View | Details | Raw Unified | Return to bug 28786
Collapse All | Expand All

(-)a/C4/Auth.pm (-18 / +20 lines)
Lines 832-837 sub checkauth { Link Here
832
832
833
    # state variables
833
    # state variables
834
    my $loggedin = 0;
834
    my $loggedin = 0;
835
    my $auth_state = 'failed';
835
    my %info;
836
    my %info;
836
    my ( $userid, $cookie, $sessionID, $flags );
837
    my ( $userid, $cookie, $sessionID, $flags );
837
    my $logout = $query->param('logout.x');
838
    my $logout = $query->param('logout.x');
Lines 846-852 sub checkauth { Link Here
846
    my $session;
847
    my $session;
847
    my $invalid_otp_token;
848
    my $invalid_otp_token;
848
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
849
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
849
    my $auth_challenge_complete;
850
850
851
    # Basic authentication is incompatible with the use of Shibboleth,
851
    # Basic authentication is incompatible with the use of Shibboleth,
852
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
852
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 882-893 sub checkauth { Link Here
882
            $userid = $session->param('id');
882
            $userid = $session->param('id');
883
        }
883
        }
884
884
885
        $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0;
885
        $auth_state =
886
            $return eq 'ok'                     ? 'completed'
887
          : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
888
          :                                       'failed';
886
889
887
        # We are at the second screen if the waiting-for-2FA is set in session
890
        # We are at the second screen if the waiting-for-2FA is set in session
888
        # and otp_token param has been passed
891
        # and otp_token param has been passed
889
        if (   $require_2FA
892
        if (   $require_2FA
890
            && $additional_auth_needed
893
            && $auth_state eq 'additional-auth-needed'
891
            && ( my $otp_token = $query->param('otp_token') ) )
894
            && ( my $otp_token = $query->param('otp_token') ) )
892
        {
895
        {
893
            my $patron    = Koha::Patrons->find( { userid => $userid } );
896
            my $patron    = Koha::Patrons->find( { userid => $userid } );
Lines 896-905 sub checkauth { Link Here
896
            $auth->clear;
899
            $auth->clear;
897
            if ( $verified ) {
900
            if ( $verified ) {
898
                # The token is correct, the user is fully logged in!
901
                # The token is correct, the user is fully logged in!
899
                $additional_auth_needed = 0;
902
                $auth_state = 'completed';
900
                $session->param( 'waiting-for-2FA', 0 );
903
                $session->param( 'waiting-for-2FA', 0 );
901
                $return = "ok";
902
                $auth_challenge_complete = 1;
903
904
904
               # This is an ugly trick to pass the test
905
               # This is an ugly trick to pass the test
905
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
906
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
Lines 911-917 sub checkauth { Link Here
911
            }
912
            }
912
        }
913
        }
913
914
914
        if ( $return eq 'ok' ) {
915
        if ( $auth_state eq 'completed' ) {
915
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
916
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
916
917
917
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
918
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
Lines 937-945 sub checkauth { Link Here
937
                my $sessiontype = $session->param('sessiontype') || '';
938
                my $sessiontype = $session->param('sessiontype') || '';
938
                unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
939
                unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
939
                    $flags = haspermission( $userid, $flagsrequired );
940
                    $flags = haspermission( $userid, $flagsrequired );
940
                    if ($flags) {
941
                    unless ( $flags ) {
941
                        $loggedin = 1;
942
                        $auth_state = 'failed';
942
                    } else {
943
                        $info{'nopermission'} = 1;
943
                        $info{'nopermission'} = 1;
944
                    }
944
                    }
945
                }
945
                }
Lines 955-961 sub checkauth { Link Here
955
        }
955
        }
956
    }
956
    }
957
957
958
    if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) {
958
    if ( $auth_state eq 'failed' || $logout ) {
959
        $sessionID = undef;
959
        $sessionID = undef;
960
        $session   = undef;
960
        $session   = undef;
961
        $userid    = undef;
961
        $userid    = undef;
Lines 984-990 sub checkauth { Link Here
984
        $sessionID = undef;
984
        $sessionID = undef;
985
        $session   = undef;
985
        $session   = undef;
986
        $userid    = undef;
986
        $userid    = undef;
987
        $additional_auth_needed = 0;
987
        $auth_state = 'logout';
988
    }
988
    }
989
989
990
    unless ( $userid ) {
990
    unless ( $userid ) {
Lines 1134-1140 sub checkauth { Link Here
1134
            if ($return) {
1134
            if ($return) {
1135
1135
1136
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1136
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1137
                    $loggedin = 1;
1137
                    $auth_state = "logged_in";
1138
                }
1138
                }
1139
                else {
1139
                else {
1140
                    $info{'nopermission'} = 1;
1140
                    $info{'nopermission'} = 1;
Lines 1276-1293 sub checkauth { Link Here
1276
        }
1276
        }
1277
    }    # END unless ($userid)
1277
    }    # END unless ($userid)
1278
1278
1279
    if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) {
1279
1280
    if ( $require_2FA && $auth_state eq 'logged_in' ) {
1280
        my $patron = Koha::Patrons->find({userid => $userid});
1281
        my $patron = Koha::Patrons->find({userid => $userid});
1281
        if ( $patron->auth_method eq 'two-factor' ) {
1282
        if ( $patron->auth_method eq 'two-factor' ) {
1282
            # Ask for the OTP token
1283
            # Ask for the OTP token
1283
            $additional_auth_needed = 1;
1284
            $auth_state = 'additional-auth-needed';
1284
            $session->param('waiting-for-2FA', 1);
1285
            $session->param('waiting-for-2FA', 1);
1285
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1286
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1287
        } else {
1288
            $auth_state = 'completed';
1286
        }
1289
        }
1287
    }
1290
    }
1288
1291
1289
    # finished authentification, now respond
1292
    # finished authentification, now respond
1290
    if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) {
1293
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1291
        # successful login
1294
        # successful login
1292
        unless ($cookie) {
1295
        unless ($cookie) {
1293
            $cookie = $query->cookie(
1296
            $cookie = $query->cookie(
Lines 1381-1387 sub checkauth { Link Here
1381
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1384
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1382
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1385
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1383
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1386
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1384
    if ( $additional_auth_needed ) {
1387
    if ( $auth_state eq 'additional-auth-needed' ) {
1385
        $template->param(
1388
        $template->param(
1386
            TwoFA_prompt => 1,
1389
            TwoFA_prompt => 1,
1387
            invalid_otp_token => $invalid_otp_token,
1390
            invalid_otp_token => $invalid_otp_token,
1388
- 

Return to bug 28786