Attachment 89423 Details for Bug 18506 – Bug 18506: Add xShibOnly preference for Shibboleth authentication

[patch] Bug 18506: Add xShibOnly preference for Shibboleth authentication

Bug-18506-Add-xShibOnly-preference-for-Shibboleth-.patch (text/plain), 3.86 KB, created by Martin Renvoize (ashimema) on 2019-05-07 09:16:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2019-05-07 09:16:31 UTC

Size: 3.86 KB

patch

obsolete

>From 42995a6fe997ff014114543e47da06f7eb3ec9d6 Mon Sep 17 00:00:00 2001
>From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>Date: Wed, 26 Apr 2017 12:39:15 +0100
>Subject: [PATCH] Bug 18506: Add xShibOnly preference for Shibboleth
> authentication
>
>This patch adds two system preferences to Koha, opacShibOnly and
>staffShibOnly, allowing users to restrict authentication to just
>one method, Shibboleth.
>
>A system preference was chosen over a configuration file update to
>allow for local override at the virtualhost level. In this way a
>hosting provider can setup a 'backdoor opac' for example to allow
>fallback to local logins for support operations.
>---
> C4/Auth.pm                                                 | 7 +++++++
> installer/data/mysql/atomicupdate/shibOnly.perl            | 6 ++++++
> .../prog/en/modules/admin/preferences/opac.pref            | 7 +++++++
> .../prog/en/modules/admin/preferences/staff_client.pref    | 7 +++++++
> 4 files changed, 27 insertions(+)
> create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 5b2434a585..9388383694 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -1324,6 +1324,13 @@ sub checkauth {
>     }
> 
>     if ($shib) {
>+        #If shibOnly is enabled just go ahead and redirect directly
>+        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
>+            my $redirect_url = login_shib_url( $query );
>+            print $query->redirect($redirect_url);
>+            safe_exit;
>+        }
>+
>         $template->param(
>             shibbolethAuthentication => $shib,
>             shibbolethLoginUrl       => login_shib_url($query),
>diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl
>new file mode 100644
>index 0000000000..9b67d0fb42
>--- /dev/null
>+++ b/installer/data/mysql/atomicupdate/shibOnly.perl
>@@ -0,0 +1,6 @@
>+$DBversion = 'XXX';  # will be replaced by the RM
>+if( CheckVersion( $DBversion ) ) {
>+    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
>+    SetVersion( $DBversion );
>+    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
>+}
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>index 8300553aee..8a6ff9bcf0 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
>@@ -880,3 +880,10 @@ OPAC:
>             - "The patron should see the charge description as "
>             - pref: PayPalChargeDescription
>               class: long
>+    Authentication:
>+        -
>+            - pref: opacShibOnly
>+              choices:
>+                  yes: "Don't allow"
>+                  no: Allow
>+            - patrons to login by means other than Shibboleth.
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>index 570c570982..cf734254d7 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
>@@ -177,3 +177,10 @@ Staff Client:
>                   yes: Show
>                   no: "Don't show"
>             - a search field pulldown for 'Search the catalog' boxes.
>+    Authentication:
>+        -
>+            - pref: staffShibOnly
>+              choices:
>+                  yes: "Don't allow"
>+                  no: Allow
>+            - staff to login by means other than shibboleth.
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 18506: 62810 | 79050 | 79522 | 79524 | 79540 | 89423 | 89424 | 91011 | 91012 | 91013 | 92665 | 92680 | 92681 | 92682 | 92683 | 116250 | 116251 | 116253 | 116280 | 116281 | 116282 | 116290 | 116536 | 116537 | 116538 | 116540