@@ -, +, @@ https://koha-community.org/manual/20.11/en/html/administrationpreferences.html a- Set OIDC to Yes b- Enter the url to the discovery doc of your OAuth2 provider c- Fill OIDCOAuth2ClientID with noted client id d- Fill OIDCOAuth2ClientSecret with noted client secret e- Configure the other related system preferences as you wish. They --- C4/Auth.pm | 7 + .../bug_30988-add_oidc_syspref.pl | 23 ++ installer/data/mysql/mandatory/sysprefs.sql | 8 + .../en/modules/admin/preferences/admin.pref | 39 +++ .../bootstrap/en/includes/masthead.inc | 6 + .../bootstrap/en/modules/opac-auth.tt | 9 + .../bootstrap/en/modules/opac-main.tt | 4 + opac/svc/auth/openidconnect | 273 ++++++++++++++++++ 8 files changed, 369 insertions(+) create mode 100755 installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl create mode 100755 opac/svc/auth/openidconnect --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -1478,6 +1478,13 @@ sub checkauth { } } + if (C4::Context->preference('OIDC')) { + if ($query->param("OIDCFailed")) { + my $reason = $query->param('OIDCFailed'); + $template->param(invalidOIDCLogin => $reason); + } + } + $template->param( LibraryName => C4::Context->preference("LibraryName"), ); --- a/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl +++ a/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl @@ -0,0 +1,23 @@ +use Modern::Perl; + +return { + bug_number => "30988", + description => "Add OIDC related system preferences", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + $dbh->do(q{ + INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) + VALUES + ('OIDC','0',NULL,'if ON, allows the use of OpenID Connect for login','YesNo'), + ('OIDCConfigURL','',NULL,"URL to identity provider's OpenID config",'Free'), + ('OIDCOAuth2ClientID','', NULL,'Client ID for the web app','Free'), + ('OIDCOAuth2ClientSecret','',NULL,'Client Secret for the web app','Free'), + ('OIDCAutoRegister','0',NULL,'OpenID Connect logins to auto-register patrons','YesNo'), + ('OIDCDefaultBranch', '','','This branch code will be used to create OpenID Connect patrons.','Textarea'), + ('OIDCDefaultCategory','','','This category code will be used to create OpenID Connect patrons.','Textarea'), + ('OIDCDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all domains', 'Free') + }); + }, +}; --- a/installer/data/mysql/mandatory/sysprefs.sql +++ a/installer/data/mysql/mandatory/sysprefs.sql @@ -391,6 +391,14 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('OAI-PMH:ConfFile','',NULL,'If empty, Koha OAI Server operates in normal mode, otherwise it operates in extended mode.','File'), ('OAI-PMH:DeletedRecord','persistent','Koha\'s deletedbiblio table will never be deleted (persistent), might be deleted (transient), or will never have any data in it (no)','transient|persistent|no','Choice'), ('OAI-PMH:MaxCount','50',NULL,'OAI-PMH maximum number of records by answer to ListRecords and ListIdentifiers queries','Integer'), +('OIDC','0',NULL,'if ON, allows the use of OpenID Connect for login','YesNo'), +('OIDCAutoRegister','0',NULL,'OpenID Connect logins to auto-register patrons','YesNo'), +('OIDCConfigURL','',NULL,"URL to identity provider's OpenID config",'Free'), +('OIDCDefaultBranch', '','','This branch code will be used to create OpenID Connect patrons.','Textarea'), +('OIDCDefaultCategory','','','This category code will be used to create OpenID Connect patrons.','Textarea'), +('OIDCDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all domains', 'Free'), +('OIDCOAuth2ClientID', '', NULL, 'Client ID for the web app', 'Free'), +('OIDCOAuth2ClientSecret', '', NULL, 'Client Secret for the web app', 'Free'), ('OPACAcquisitionDetails','0','','Show the acquisition details at the OPAC','YesNo'), ('OpacAddMastheadLibraryPulldown','0','','Adds a pulldown menu to select the library to search on the opac masthead.','YesNo'), ('OpacAdvSearchMoreOptions','pubdate,itemtype,language,subtype,sorting,location','Show search options for the expanded view (More options)','pubdate|itemtype|language|subtype|sorting|location','multiple'), --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -171,6 +171,45 @@ Administration: None: "None" Common Name: Common Name emailAddress: emailAddress + OpenID Connect: + - + - "Use OpenID Connect login in the OPAC: " + - pref: OIDC + choices: + 1: "Yes" + 0: "No" + - You will need to create an app in your chosen identity provider and activate OAuth2. Requires OIDCConfigURL, OAuth2ClientID and OAuth2ClientSecret + - + - "URL to your identity provider's OpenID configuration: " + - pref: OIDCConfigURL + - Along with OAuth2ClientID and OAuth2ClientSecret. Enables OIDC. + - + - "OAuth2 Client ID: " + - pref: OIDCOAuth2ClientID + - Along with OIDCConfigURL and OAuth2ClientSecret. Enables OIDC. + - + - "OAuth2 Client Secret: " + - pref: OIDCOAuth2ClientSecret + - Along with OIDCConfigURL and OAuth2ClientID. Enables OIDC. + - + - pref: OIDCAutoRegister + choices: + 1: Allow + 0: "Don't allow" + - patrons logging in with OpenID to automatically register. Requires OIDC. + - + - "Use this category code when automatically registering a patron using OpenID: " + - pref: OIDCDefaultCategory + choices: patron-categories + - Requires OIDC. + - + - "Use this branch code when automatically registering a patron using OpenID: " + - pref: OIDCDefaultBranch + - Requires OIDC. + - + - "Restrict OpenID Connect to this domain (or subdomain of this domain): " + - pref: OIDCDomain + - Leave blank for all domains. Requires OIDC. Google OpenID Connect: - - "Use Google OpenID Connect login in the OPAC: " --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -101,6 +101,8 @@ Log in to your account [% ELSIF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %] Log in to your account + [% ELSIF ( Koha.Preference('OIDC') == 1 ) %] + Log in to your account [% ELSE %] Log in to your account [% END %] @@ -368,6 +370,10 @@ Log in with Google
If you do not have a Google account, but do have a local account, you can still log in:
[% END # /IF GoogleOpenIDConnect %] + [% IF ( Koha.Preference('OIDC') == 1 ) %] + Log in with OpenID Connect +If you do not have an OpenID account from the provider specified in this library, but do have a local account, you can still log in:
+ [% END # /IF OIDC %] [% IF ( shibbolethAuthentication ) %] [% IF ( invalidShibLogin ) %] --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -165,6 +165,15 @@ Log in with GoogleIf you do not have a Google account, but do have a local account, you can still log in:
[% END # /IF GoogleOpenIDConnect %] + [% IF ( Koha.Preference('OIDC') == 1 ) %] + [% IF ( invalidOIDCLogin ) %] +Sorry, your login using OpenID Connect failed. [% invalidOIDCLogin | html %]
+Please note that the login will only work if you are using the e-mail address registered with this library.
+ [% END %] + Log in with OpenID Connect +If you do not have an OpenID account from the provider specified in this library, but do have a local account, you can still log in:
+ [% END # /IF OIDC %] [% END # /UNLESS OPACShibOnly %] [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %] --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt +++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt @@ -189,6 +189,10 @@ Log in with GoogleIf you do not have a Google account, but do have a local account, you can still log in:
[% END # /IF GoogleOpenIDConnect %] + [% IF ( Koha.Preference('OIDC') == 1 ) %] + Log in with OpenID Connect +If you do not have an OpenID account from the provider specified in this library, but do have a local account, you can still log in:
+ [% END # /IF OIDC %] --- a/opac/svc/auth/openidconnect +++ a/opac/svc/auth/openidconnect @@ -0,0 +1,273 @@ +#!/usr/bin/perl +# +# This file is part of Koha. +# +# Koha is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# Koha is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Koha; if not, see