Lines 846-851
sub checkauth {
Link Here
|
846 |
|
846 |
|
847 |
# state variables |
847 |
# state variables |
848 |
my $loggedin = 0; |
848 |
my $loggedin = 0; |
|
|
849 |
my $auth_state = 'failed'; |
849 |
my %info; |
850 |
my %info; |
850 |
my ( $userid, $cookie, $sessionID, $flags ); |
851 |
my ( $userid, $cookie, $sessionID, $flags ); |
851 |
$cookie = []; |
852 |
$cookie = []; |
Lines 861-867
sub checkauth {
Link Here
|
861 |
my $session; |
862 |
my $session; |
862 |
my $invalid_otp_token; |
863 |
my $invalid_otp_token; |
863 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
864 |
my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "OPAC" ) ? 1 : 0; |
864 |
my $auth_challenge_complete; |
|
|
865 |
|
865 |
|
866 |
# Basic authentication is incompatible with the use of Shibboleth, |
866 |
# Basic authentication is incompatible with the use of Shibboleth, |
867 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
867 |
# as Shibboleth may return REMOTE_USER as a Shibboleth attribute, |
Lines 897-908
sub checkauth {
Link Here
|
897 |
$userid = $session->param('id'); |
897 |
$userid = $session->param('id'); |
898 |
} |
898 |
} |
899 |
|
899 |
|
900 |
$additional_auth_needed = ( $return eq 'additional-auth-needed' ) ? 1 : 0; |
900 |
$auth_state = |
|
|
901 |
$return eq 'ok' ? 'completed' |
902 |
: $return eq 'additional-auth-needed' ? 'additional-auth-needed' |
903 |
: 'failed'; |
901 |
|
904 |
|
902 |
# We are at the second screen if the waiting-for-2FA is set in session |
905 |
# We are at the second screen if the waiting-for-2FA is set in session |
903 |
# and otp_token param has been passed |
906 |
# and otp_token param has been passed |
904 |
if ( $require_2FA |
907 |
if ( $require_2FA |
905 |
&& $additional_auth_needed |
908 |
&& $auth_state eq 'additional-auth-needed' |
906 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
909 |
&& ( my $otp_token = $query->param('otp_token') ) ) |
907 |
{ |
910 |
{ |
908 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
911 |
my $patron = Koha::Patrons->find( { userid => $userid } ); |
Lines 911-920
sub checkauth {
Link Here
|
911 |
$auth->clear; |
914 |
$auth->clear; |
912 |
if ( $verified ) { |
915 |
if ( $verified ) { |
913 |
# The token is correct, the user is fully logged in! |
916 |
# The token is correct, the user is fully logged in! |
914 |
$additional_auth_needed = 0; |
917 |
$auth_state = 'completed'; |
915 |
$session->param( 'waiting-for-2FA', 0 ); |
918 |
$session->param( 'waiting-for-2FA', 0 ); |
916 |
$return = "ok"; |
|
|
917 |
$auth_challenge_complete = 1; |
918 |
|
919 |
|
919 |
# This is an ugly trick to pass the test |
920 |
# This is an ugly trick to pass the test |
920 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
921 |
# $query->param('koha_login_context') && ( $q_userid ne $userid ) |
Lines 926-932
sub checkauth {
Link Here
|
926 |
} |
927 |
} |
927 |
} |
928 |
} |
928 |
|
929 |
|
929 |
if ( $return eq 'ok' ) { |
930 |
if ( $auth_state eq 'completed' ) { |
930 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
931 |
Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch)); |
931 |
|
932 |
|
932 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
933 |
if ( ( $query->param('koha_login_context') && ( $q_userid ne $userid ) ) |
Lines 952-960
sub checkauth {
Link Here
|
952 |
)); |
953 |
)); |
953 |
|
954 |
|
954 |
$flags = haspermission( $userid, $flagsrequired ); |
955 |
$flags = haspermission( $userid, $flagsrequired ); |
955 |
if ($flags) { |
956 |
unless ( $flags ) { |
956 |
$loggedin = 1; |
957 |
$auth_state = 'failed'; |
957 |
} else { |
|
|
958 |
$info{'nopermission'} = 1; |
958 |
$info{'nopermission'} = 1; |
959 |
} |
959 |
} |
960 |
} |
960 |
} |
Lines 969-975
sub checkauth {
Link Here
|
969 |
} |
969 |
} |
970 |
} |
970 |
} |
971 |
|
971 |
|
972 |
if ( ( !$loggedin && !$additional_auth_needed ) || $logout ) { |
972 |
if ( $auth_state eq 'failed' || $logout ) { |
973 |
$sessionID = undef; |
973 |
$sessionID = undef; |
974 |
$userid = undef; |
974 |
$userid = undef; |
975 |
} |
975 |
} |
Lines 996-1002
sub checkauth {
Link Here
|
996 |
} |
996 |
} |
997 |
|
997 |
|
998 |
$session = undef; |
998 |
$session = undef; |
999 |
$additional_auth_needed = 0; |
999 |
$auth_state = 'logout'; |
1000 |
} |
1000 |
} |
1001 |
|
1001 |
|
1002 |
unless ( $userid ) { |
1002 |
unless ( $userid ) { |
Lines 1148-1154
sub checkauth {
Link Here
|
1148 |
if ($return) { |
1148 |
if ($return) { |
1149 |
|
1149 |
|
1150 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1150 |
if ( $flags = haspermission( $userid, $flagsrequired ) ) { |
1151 |
$loggedin = 1; |
1151 |
$auth_state = "logged_in"; |
1152 |
} |
1152 |
} |
1153 |
else { |
1153 |
else { |
1154 |
$info{'nopermission'} = 1; |
1154 |
$info{'nopermission'} = 1; |
Lines 1298-1315
sub checkauth {
Link Here
|
1298 |
$session->flush; |
1298 |
$session->flush; |
1299 |
} # END unless ($userid) |
1299 |
} # END unless ($userid) |
1300 |
|
1300 |
|
1301 |
if ( $require_2FA && ( $loggedin && !$auth_challenge_complete)) { |
1301 |
|
1302 |
my $patron = Koha::Patrons->find({userid => $userid}); |
1302 |
if ( $auth_state eq 'logged_in' ) { |
1303 |
if ( $patron->auth_method eq 'two-factor' ) { |
1303 |
$auth_state = 'completed'; |
1304 |
# Ask for the OTP token |
1304 |
|
1305 |
$additional_auth_needed = 1; |
1305 |
# Auth is completed unless an additional auth is needed |
1306 |
$session->param('waiting-for-2FA', 1); |
1306 |
if ( $require_2FA ) { |
1307 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1307 |
my $patron = Koha::Patrons->find({userid => $userid}); |
|
|
1308 |
if ( $patron->auth_method eq 'two-factor' ) { |
1309 |
# Ask for the OTP token |
1310 |
$auth_state = 'additional-auth-needed'; |
1311 |
$session->param('waiting-for-2FA', 1); |
1312 |
%info = ();# We remove the warnings/errors we may have set incorrectly before |
1313 |
} |
1308 |
} |
1314 |
} |
1309 |
} |
1315 |
} |
1310 |
|
1316 |
|
1311 |
# finished authentification, now respond |
1317 |
# finished authentification, now respond |
1312 |
if ( ( $loggedin || $authnotrequired ) && !$additional_auth_needed ) { |
1318 |
if ( $auth_state eq 'completed' || $authnotrequired ) { |
1313 |
# successful login |
1319 |
# successful login |
1314 |
unless (@$cookie) { |
1320 |
unless (@$cookie) { |
1315 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( |
1321 |
$cookie = $cookie_mgr->replace_in_list( $cookie, $query->cookie( |
Lines 1401-1407
sub checkauth {
Link Here
|
1401 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1407 |
$template->param( SCI_login => 1 ) if ( $query->param('sci_user_login') ); |
1402 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1408 |
$template->param( OpacPublic => C4::Context->preference("OpacPublic") ); |
1403 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1409 |
$template->param( loginprompt => 1 ) unless $info{'nopermission'}; |
1404 |
if ( $additional_auth_needed ) { |
1410 |
if ( $auth_state eq 'additional-auth-needed' ) { |
1405 |
$template->param( |
1411 |
$template->param( |
1406 |
TwoFA_prompt => 1, |
1412 |
TwoFA_prompt => 1, |
1407 |
invalid_otp_token => $invalid_otp_token, |
1413 |
invalid_otp_token => $invalid_otp_token, |
1408 |
- |
|
|