethAuthentication => $shib,
>             shibbolethLoginUrl       => login_shib_url($query),
>diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl
>new file mode 100644
>index 0000000000..9b67d0fb42
>--- /dev/null
>+++ b/installer/data/mysql/atomicupdate/shibOnly.perl
>@@ -0,0 +1,6 @@
>+$DBversion = 'XXX';  # will be replaced by the RM
>+if( CheckVersion( $DBversion ) ) {
>+    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
>+    SetVersion( $DBversion );
>+    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
>+}
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>index a974f0c51a..188f13ce7c 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>@@ -824,3 +824,10 @@ OPAC:
>             - "The patron should see the charge description as "
>             - pref: PayPalChargeDescription
>               class: long
>+    Authentication:
>+        -
>+            - pref: opacShibOnly
>+              choices:
>+                  yes: "Don't allow"
>+                  no: Allow
>+            - patrons to login by means other than Shibboleth.
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>index 1822c7ab24..1126cccbcd 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>@@ -167,3 +167,10 @@ Staff Client:
>                   yes: Show
>                   no: "Don't show"
>             - a search field pulldown for 'Search the catalog' boxes.
>+    Authentication:
>+        -
>+            - pref: staffShibOnly
>+              choices:
>+                  yes: "Don't allow"
>+                  no: Allow
>+            - staff to login by means other than shibboleth.
>-- 
>2.18.0

Actions: View | Diff | Splinter Review

Attachments on bug 18506: 62810 | 79050 | 79522 | 79524 | 79540 | 89423 | 89424 | 91011 | 91012 | 91013 | 92665 | 92680 | 92681 | 92682 | 92683 | 116250 | 116251 | 116253 | 116280 | 116281 | 116282 | 116290 | 116536 | 116537 | 116538 | 116540