View | Details | Raw Unified | Return to bug 28786
Collapse All | Expand All

(-)a/C4/Auth.pm (-18 / +20 lines)
Lines 827-832 sub checkauth { Link Here
827
827
828
    # state variables
828
    # state variables
829
    my $loggedin = 0;
829
    my $loggedin = 0;
830
    my $auth_state = 'failed';
830
    my %info;
831
    my %info;
831
    my ( $userid, $cookie, $sessionID, $flags );
832
    my ( $userid, $cookie, $sessionID, $flags );
832
    my $logout = $query->param('logout.x');
833
    my $logout = $query->param('logout.x');
Lines 841-847 sub checkauth { Link Here
841
    my $session;
842
    my $session;
842
    my $invalid_otp_token;
843
    my $invalid_otp_token;
843
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
844
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
844
    my $auth_challenge_complete;
845
845
846
    # Basic authentication is incompatible with the use of Shibboleth,
846
    # Basic authentication is incompatible with the use of Shibboleth,
847
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
847
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 877-888 sub checkauth { Link Here
877
            $userid = $session->param('id');
877
            $userid = $session->param('id');
878
        }
878
        }
879
879
880
        $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0;
880
        $auth_state =
881
            $return eq 'ok'                     ? 'completed'
882
          : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
883
          :                                       'failed';
881
884
882
        # We are at the second screen if the waiting-for-2FA is set in session
885
        # We are at the second screen if the waiting-for-2FA is set in session
883
        # and otp_token param has been passed
886
        # and otp_token param has been passed
884
        if (   $require_2FA
887
        if (   $require_2FA
885
            && $additional_auth_needed
888
            && $auth_state eq 'additional-auth-needed'
886
            && ( my $otp_token = $query->param('otp_token') ) )
889
            && ( my $otp_token = $query->param('otp_token') ) )
887
        {
890
        {
888
            my $patron    = Koha::Patrons->find( { userid => $userid } );
891
            my $patron    = Koha::Patrons->find( { userid => $userid } );
Lines 891-900 sub checkauth { Link Here
891
            $auth->clear;
894
            $auth->clear;
892
            if ( $verified ) {
895
            if ( $verified ) {
893
                # The token is correct, the user is fully logged in!
896
                # The token is correct, the user is fully logged in!
894
                $additional_auth_needed = 0;
897
                $auth_state = 'completed';
895
                $session->param( 'waiting-for-2FA', 0 );
898
                $session->param( 'waiting-for-2FA', 0 );
896
                $return = "ok";
897
                $auth_challenge_complete = 1;
898
899
899
               # This is an ugly trick to pass the test
900
               # This is an ugly trick to pass the test
900
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
901
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
Lines 906-912 sub checkauth { Link Here
906
            }
907
            }
907
        }
908
        }
908
909
909
        if ( $return eq 'ok' ) {
910
        if ( $auth_state eq 'completed' ) {
910
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
911
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
911
912
912
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
913
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
Lines 930-938 sub checkauth { Link Here
930
                );
931
                );
931
932
932
                $flags = haspermission( $userid, $flagsrequired );
933
                $flags = haspermission( $userid, $flagsrequired );
933
                if ($flags) {
934
                unless ( $flags ) {
934
                    $loggedin = 1;
935
                    $auth_state = 'failed';
935
                } else {
936
                    $info{'nopermission'} = 1;
936
                    $info{'nopermission'} = 1;
937
                }
937
                }
938
            }
938
            }
Lines 947-953 sub checkauth { Link Here
947
        }
947
        }
948
    }
948
    }
949
949
950
    if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) {
950
    if ( $auth_state eq 'failed' || $logout ) {
951
        $sessionID = undef;
951
        $sessionID = undef;
952
        $session   = undef;
952
        $session   = undef;
953
        $userid    = undef;
953
        $userid    = undef;
Lines 976-982 sub checkauth { Link Here
976
        $sessionID = undef;
976
        $sessionID = undef;
977
        $session   = undef;
977
        $session   = undef;
978
        $userid    = undef;
978
        $userid    = undef;
979
        $additional_auth_needed = 0;
979
        $auth_state = 'logout';
980
    }
980
    }
981
981
982
    unless ( $userid ) {
982
    unless ( $userid ) {
Lines 1126-1132 sub checkauth { Link Here
1126
            if ($return) {
1126
            if ($return) {
1127
1127
1128
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1128
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1129
                    $loggedin = 1;
1129
                    $auth_state = "logged_in";
1130
                }
1130
                }
1131
                else {
1131
                else {
1132
                    $info{'nopermission'} = 1;
1132
                    $info{'nopermission'} = 1;
Lines 1268-1285 sub checkauth { Link Here
1268
        }
1268
        }
1269
    }    # END unless ($userid)
1269
    }    # END unless ($userid)
1270
1270
1271
    if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) {
1271
1272
    if ( $require_2FA && $auth_state eq 'logged_in' ) {
1272
        my $patron = Koha::Patrons->find({userid => $userid});
1273
        my $patron = Koha::Patrons->find({userid => $userid});
1273
        if ( $patron->auth_method eq 'two-factor' ) {
1274
        if ( $patron->auth_method eq 'two-factor' ) {
1274
            # Ask for the OTP token
1275
            # Ask for the OTP token
1275
            $additional_auth_needed = 1;
1276
            $auth_state = 'additional-auth-needed';
1276
            $session->param('waiting-for-2FA', 1);
1277
            $session->param('waiting-for-2FA', 1);
1277
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1278
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1279
        } else {
1280
            $auth_state = 'completed';
1278
        }
1281
        }
1279
    }
1282
    }
1280
1283
1281
    # finished authentification, now respond
1284
    # finished authentification, now respond
1282
    if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) {
1285
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1283
        # successful login
1286
        # successful login
1284
        unless ($cookie) {
1287
        unless ($cookie) {
1285
            $cookie = $query->cookie(
1288
            $cookie = $query->cookie(
Lines 1371-1377 sub checkauth { Link Here
1371
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1374
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1372
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1375
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1373
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1376
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1374
    if ( $additional_auth_needed ) {
1377
    if ( $auth_state eq 'additional-auth-needed' ) {
1375
        $template->param(
1378
        $template->param(
1376
            TwoFA_prompt => 1,
1379
            TwoFA_prompt => 1,
1377
            invalid_otp_token => $invalid_otp_token,
1380
            invalid_otp_token => $invalid_otp_token,
1378
- 

Return to bug 28786