From c9255d08a0dabde76cb1415c3d2f1b36ad4a86ed Mon Sep 17 00:00:00 2001
From: Alex Buckley <alexbuckley@catalyst.net.nz>
Date: Mon, 4 Apr 2022 19:22:16 +1200
Subject: [PATCH] Bug 30444: Add shibboleth login to self checkout

This patch adds a 'Shibboleth' option to the SelfCheckoutByLogin system
preference. When 'Shibboleth' is selected the user should be logged
straight into the self check module - assuming the AutoSelfCheckAllowed,
AutoSelfCheckID and AutoSelfCheckPass system preferences are set.

Test plan:

1. Have your Koha setup to do Shibboleth login
2. Set the following system preferences:
- AutoSelfCheckAllowed => 'Allow'
- AutoSelfCheckId and AutoSelfCheckPass => Set these to a patron with
'circulate' permissions
- WebBasedSelfCheck -> 'Enable'
- OpacShibOnly -> "Don't allow"
3. Visit the self checkout page /cgi-bin/koha/sco/sco-main.pl and notice
a local login page loads
4. Apply patchset, update database and restart services
5. Set the new syspref:
- SelfCheckoutByLogin -> 'Shibboleth'
6. Visit the self checkout page and notice you're logged into the sco
interface straight away, without the local login page loading

Sponsored-by: Catalyst IT
---
 .../bug_30444-edit_SelfCheckoutByLogin_syspref.pl  | 18 ++++++++++++++++++
 installer/data/mysql/mandatory/sysprefs.sql        |  2 +-
 .../en/modules/admin/preferences/circulation.pref  |  5 +++--
 opac/sco/sco-main.pl                               | 22 +++++++++++++++++++---
 4 files changed, 41 insertions(+), 6 deletions(-)
 create mode 100755 installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl

diff --git a/installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl b/installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl
new file mode 100755
index 0000000000..018eaf0de0
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl
@@ -0,0 +1,18 @@
+use Modern::Perl;
+
+return {
+    bug_number => "30444",
+    description => "Edit existing system preference SelfCheckoutByLogin",
+    up => sub {
+        my ($args) = @_;
+        my ($dbh, $out) = @$args{qw(dbh out)};
+
+        if ( C4::Context->preference('SelfCheckoutByLogin') ) {
+            $dbh->do(q{ UPDATE systempreferences SET value="cardnumber" WHERE variable="SelfCheckoutByLogin" });
+        } else {
+            $dbh->do(q{ UPDATE systempreferences SET value="username" WHERE variable="SelfCheckoutByLogin" });
+        }
+
+        $dbh->do(q{ UPDATE systempreferences SET options="cardnumber|username|shibboleth", type="Choice", explanation="Have patrons log in to the web-based self checkout system with their username/password, their cardnumber, or using Shibboleth" WHERE variable="SelfCheckoutByLogin" });
+    },
+};
diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql
index 2ffc076e55..a7d23d6fb5 100644
--- a/installer/data/mysql/mandatory/sysprefs.sql
+++ b/installer/data/mysql/mandatory/sysprefs.sql
@@ -602,7 +602,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
 ('SelfCheckInTimeout','120','','Define the number of seconds before the self check-in module times out.','Integer'),
 ('SelfCheckInUserCSS','',NULL,'Add CSS to be included in the self check-in module in an embedded <style> tag.','free'),
 ('SelfCheckInUserJS','',NULL,'Define custom javascript for inclusion in the self check-in module.','free'),
-('SelfCheckoutByLogin','1',NULL,'Have patrons login into the web-based self checkout system with their username/password or their cardnumber','YesNo'),
+('SelfCheckoutByLogin','username','username|cardnumber|shibboleth','Have patrons log in to the web-based self checkout system with their username/password, their cardnumber, or using Shibboleth','Choice'),
 ('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'),
 ('SelfCheckTimeout','120','','Define the number of seconds before the Web-based Self Checkout times out a patron','Integer'),
 ('SendAllEmailsTo','',NULL,'All emails will be redirected to this email if it is not empty','free'),
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
index ecc49a3a90..97991aa4c9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
@@ -1110,8 +1110,9 @@ Circulation:
             - Have patrons log into the web-based self checkout system with their
             - pref: SelfCheckoutByLogin
               choices:
-                  1: username and password
-                  0: cardnumber
+                  username: username and password
+                  cardnumber: cardnumber
+                  shibboleth: Shibboleth login
             - ".</br>NOTE: If using 'cardnumber' and AutoSelfCheckAllowed you should set SelfCheckAllowByIPRanges to prevent brute force attacks to gain patron information outside the library."
         -
             - "Time out the current patron's web-based self checkout system login after"
diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index 7e056fa34e..5356e8e0cf 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -33,6 +33,7 @@ use Modern::Perl;
 use CGI qw ( -utf8 );
 
 use C4::Auth qw( in_iprange get_template_and_user checkpw );
+use C4::Auth_with_shibboleth qw( shib_ok get_login_shib );
 use C4::Circulation qw( barcodedecode AddReturn CanBookBeIssued AddIssue CanBookBeRenewed AddRenewal );
 use C4::Reserves;
 use C4::Output qw( output_html_with_http_headers );
@@ -117,7 +118,18 @@ my $issuer   = Koha::Patrons->find( $issuerid )->unblessed;
 
 my $patronid = $jwt ? Koha::Token->new->decode_jwt({ token => $jwt }) : undef;
 unless ( $patronid ) {
-    if ( C4::Context->preference('SelfCheckoutByLogin') ) {
+    if ( C4::Context->preference('SelfCheckoutByLogin') eq 'shibboleth' ) {
+        # Do Shibboleth login
+        my ($shib, $shib_login, $patron, $value);
+        $shib = C4::Context->config('useshibboleth') && shib_ok();
+        $shib_login = $shib ? get_login_shib() : undef;
+        $patron = Koha::Patrons->find({ email => $shib_login }) if $shib_login;
+        if ($patron) {
+           $patronid = $patron->userid;
+        } else {
+          undef $patronid;
+        }
+    } elsif ( C4::Context->preference('SelfCheckoutByLogin') eq 'username' ) {
         my $dbh = C4::Context->dbh;
         ( undef, $patronid ) = checkpw( $dbh, $patronlogin, $patronpw );
     }
@@ -130,8 +142,12 @@ unless ( $patronid ) {
 
 my $patron;
 if ( $patronid ) {
-    Koha::Plugins->call( 'patron_barcode_transform', \$patronid );
-    $patron = Koha::Patrons->find( { cardnumber => $patronid } );
+    if ( C4::Context->preference('SelfCheckoutByLogin') eq 'shibboleth' ) {
+        $patron = Koha::Patrons->find( { userid => $patronid } );
+    } else {
+        Koha::Plugins->call( 'patron_barcode_transform', \$patronid );
+        $patron = Koha::Patrons->find( { cardnumber => $patronid } );
+    }
 }
 
 my $branch = $issuer->{branchcode};
-- 
2.11.0