View | Details | Raw Unified | Return to bug 28786
Collapse All | Expand All

(-)a/C4/Auth.pm (-18 / +20 lines)
Lines 828-833 sub checkauth { Link Here
828
828
829
    # state variables
829
    # state variables
830
    my $loggedin = 0;
830
    my $loggedin = 0;
831
    my $auth_state = 'failed';
831
    my %info;
832
    my %info;
832
    my ( $userid, $cookie, $sessionID, $flags );
833
    my ( $userid, $cookie, $sessionID, $flags );
833
    my $logout = $query->param('logout.x');
834
    my $logout = $query->param('logout.x');
Lines 842-848 sub checkauth { Link Here
842
    my $session;
843
    my $session;
843
    my $invalid_otp_token;
844
    my $invalid_otp_token;
844
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
845
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
845
    my $auth_challenge_complete;
846
846
847
    # Basic authentication is incompatible with the use of Shibboleth,
847
    # Basic authentication is incompatible with the use of Shibboleth,
848
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
848
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 878-889 sub checkauth { Link Here
878
            $userid = $session->param('id');
878
            $userid = $session->param('id');
879
        }
879
        }
880
880
881
        $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0;
881
        $auth_state =
882
            $return eq 'ok'                     ? 'completed'
883
          : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
884
          :                                       'failed';
882
885
883
        # We are at the second screen if the waiting-for-2FA is set in session
886
        # We are at the second screen if the waiting-for-2FA is set in session
884
        # and otp_token param has been passed
887
        # and otp_token param has been passed
885
        if (   $require_2FA
888
        if (   $require_2FA
886
            && $additional_auth_needed
889
            && $auth_state eq 'additional-auth-needed'
887
            && ( my $otp_token = $query->param('otp_token') ) )
890
            && ( my $otp_token = $query->param('otp_token') ) )
888
        {
891
        {
889
            my $patron    = Koha::Patrons->find( { userid => $userid } );
892
            my $patron    = Koha::Patrons->find( { userid => $userid } );
Lines 892-901 sub checkauth { Link Here
892
            $auth->clear;
895
            $auth->clear;
893
            if ( $verified ) {
896
            if ( $verified ) {
894
                # The token is correct, the user is fully logged in!
897
                # The token is correct, the user is fully logged in!
895
                $additional_auth_needed = 0;
898
                $auth_state = 'completed';
896
                $session->param( 'waiting-for-2FA', 0 );
899
                $session->param( 'waiting-for-2FA', 0 );
897
                $return = "ok";
898
                $auth_challenge_complete = 1;
899
900
900
               # This is an ugly trick to pass the test
901
               # This is an ugly trick to pass the test
901
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
902
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
Lines 907-913 sub checkauth { Link Here
907
            }
908
            }
908
        }
909
        }
909
910
910
        if ( $return eq 'ok' ) {
911
        if ( $auth_state eq 'completed' ) {
911
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
912
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
912
913
913
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
914
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
Lines 933-941 sub checkauth { Link Here
933
                my $sessiontype = $session->param('sessiontype') || '';
934
                my $sessiontype = $session->param('sessiontype') || '';
934
                unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
935
                unless ( $sessiontype && $sessiontype eq 'anon' ) {    #if this is an anonymous session, we want to update the session, but not behave as if they are logged in...
935
                    $flags = haspermission( $userid, $flagsrequired );
936
                    $flags = haspermission( $userid, $flagsrequired );
936
                    if ($flags) {
937
                    unless ( $flags ) {
937
                        $loggedin = 1;
938
                        $auth_state = 'failed';
938
                    } else {
939
                        $info{'nopermission'} = 1;
939
                        $info{'nopermission'} = 1;
940
                    }
940
                    }
941
                }
941
                }
Lines 951-957 sub checkauth { Link Here
951
        }
951
        }
952
    }
952
    }
953
953
954
    if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) {
954
    if ( $auth_state eq 'failed' || $logout ) {
955
        $sessionID = undef;
955
        $sessionID = undef;
956
        $session   = undef;
956
        $session   = undef;
957
        $userid    = undef;
957
        $userid    = undef;
Lines 980-986 sub checkauth { Link Here
980
        $sessionID = undef;
980
        $sessionID = undef;
981
        $session   = undef;
981
        $session   = undef;
982
        $userid    = undef;
982
        $userid    = undef;
983
        $additional_auth_needed = 0;
983
        $auth_state = 'logout';
984
    }
984
    }
985
985
986
    unless ( $userid ) {
986
    unless ( $userid ) {
Lines 1130-1136 sub checkauth { Link Here
1130
            if ($return) {
1130
            if ($return) {
1131
1131
1132
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1132
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1133
                    $loggedin = 1;
1133
                    $auth_state = "logged_in";
1134
                }
1134
                }
1135
                else {
1135
                else {
1136
                    $info{'nopermission'} = 1;
1136
                    $info{'nopermission'} = 1;
Lines 1272-1289 sub checkauth { Link Here
1272
        }
1272
        }
1273
    }    # END unless ($userid)
1273
    }    # END unless ($userid)
1274
1274
1275
    if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) {
1275
1276
    if ( $require_2FA && $auth_state eq 'logged_in' ) {
1276
        my $patron = Koha::Patrons->find({userid => $userid});
1277
        my $patron = Koha::Patrons->find({userid => $userid});
1277
        if ( $patron->auth_method eq 'two-factor' ) {
1278
        if ( $patron->auth_method eq 'two-factor' ) {
1278
            # Ask for the OTP token
1279
            # Ask for the OTP token
1279
            $additional_auth_needed = 1;
1280
            $auth_state = 'additional-auth-needed';
1280
            $session->param('waiting-for-2FA', 1);
1281
            $session->param('waiting-for-2FA', 1);
1281
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1282
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1283
        } else {
1284
            $auth_state = 'completed';
1282
        }
1285
        }
1283
    }
1286
    }
1284
1287
1285
    # finished authentification, now respond
1288
    # finished authentification, now respond
1286
    if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) {
1289
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1287
        # successful login
1290
        # successful login
1288
        unless ($cookie) {
1291
        unless ($cookie) {
1289
            $cookie = $query->cookie(
1292
            $cookie = $query->cookie(
Lines 1377-1383 sub checkauth { Link Here
1377
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1380
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1378
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1381
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1379
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1382
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1380
    if ( $additional_auth_needed ) {
1383
    if ( $auth_state eq 'additional-auth-needed' ) {
1381
        $template->param(
1384
        $template->param(
1382
            TwoFA_prompt => 1,
1385
            TwoFA_prompt => 1,
1383
            invalid_otp_token => $invalid_otp_token,
1386
            invalid_otp_token => $invalid_otp_token,
1384
- 

Return to bug 28786