From 01ea1f497c4b9ff636d9770e2a8e55d8d5150835 Mon Sep 17 00:00:00 2001 From: Shi Yao Wang Date: Thu, 16 Jun 2022 16:28:30 -0400 Subject: [PATCH] Bug 30988: Add generic OpenIDConnect client implementation A generic OpenID Connect implementation. Test plan: 1- Set up an OAuth2 provider that has a discovery doc (e.g. for google it's https://accounts.google.com/.well-known/openid-configuration) and note down the client id and client secret. Docs to help setup: google: https://developers.google.com/identity/protocols/oauth2/openid-connect https://koha-community.org/manual/20.11/en/html/administrationpreferences.html gitlab: https://docs.gitlab.com/ee/integration/oauth_provider.html 2- Apply the patch 3- Run atomicupdate to update database 4- Configure system preferences: a- Set OIDC to Yes b- Enter the url to the discovery doc of your OAuth2 provider c- Fill OIDCOAuth2ClientID with noted client id d- Fill OIDCOAuth2ClientSecret with noted client secret e- Change OIDCProviderName to change the text displayed on OIDC login buttons f- Configure the other related system preferences as you wish. They shoud work the same way as the similar googleopenidconnect system preferences. 5- If OIDCAutoRegister is set to Don't allow, have a koha account with the same email as the one used by your OAuth2 provider. 6- In OPAC, sign in using OpenID Connect. 7- You may have to log into your OpenID provider account and accept conditions. It should finally log you into the koha account. Signed-off-by: David Cook --- C4/Auth.pm | 7 + .../bug_30988-add_oidc_syspref.pl | 24 ++ installer/data/mysql/mandatory/sysprefs.sql | 9 + .../en/modules/admin/preferences/admin.pref | 43 +++ .../bootstrap/en/includes/masthead.inc | 5 + .../bootstrap/en/modules/opac-auth.tt | 8 + .../bootstrap/en/modules/opac-main.tt | 3 + opac/svc/auth/openidconnect | 273 ++++++++++++++++++ 8 files changed, 372 insertions(+) create mode 100755 installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl create mode 100755 opac/svc/auth/openidconnect diff --git a/C4/Auth.pm b/C4/Auth.pm index a44cd09767..2a3eed1537 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1478,6 +1478,13 @@ sub checkauth { } } + if (C4::Context->preference('OIDC')) { + if ($query->param("OIDCFailed")) { + my $reason = $query->param('OIDCFailed'); + $template->param(invalidOIDCLogin => $reason); + } + } + $template->param( LibraryName => C4::Context->preference("LibraryName"), ); diff --git a/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl b/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl new file mode 100755 index 0000000000..2bf30a8fe9 --- /dev/null +++ b/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl @@ -0,0 +1,24 @@ +use Modern::Perl; + +return { + bug_number => "30988", + description => "Add OIDC related system preferences", + up => sub { + my ($args) = @_; + my ($dbh, $out) = @$args{qw(dbh out)}; + + $dbh->do(q{ + INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) + VALUES + ('OIDC','0',NULL,'if ON, allows the use of OpenID Connect for login','YesNo'), + ('OIDCConfigURL','',NULL,"URL to identity provider's OpenID Connect config",'Free'), + ('OIDCClientID','', NULL,'Client ID for the web app','Free'), + ('OIDCClientSecret','',NULL,'Client Secret for the web app','Free'), + ('OIDCAutoRegister','0',NULL,'OpenID Connect logins to auto-register patrons','YesNo'), + ('OIDCDefaultBranch', '','','This branch code will be used to create OpenID Connect patrons.','Textarea'), + ('OIDCDefaultCategory','','','This category code will be used to create OpenID Connect patrons.','Textarea'), + ('OIDCDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all domains', 'Free'), + ('OIDCProviderName', 'OpenID Connect', NULL, 'Name of identity provider to display', 'Free') + }); + }, +}; diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql index c1162d9f6c..920763f480 100644 --- a/installer/data/mysql/mandatory/sysprefs.sql +++ b/installer/data/mysql/mandatory/sysprefs.sql @@ -393,6 +393,15 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('OAI-PMH:ConfFile','',NULL,'If empty, Koha OAI Server operates in normal mode, otherwise it operates in extended mode.','File'), ('OAI-PMH:DeletedRecord','persistent','Koha\'s deletedbiblio table will never be deleted (persistent), might be deleted (transient), or will never have any data in it (no)','transient|persistent|no','Choice'), ('OAI-PMH:MaxCount','50',NULL,'OAI-PMH maximum number of records by answer to ListRecords and ListIdentifiers queries','Integer'), +('OIDC','0',NULL,'if ON, allows the use of OpenID Connect for login','YesNo'), +('OIDCAutoRegister','0',NULL,'OpenID Connect logins to auto-register patrons','YesNo'), +('OIDCClientID', '', NULL, 'Client ID for the web app', 'Free'), +('OIDCClientSecret', '', NULL, 'Client Secret for the web app', 'Free'), +('OIDCConfigURL','',NULL,"URL to identity provider's OpenID Connect config",'Free'), +('OIDCDefaultBranch', '','','This branch code will be used to create OpenID Connect patrons.','Textarea'), +('OIDCDefaultCategory','','','This category code will be used to create OpenID Connect patrons.','Textarea'), +('OIDCDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all domains', 'Free'), +('OIDCProviderName', 'OpenID Connect', NULL, 'Name of identity provider to display', 'Free'), ('OPACAcquisitionDetails','0','','Show the acquisition details at the OPAC','YesNo'), ('OpacAddMastheadLibraryPulldown','0','','Adds a pulldown menu to select the library to search on the opac masthead.','YesNo'), ('OpacAdvSearchMoreOptions','pubdate,itemtype,language,subtype,sorting,location','Show search options for the expanded view (More options)','pubdate|itemtype|language|subtype|sorting|location','multiple'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index 593c8c3417..7927b6fe42 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -171,6 +171,49 @@ Administration: None: "None" Common Name: Common Name emailAddress: emailAddress + OpenID Connect: + - + - "Use OpenID Connect login in the OPAC: " + - pref: OIDC + choices: + 1: "Yes" + 0: "No" + - You will need to create an app in your chosen identity provider and activate OAuth2. Requires OIDCConfigURL, OIDCClientID and OIDCClientSecret + - + - "URL to your identity provider's OpenID Connect configuration: " + - pref: OIDCConfigURL + - Along with OIDCClientID and OIDCClientSecret. Enables OIDC. + - + - "OIDC Client ID: " + - pref: OIDCClientID + - Along with OIDCConfigURL and OIDCClientSecret. Enables OIDC. + - + - "OIDC Client Secret: " + - pref: OIDCClientSecret + - Along with OIDCConfigURL and OIDCClientID. Enables OIDC. + - + - pref: OIDCAutoRegister + choices: + 1: Allow + 0: "Don't allow" + - patrons logging in with OpenID Connect to automatically register. Requires OIDC. + - + - "Use this category code when automatically registering a patron using OpenID Connect: " + - pref: OIDCDefaultCategory + choices: patron-categories + - Requires OIDC. + - + - "Use this branch code when automatically registering a patron using OpenID Connect: " + - pref: OIDCDefaultBranch + - Requires OIDC. + - + - "Restrict OpenID Connect to this domain (or subdomain of this domain): " + - pref: OIDCDomain + - Leave blank for all domains. Requires OIDC. + - + - "Name of identity provider : " + - pref: OIDCProviderName + - Associated with OIDCConfigURL. Google OpenID Connect: - - "Use Google OpenID Connect login in the OPAC: " diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc index fbab4ec2c9..f47ad5836e 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -101,6 +101,8 @@ [% ELSIF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %] + [% ELSIF ( Koha.Preference('OIDC') == 1 ) %] + [% ELSE %] [% END %] @@ -368,6 +370,9 @@ Log in with Google

If you do not have a Google account, but do have a local account, you can still log in:

[% END # /IF GoogleOpenIDConnect %] + [% IF ( Koha.Preference('OIDC') == 1 ) %] + Log in with [% Koha.Preference('OIDCProviderName') | html %] + [% END # /IF OIDC %] [% IF ( shibbolethAuthentication ) %] [% IF ( invalidShibLogin ) %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt index 62a8ee03ed..2c9f5f7828 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -165,6 +165,14 @@ Log in with Google

If you do not have a Google account, but do have a local account, you can still log in:

[% END # /IF GoogleOpenIDConnect %] + [% IF ( Koha.Preference('OIDC') == 1 ) %] + [% IF ( invalidOIDCLogin ) %] +

OpenID login

+

Sorry, your login using [% Koha.Preference('OIDCProviderName') | html %] failed. [% invalidOIDCLogin | html %]

+

Please note that the login will only work if you are using the e-mail address registered with this library.

+ [% END %] + Log in with [% Koha.Preference('OIDCProviderName') | html %] + [% END # /IF OIDC %] [% END # /UNLESS OPACShibOnly %] [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt index 8850ee7927..e3c82d7322 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt @@ -189,6 +189,9 @@ Log in with Google

If you do not have a Google account, but do have a local account, you can still log in:

[% END # /IF GoogleOpenIDConnect %] + [% IF ( Koha.Preference('OIDC') == 1 ) %] + Log in with [% Koha.Preference('OIDCProviderName') | html %] + [% END # /IF OIDC %]