View | Details | Raw Unified | Return to bug 28786
Collapse All | Expand All

(-)a/C4/Auth.pm (-23 / +28 lines)
Lines 846-851 sub checkauth { Link Here
846
846
847
    # state variables
847
    # state variables
848
    my $loggedin = 0;
848
    my $loggedin = 0;
849
    my $auth_state = 'failed';
849
    my %info;
850
    my %info;
850
    my ( $userid, $cookie, $sessionID, $flags );
851
    my ( $userid, $cookie, $sessionID, $flags );
851
    $cookie = [];
852
    $cookie = [];
Lines 861-867 sub checkauth { Link Here
861
    my $session;
862
    my $session;
862
    my $invalid_otp_token;
863
    my $invalid_otp_token;
863
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
864
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0;
864
    my $auth_challenge_complete;
865
865
866
    # Basic authentication is incompatible with the use of Shibboleth,
866
    # Basic authentication is incompatible with the use of Shibboleth,
867
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
867
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 897-908 sub checkauth { Link Here
897
            $userid = $session->param('id');
897
            $userid = $session->param('id');
898
        }
898
        }
899
899
900
        $additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0;
900
        $auth_state =
901
            $return eq 'ok'                     ? 'completed'
902
          : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
903
          :                                       'failed';
901
904
902
        # We are at the second screen if the waiting-for-2FA is set in session
905
        # We are at the second screen if the waiting-for-2FA is set in session
903
        # and otp_token param has been passed
906
        # and otp_token param has been passed
904
        if (   $require_2FA
907
        if (   $require_2FA
905
            && $additional_auth_needed
908
            && $auth_state eq 'additional-auth-needed'
906
            && ( my $otp_token = $query->param('otp_token') ) )
909
            && ( my $otp_token = $query->param('otp_token') ) )
907
        {
910
        {
908
            my $patron    = Koha::Patrons->find( { userid => $userid } );
911
            my $patron    = Koha::Patrons->find( { userid => $userid } );
Lines 911-920 sub checkauth { Link Here
911
            $auth->clear;
914
            $auth->clear;
912
            if ( $verified ) {
915
            if ( $verified ) {
913
                # The token is correct, the user is fully logged in!
916
                # The token is correct, the user is fully logged in!
914
                $additional_auth_needed = 0;
917
                $auth_state = 'completed';
915
                $session->param( 'waiting-for-2FA', 0 );
918
                $session->param( 'waiting-for-2FA', 0 );
916
                $return = "ok";
917
                $auth_challenge_complete = 1;
918
919
919
               # This is an ugly trick to pass the test
920
               # This is an ugly trick to pass the test
920
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
921
               # $query->param('koha_login_context') && ( $q_userid ne $userid )
Lines 926-932 sub checkauth { Link Here
926
            }
927
            }
927
        }
928
        }
928
929
929
        if ( $return eq 'ok' ) {
930
        if ( $auth_state eq 'completed' ) {
930
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
931
            Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
931
932
932
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
933
            if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) )
Lines 952-960 sub checkauth { Link Here
952
                ));
953
                ));
953
954
954
                $flags = haspermission( $userid, $flagsrequired );
955
                $flags = haspermission( $userid, $flagsrequired );
955
                if ($flags) {
956
                unless ( $flags ) {
956
                    $loggedin = 1;
957
                    $auth_state = 'failed';
957
                } else {
958
                    $info{'nopermission'} = 1;
958
                    $info{'nopermission'} = 1;
959
                }
959
                }
960
            }
960
            }
Lines 969-975 sub checkauth { Link Here
969
        }
969
        }
970
    }
970
    }
971
971
972
    if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) {
972
    if ( $auth_state eq 'failed' || $logout ) {
973
        $sessionID = undef;
973
        $sessionID = undef;
974
        $userid    = undef;
974
        $userid    = undef;
975
    }
975
    }
Lines 996-1002 sub checkauth { Link Here
996
        }
996
        }
997
997
998
        $session   = undef;
998
        $session   = undef;
999
        $additional_auth_needed = 0;
999
        $auth_state = 'logout';
1000
    }
1000
    }
1001
1001
1002
    unless ( $userid ) {
1002
    unless ( $userid ) {
Lines 1148-1154 sub checkauth { Link Here
1148
            if ($return) {
1148
            if ($return) {
1149
1149
1150
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1150
                if ( $flags = haspermission( $userid, $flagsrequired ) ) {
1151
                    $loggedin = 1;
1151
                    $auth_state = "logged_in";
1152
                }
1152
                }
1153
                else {
1153
                else {
1154
                    $info{'nopermission'} = 1;
1154
                    $info{'nopermission'} = 1;
Lines 1298-1315 sub checkauth { Link Here
1298
        $session->flush;
1298
        $session->flush;
1299
    }    # END unless ($userid)
1299
    }    # END unless ($userid)
1300
1300
1301
    if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) {
1301
1302
        my $patron = Koha::Patrons->find({userid => $userid});
1302
    if ( $auth_state eq 'logged_in' ) {
1303
        if ( $patron->auth_method eq 'two-factor' ) {
1303
        $auth_state = 'completed';
1304
            # Ask for the OTP token
1304
1305
            $additional_auth_needed = 1;
1305
        # Auth is completed unless an additional auth is needed
1306
            $session->param('waiting-for-2FA', 1);
1306
        if ( $require_2FA ) {
1307
            %info = ();# We remove the warnings/errors we may have set incorrectly before
1307
            my $patron = Koha::Patrons->find({userid => $userid});
1308
            if ( $patron->auth_method eq 'two-factor' ) {
1309
                # Ask for the OTP token
1310
                $auth_state = 'additional-auth-needed';
1311
                $session->param('waiting-for-2FA', 1);
1312
                %info = ();# We remove the warnings/errors we may have set incorrectly before
1313
            }
1308
        }
1314
        }
1309
    }
1315
    }
1310
1316
1311
    # finished authentification, now respond
1317
    # finished authentification, now respond
1312
    if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) {
1318
    if ( $auth_state eq 'completed' || $authnotrequired ) {
1313
        # successful login
1319
        # successful login
1314
        unless (@$cookie) {
1320
        unless (@$cookie) {
1315
            $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
1321
            $cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie(
Lines 1401-1407 sub checkauth { Link Here
1401
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1407
    $template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') );
1402
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1408
    $template->param( OpacPublic => C4::Context->preference("OpacPublic") );
1403
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1409
    $template->param( loginprompt => 1 ) unless $info{'nopermission'};
1404
    if ( $additional_auth_needed ) {
1410
    if ( $auth_state eq 'additional-auth-needed' ) {
1405
        $template->param(
1411
        $template->param(
1406
            TwoFA_prompt => 1,
1412
            TwoFA_prompt => 1,
1407
            invalid_otp_token => $invalid_otp_token,
1413
            invalid_otp_token => $invalid_otp_token,
1408
- 

Return to bug 28786