@@ -, +, @@ 0. a. % apt install -y libauth-googleauth-perl && updatedatabase && restart_all b. To test this you will need an app to generate the TOTP token, you can use FreeOTP that is open source and easy to use. 1. Turn on TwoFactorAuthentication 2. Go to your account, click 'More' > 'Manage Two-Factor authentication' 3. Click Enable, scan the QR code with the app, insert the pin code and register 4. Your account now requires 2FA to login! 5. Notice that you can browse until you logout 6. Logout 7. Enter the credential and the pincode provided by the app 8. Logout 9. Enter the credential, no pincode --- C4/Auth.pm | 125 +++++++++--- Koha/Auth/TwoFactorAuth.pm | 31 +++ cpanfile | 1 + .../prog/en/includes/members-toolbar.inc | 2 +- .../intranet-tmpl/prog/en/modules/auth.tt | 19 +- .../en/modules/members/two_factor_auth.tt | 10 +- t/db_dependent/selenium/authentication_2fa.t | 178 ++++++++++++++++++ t/lib/TestBuilder.pm | 1 + 8 files changed, 330 insertions(+), 37 deletions(-) create mode 100644 Koha/Auth/TwoFactorAuth.pm create mode 100755 t/db_dependent/selenium/authentication_2fa.t --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -32,6 +32,7 @@ use Koha; use Koha::Logger; use Koha::Caches; use Koha::AuthUtils qw( get_script_name hash_password ); +use Koha::Auth::TwoFactorAuth; use Koha::Checkouts; use Koha::DateUtils qw( dt_from_string ); use Koha::Library::Groups; @@ -843,6 +844,9 @@ sub checkauth { my $q_userid = $query->param('userid') // ''; my $session; + my $invalid_otp_token; + my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; + my $auth_challenge_complete; # Basic authentication is incompatible with the use of Shibboleth, # as Shibboleth may return REMOTE_USER as a Shibboleth attribute, @@ -874,13 +878,43 @@ sub checkauth { { remote_addr => $ENV{REMOTE_ADDR}, skip_version_check => 1 } ); + if ( $return eq 'ok' || $return eq 'additional-auth-needed' ) { + $userid = $session->param('id'); + } + + $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; + + # We are at the second screen if the waiting-for-2FA is set in session + # and otp_token param has been passed + if ( $require_2FA + && $additional_auth_needed + && ( my $otp_token = $query->param('otp_token') ) ) + { + my $patron = Koha::Patrons->find( { userid => $userid } ); + my $auth = Koha::Auth::TwoFactorAuth::get_auth( { patron => $patron } ); + my $verified = $auth->verify($otp_token); + $auth->clear; + if ( $verified ) { + # The token is correct, the user is fully logged in! + $additional_auth_needed = 0; + $session->param( 'waiting-for-2FA', 0 ); + $return = "ok"; + $auth_challenge_complete = 1; + + # This is an ugly trick to pass the test + # $query->param('koha_login_context') && ( $q_userid ne $userid ) + # few lines later + $q_userid = $userid; + } + else { + $invalid_otp_token = 1; + } + } + if ( $return eq 'ok' ) { Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); - my $s_userid = $session->param('id'); - $userid = $s_userid; - - if ( ( $query->param('koha_login_context') && ( $q_userid ne $s_userid ) ) + if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) || ( $cas && $query->param('ticket') && !C4::Context->userenv->{'id'} ) || ( $shib && $shib_login && !$logout && !C4::Context->userenv->{'id'} ) ) { @@ -891,25 +925,7 @@ sub checkauth { $session->delete(); $session->flush; C4::Context->_unset_userenv($sessionID); - } - elsif ($logout) { - - # voluntary logout the user - # check wether the user was using their shibboleth session or a local one - my $shibSuccess = C4::Context->userenv->{'shibboleth'}; - $session->delete(); - $session->flush; - C4::Context->_unset_userenv($sessionID); - - if ($cas and $caslogout) { - logout_cas($query, $type); - } - - # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) - if ( $shib and $shib_login and $shibSuccess) { - logout_shib($query); - } - } else { + } elsif (!$logout) { $cookie = $query->cookie( -name => 'CGISESSID', @@ -939,14 +955,41 @@ sub checkauth { } } - unless ( $loggedin ) { + if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { $sessionID = undef; + $session = undef; $userid = undef; } + if ($logout) { + + # voluntary logout the user + # check wether the user was using their shibboleth session or a local one + my $shibSuccess = C4::Context->userenv->{'shibboleth'}; + if ( $session ) { + $session->delete(); + $session->flush; + } + C4::Context->_unset_userenv($sessionID); + + if ($cas and $caslogout) { + logout_cas($query, $type); + } + + # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) + if ( $shib and $shib_login and $shibSuccess) { + logout_shib($query); + } + + $sessionID = undef; + $session = undef; + $userid = undef; + $additional_auth_needed = 0; + } + unless ( $userid ) { #we initiate a session prior to checking for a username to allow for anonymous sessions... - my $session = get_session("") or die "Auth ERROR: Cannot get_session()"; + $session = get_session("") or die "Auth ERROR: Cannot get_session()"; # Save anonymous search history in new session so it can be retrieved # by get_template_and_user to store it in user's search history after @@ -1233,9 +1276,18 @@ sub checkauth { } } # END unless ($userid) + if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { + my $patron = Koha::Patrons->find({userid => $userid}); + if ( $patron->auth_method eq 'two-factor' ) { + # Ask for the OTP token + $additional_auth_needed = 1; + $session->param('waiting-for-2FA', 1); + %info = ();# We remove the warnings/errors we may have set incorrectly before + } + } + # finished authentification, now respond - if ( $loggedin || $authnotrequired ) - { + if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { # successful login unless ($cookie) { $cookie = $query->cookie( @@ -1269,16 +1321,17 @@ sub checkauth { # # + my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! + # get the inputs from the incoming query my @inputs = (); + my @inputs_to_clean = qw( userid password ticket logout.x otp_token ); foreach my $name ( param $query) { - (next) if ( $name eq 'userid' || $name eq 'password' || $name eq 'ticket' ); + next if grep { $name eq $_ } @inputs_to_clean; my @value = $query->multi_param($name); push @inputs, { name => $name, value => $_ } for @value; } - my $patron = Koha::Patrons->find({ userid => $q_userid }); # Not necessary logged in! - my $LibraryNameTitle = C4::Context->preference("LibraryName"); $LibraryNameTitle =~ s/<(?:\/?)(?:br|p)\s*(?:\/?)>/ /sgi; $LibraryNameTitle =~ s/<(?:[^<>'"]|'(?:[^']*)'|"(?:[^"]*)")*>//sg; @@ -1328,6 +1381,12 @@ sub checkauth { $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); $template->param( OpacPublic => C4::Context->preference("OpacPublic") ); $template->param( loginprompt => 1 ) unless $info{'nopermission'}; + if ( $additional_auth_needed ) { + $template->param( + TwoFA_prompt => 1, + invalid_otp_token => $invalid_otp_token, + ); + } if ( $type eq 'opac' ) { require Koha::Virtualshelves; @@ -1435,6 +1494,8 @@ Possible return values in C<$status> are: =item "restricted" -- The IP has changed (if SessionRestrictionByIP) +=item "additional-auth-needed -- User is in an authentication process that is not finished + =back =cut @@ -1710,6 +1771,10 @@ sub check_cookie_auth { $session->param( 'lasttime', time() ); my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1; if ($flags) { + + return ( "additional-auth-needed", $session ) + if $session->param('waiting-for-2FA'); + return ( "ok", $session ); } else { $session->delete(); --- a/Koha/Auth/TwoFactorAuth.pm +++ a/Koha/Auth/TwoFactorAuth.pm @@ -0,0 +1,31 @@ +package Koha::Auth::TwoFactorAuth; + +use Modern::Perl; +use Auth::GoogleAuth; + + +sub get_auth { + my ($params) = @_; + my $patron = $params->{patron}; + my $secret = $params->{secret}; + my $secret32 = $params->{secret32}; + + if (!$secret && !$secret32){ + $secret32 = $patron->secret; + } + + my $issuer = $patron->library->branchname; + my $key_id = sprintf "%s_%s", + $issuer, ( $patron->email || $patron->userid ); + + return Auth::GoogleAuth->new( + { + ( $secret ? ( secret => $secret ) : () ), + ( $secret32 ? ( secret32 => $secret32 ) : () ), + issuer => $issuer, + key_id => $key_id, + } + ); +} + +1; --- a/cpanfile +++ a/cpanfile @@ -1,6 +1,7 @@ requires 'Algorithm::CheckDigits', '0.5'; requires 'Array::Utils', '0.5'; requires 'Authen::CAS::Client', '0.05'; +requires 'Auth::GoogleAuth', '1.02'; requires 'Biblio::EndnoteStyle', '0.05'; requires 'Business::ISBN', '2.05'; requires 'Business::ISSN', '0.91'; --- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc +++ a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc @@ -53,7 +53,7 @@ [% END %] [% IF Koha.Preference('TwoFactorAuthentication') && logged_in_user.borrowernumber == patron.borrowernumber %] -
  • Enable Two-Factor Authentication
  • +
  • Manage two-factor authentication
  • [% END %] [% IF CAN_user_borrowers_edit_borrowers && useDischarge %] --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt @@ -8,6 +8,7 @@ [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] + [% IF TwoFA_prompt %]Two-factor authentication[% END %] [% IF ( loginprompt ) %]Log in to Koha[% END %] [% IF too_many_login_attempts %]This account has been locked. [% ELSIF invalid_username_or_password %]Invalid username or password[% END %] @@ -61,7 +62,7 @@ <p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl | $raw %]">click here</a> to login.</p> [% END %] -[% UNLESS Koha.Preference('staffShibOnly') %] +[% IF !TwoFA_prompt && !Koha.Preference('staffShibOnly') %] <!-- login prompt time--> <form action="[% script_name | html %]" method="post" name="loginform" id="loginform"> <input type="hidden" name="koha_login_context" value="intranet" /> @@ -135,6 +136,22 @@ [% END %] [% END %] [% END %] +[% ELSIF TwoFA_prompt %] + <form action="[% script_name | html %]" method="post" name="loginform" id="loginform"> + <input type="hidden" name="koha_login_context" value="intranet" /> + [% FOREACH INPUT IN INPUTS %] + <input type="hidden" name="[% INPUT.name | html %]" value="[% INPUT.value | html %]" /> + [% END %] + [% IF invalid_otp_token %] + <div class="dialog error">Invalid two-factor code</div> + [% END %] + + <p><label for="otp_token">Two-factor authentication code:</label> + <input type="text" name="otp_token" id="otp_token" class="input focus" value="" size="20" tabindex="1" /> + <p class="submit"><input id="submit-button" type="submit" value="Verify code" /></p> + <a class="logout" id="logout" href="/cgi-bin/koha/mainpage.pl?logout.x=1">Log out</a> + + </form> [% END %] [% IF ( nopermission ) %] --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt @@ -3,7 +3,7 @@ [% USE Asset %] [% SET footerjs = 1 %] [% INCLUDE 'doc-head-open.inc' %] -<title>Two-Factor Authentication › Patrons › Koha +Two-factor authentication › Patrons › Koha [% INCLUDE 'doc-head-close.inc' %] @@ -34,7 +34,7 @@ [% INCLUDE 'members-toolbar.inc' %] [% IF op == 'register' %] -

    Register Two-Factor Authenticator

    +

    Register two-factor authenticator

    We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.

    Can't scan the code?

    @@ -69,14 +69,14 @@ [% ELSE %] -

    Two-Factor Authentication

    +

    Two-factor authentication

    [% IF patron.auth_method == "two-factor" %]
    Status: Enabled
    - +
    [% ELSE %]
    Status: Disabled
    @@ -84,7 +84,7 @@
    - +
    [% END %] --- a/t/db_dependent/selenium/authentication_2fa.t +++ a/t/db_dependent/selenium/authentication_2fa.t @@ -0,0 +1,178 @@ +#!/usr/bin/perl + +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see . + +use Modern::Perl; +use Test::More tests => 2; + +use C4::Context; +use Koha::AuthUtils; +use Koha::Auth::TwoFactorAuth; +use t::lib::Mocks; +use t::lib::Selenium; +use t::lib::TestBuilder; + +my @data_to_cleanup; +my $pref_value = C4::Context->preference('TwoFactorAuthentication'); + +SKIP: { + eval { require Selenium::Remote::Driver; }; + skip "Selenium::Remote::Driver is needed for selenium tests.", 2 if $@; + + my $builder = t::lib::TestBuilder->new; + + my $patron = $builder->build_object({ class => 'Koha::Patrons', value => { flags => 1 }}); + $patron->flags(1)->store; # superlibrarian permission + my $password = Koha::AuthUtils::generate_password($patron->category); + t::lib::Mocks::mock_preference( 'RequireStrongPassword', 0 ); + $patron->set_password({ password => $password }); + + push @data_to_cleanup, $patron, $patron->category, $patron->library; + + my $s = t::lib::Selenium->new({ login => $patron->userid, password => $password }); + my $driver = $s->driver; + + subtest 'Setup' => sub { + plan tests => 10; + + my $mainpage = $s->base_url . q|mainpage.pl|; + $driver->get($mainpage); + like( $driver->get_title, qr(Log in to Koha), 'Hitting the main page should redirect to the login form'); + + fill_login_form($s); + like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' ); + + C4::Context->set_preference('TwoFactorAuthentication', 0); + $driver->get($s->base_url . q|members/two_factor_auth.pl|); + like( $driver->get_title, qr(Error 404), 'Must be redirected to 404 is the pref is off' ); + + C4::Context->set_preference('TwoFactorAuthentication', 1); + $driver->get($s->base_url . q|members/two_factor_auth.pl|); + like( $driver->get_title, qr(Two-Factor Authentication), 'Must be on the page with the pref on' ); + + is( $driver->find_element('//div[@class="two-factor-status"]')->get_text(), 'Status: Disabled', '2FA is disabled' ); + + $driver->find_element('//form[@id="two-factor-auth"]//input[@type="submit"]')->click; + ok($driver->find_element('//img[@id="qr_code"]'), 'There is a QR code'); + + $s->fill_form({pin_code => 'wrong_code'}); + $s->submit_form; + ok($driver->find_element('//div[@class="dialog error"][contains(text(), "Invalid pin code")]')); + is( $patron->get_from_storage->secret, undef, 'secret is not set in DB yet' ); + + my $secret32 = $driver->find_element('//form[@id="two-factor-auth"]//input[@name="secret32"]')->get_value(); + my $auth = Koha::Auth::TwoFactorAuth::get_auth({patron => $patron, secret32 => $secret32}); + my $code = $auth->code(); + $s->fill_form({pin_code => $code}); + $s->submit_form; + is( $driver->find_element('//div[@class="two-factor-status"]')->get_text(), 'Status: Enabled', '2FA is enabled' ); + $patron = $patron->get_from_storage; + is( $patron->secret, $secret32, 'secret is set in DB' ); + + }; + + subtest 'Login' => sub { + plan tests => 19; + + my $mainpage = $s->base_url . q|mainpage.pl|; + + { # ok first try + $driver->get($mainpage . q|?logout.x=1|); + $driver->get($s->base_url . q|circ/circulation.pl?borrowernumber=|.$patron->borrowernumber); + like( $driver->get_title, qr(Log in to Koha), 'Must be on the first auth screen' ); + $driver->capture_screenshot('selenium_failure_2.png'); + fill_login_form($s); + like( $driver->get_title, qr(Two-Factor Authentication), 'Must be on the second auth screen' ); + is( login_error($s), undef ); + + my $auth = Koha::Auth::TwoFactorAuth::get_auth({patron => $patron}); + my $code = $auth->code(); + $auth->clear; + $driver->find_element('//form[@id="loginform"]//input[@id="otp_token"]')->send_keys($code); + $driver->find_element('//input[@type="submit"]')->click; + like( $driver->get_title, qr(Checking out to ), 'Must be redirected to the original page' ); + } + + { # second try and logout + $driver->get($mainpage . q|?logout.x=1|); + $driver->get($s->base_url . q|circ/circulation.pl?borrowernumber=|.$patron->borrowernumber); + like( $driver->get_title, qr(Log in to Koha), 'Must be on the first auth screen' ); + fill_login_form($s); + like( $driver->get_title, qr(Two-Factor Authentication), 'Must be on the second auth screen' ); + is( login_error($s), undef ); + $driver->find_element('//form[@id="loginform"]//input[@id="otp_token"]')->send_keys('wrong_code'); + $driver->find_element('//input[@type="submit"]')->click; + ok($driver->find_element('//div[@class="dialog error"][contains(text(), "Invalid two-factor code")]')); + is( login_error($s), undef ); + + $driver->get($mainpage); + like( $driver->get_title, qr(Two-Factor Authentication), 'Must still be on the second auth screen' ); + is( login_error($s), undef ); + $driver->find_element('//a[@id="logout"]')->click(); + like( $driver->get_title, qr(Log in to Koha), 'Must be on the first auth screen' ); + is( login_error($s), undef ); + } + + { # second try and success + + $driver->get($mainpage . q|?logout.x=1|); + $driver->get($s->base_url . q|circ/circulation.pl?borrowernumber=|.$patron->borrowernumber); + like( $driver->get_title, qr(Log in to Koha), 'Must be on the first auth screen' ); + like( login_error($s), qr(Session timed out) ); + fill_login_form($s); + like( $driver->get_title, qr(Two-Factor Authentication), 'Must be on the second auth screen' ); + is( login_error($s), undef ); + $driver->find_element('//form[@id="loginform"]//input[@id="otp_token"]')->send_keys('wrong_code'); + $driver->find_element('//input[@type="submit"]')->click; + ok($driver->find_element('//div[@class="dialog error"][contains(text(), "Invalid two-factor code")]')); + + my $auth = Koha::Auth::TwoFactorAuth::get_auth({patron => $patron}); + my $code = $auth->code(); + $auth->clear; + $driver->find_element('//form[@id="loginform"]//input[@id="otp_token"]')->send_keys($code); + $driver->find_element('//input[@type="submit"]')->click; + like( $driver->get_title, qr(Checking out to ), 'Must be redirected to the original page' ); + } + }; + + $driver->quit(); +}; + +END { + $_->delete for @data_to_cleanup; + C4::Context->set_preference('TwoFactorAuthentication', $pref_value); +}; + + +sub login_error { + my ( $s ) = @_; + my $driver = $s->driver; + + $s->remove_error_handler; + my $login_error = eval { + my $elt = $driver->find_element('//div[@id="login_error"]'); + return $elt->get_text if $elt && $elt->id; + }; + $s->add_error_handler; + return $login_error; +} + +# Don't use the usual t::lib::Selenium->auth as we don't want the ->get($mainpage) to test the redirect +sub fill_login_form { + my ( $s ) = @_; + $s->fill_form({ userid => $s->login, password => $s->password }); + $s->driver->find_element('//input[@id="submit-button"]')->click; +} --- a/t/lib/TestBuilder.pm +++ a/t/lib/TestBuilder.pm @@ -553,6 +553,7 @@ sub _gen_default_values { lost => undef, debarred => undef, borrowernotes => '', + secret => undef, }, Item => { notforloan => 0, --