From 3e14f63cd9dc1e11138d7e8f5bf29cc7715711d9 Mon Sep 17 00:00:00 2001
From: Alex Buckley <alexbuckley@catalyst.net.nz>
Date: Mon, 4 Apr 2022 19:22:16 +1200
Subject: [PATCH] Bug 30444: Add shibboleth login to self checkout

This patch adds a 'Shibboleth' option to the SelfCheckoutByLogin system
preference. When 'Shibboleth' is selected the user should be logged
straight into the self check module - assuming the AutoSelfCheckAllowed,
AutoSelfCheckID and AutoSelfCheckPass system preferences are set.

Test plan:

1. Have your Koha setup to do Shibboleth login
2. Set the following system preferences:
- AutoSelfCheckAllowed => 'Allow'
- AutoSelfCheckId and AutoSelfCheckPass => Set these to a patron with
'circulate' permissions
- WebBasedSelfCheck -> 'Enable'
- OpacShibOnly -> "Don't allow"
3. Visit the self checkout page /cgi-bin/koha/sco/sco-main.pl and notice
a local login page loads
4. Apply patchset, update database and restart services
5. Set the new syspref:
- SelfCheckoutByLogin -> 'Shibboleth'
6. Visit the self checkout page and notice you're logged into the sco
interface straight away, without the local login page loading

Sponsored-by: Catalyst IT
---
 C4/Auth.pm                                    |  3 ++-
 ..._30444-edit_SelfCheckoutByLogin_syspref.pl | 18 ++++++++++++++
 installer/data/mysql/mandatory/sysprefs.sql   |  2 +-
 .../admin/preferences/circulation.pref        |  5 ++--
 opac/sco/sco-main.pl                          | 24 ++++++++++++++++---
 5 files changed, 45 insertions(+), 7 deletions(-)
 create mode 100755 installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 07148611151..490baa896dc 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -997,7 +997,7 @@ sub checkauth {
             my ( $return, $cardnumber );
 
             # If shib is enabled and we have a shib login, does the login match a valid koha user
-            if ( $shib && $shib_login ) {
+            if ( $shib && $shib_login && !$query->param('password')) {
                 my $retuserid;
 
                 # Do not pass password here, else shib will not be checked in checkpw.
@@ -1096,6 +1096,7 @@ sub checkauth {
                     (
                         ( $type eq 'opac' )
                         && C4::Context->preference('OPACShibOnly')
+			&& C4::Context->preference('SelfCheckoutByLogin') ne 'shibboleth'
                     )
                     || ( ( $type ne 'opac' )
                         && C4::Context->preference('staffShibOnly') )
diff --git a/installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl b/installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl
new file mode 100755
index 00000000000..018eaf0de0f
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/bug_30444-edit_SelfCheckoutByLogin_syspref.pl
@@ -0,0 +1,18 @@
+use Modern::Perl;
+
+return {
+    bug_number => "30444",
+    description => "Edit existing system preference SelfCheckoutByLogin",
+    up => sub {
+        my ($args) = @_;
+        my ($dbh, $out) = @$args{qw(dbh out)};
+
+        if ( C4::Context->preference('SelfCheckoutByLogin') ) {
+            $dbh->do(q{ UPDATE systempreferences SET value="cardnumber" WHERE variable="SelfCheckoutByLogin" });
+        } else {
+            $dbh->do(q{ UPDATE systempreferences SET value="username" WHERE variable="SelfCheckoutByLogin" });
+        }
+
+        $dbh->do(q{ UPDATE systempreferences SET options="cardnumber|username|shibboleth", type="Choice", explanation="Have patrons log in to the web-based self checkout system with their username/password, their cardnumber, or using Shibboleth" WHERE variable="SelfCheckoutByLogin" });
+    },
+};
diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql
index d6618ceb457..7ba289d224c 100644
--- a/installer/data/mysql/mandatory/sysprefs.sql
+++ b/installer/data/mysql/mandatory/sysprefs.sql
@@ -606,7 +606,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
 ('SelfCheckInTimeout','120','','Define the number of seconds before the self check-in module times out.','Integer'),
 ('SelfCheckInUserCSS','',NULL,'Add CSS to be included in the self check-in module in an embedded <style> tag.','free'),
 ('SelfCheckInUserJS','',NULL,'Define custom javascript for inclusion in the self check-in module.','free'),
-('SelfCheckoutByLogin','1',NULL,'Have patrons login into the web-based self checkout system with their username/password or their cardnumber','YesNo'),
+('SelfCheckoutByLogin','username','username|cardnumber|shibboleth','Have patrons log in to the web-based self checkout system with their username/password, their cardnumber, or using Shibboleth','Choice'),
 ('SelfCheckReceiptPrompt','1','NULL','If ON, print receipt dialog pops up when self checkout is finished','YesNo'),
 ('SelfCheckTimeout','120','','Define the number of seconds before the Web-based Self Checkout times out a patron','Integer'),
 ('SendAllEmailsTo','',NULL,'All emails will be redirected to this email if it is not empty','free'),
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
index 7a05ccdf1a9..74e1a73ae81 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/circulation.pref
@@ -1110,8 +1110,9 @@ Circulation:
             - Have patrons log into the web-based self checkout system with their
             - pref: SelfCheckoutByLogin
               choices:
-                  1: username and password
-                  0: cardnumber
+                  username: username and password
+                  cardnumber: cardnumber
+                  shibboleth: Shibboleth login
             - ".</br>NOTE: If using 'cardnumber' and AutoSelfCheckAllowed you should set SelfCheckAllowByIPRanges to prevent brute force attacks to gain patron information outside the library."
         -
             - "Time out the current patron's web-based self checkout system login after"
diff --git a/opac/sco/sco-main.pl b/opac/sco/sco-main.pl
index a89f2538d6e..3ac4cfd38d1 100755
--- a/opac/sco/sco-main.pl
+++ b/opac/sco/sco-main.pl
@@ -33,6 +33,7 @@ use Modern::Perl;
 use CGI qw ( -utf8 );
 
 use C4::Auth qw( in_iprange get_template_and_user checkpw );
+use C4::Auth_with_shibboleth qw( shib_ok get_login_shib );
 use C4::Circulation qw( barcodedecode AddReturn CanBookBeIssued AddIssue CanBookBeRenewed AddRenewal );
 use C4::Reserves;
 use C4::Output qw( output_html_with_http_headers );
@@ -117,7 +118,20 @@ my $issuer   = Koha::Patrons->find( $issuerid )->unblessed;
 
 my $patronid = $jwt ? Koha::Token->new->decode_jwt({ token => $jwt }) : undef;
 unless ( $patronid ) {
-    if ( C4::Context->preference('SelfCheckoutByLogin') ) {
+    if ( C4::Context->preference('SelfCheckoutByLogin') eq 'shibboleth' ) {
+        # Do Shibboleth login
+        my ($shib, $shib_login, $patron, $value);
+        my $shib_config = C4::Context->config('shibboleth');
+        $shib = C4::Context->config('useshibboleth') && shib_ok();
+        $shib_login = $shib ? get_login_shib() : undef;
+        my $match_point = $shib_config->{matchpoint};
+        $patron = Koha::Patrons->find({ $match_point => $shib_login }) if $shib_login;
+        if ($patron) {
+           $patronid = $patron->userid;
+        } else {
+          undef $patronid;
+        }
+    } elsif ( C4::Context->preference('SelfCheckoutByLogin') eq 'username' ) {
         my $dbh = C4::Context->dbh;
         ( undef, $patronid ) = checkpw( $dbh, $patronlogin, $patronpw );
     }
@@ -130,8 +144,12 @@ unless ( $patronid ) {
 
 my $patron;
 if ( $patronid ) {
-    Koha::Plugins->call( 'patron_barcode_transform', \$patronid );
-    $patron = Koha::Patrons->find( { cardnumber => $patronid } );
+    if ( C4::Context->preference('SelfCheckoutByLogin') eq 'shibboleth' ) {
+        $patron = Koha::Patrons->find( { userid => $patronid } );
+    } else {
+        Koha::Plugins->call( 'patron_barcode_transform', \$patronid );
+        $patron = Koha::Patrons->find( { cardnumber => $patronid } );
+    }
 }
 
 undef $jwt unless $patron;
-- 
2.20.1