@@ -, +, @@
https://koha-community.org/manual/20.11/en/html/administrationpreferences.html
a- Set OIDC to Yes
b- Enter the url to the discovery doc of your OAuth2 provider
c- Fill OIDCOAuth2ClientID with noted client id
d- Fill OIDCOAuth2ClientSecret with noted client secret
e- Change OIDCProviderName to change the text displayed on OIDC login
f- Configure the other related system preferences as you wish. They
---
C4/Auth.pm | 7 +
.../bug_30988-add_oidc_syspref.pl | 24 ++
installer/data/mysql/mandatory/sysprefs.sql | 9 +
.../en/modules/admin/preferences/admin.pref | 43 +++
.../bootstrap/en/includes/masthead.inc | 5 +
.../bootstrap/en/modules/opac-auth.tt | 8 +
.../bootstrap/en/modules/opac-main.tt | 3 +
opac/svc/auth/openidconnect | 273 ++++++++++++++++++
8 files changed, 372 insertions(+)
create mode 100755 installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl
create mode 100755 opac/svc/auth/openidconnect
--- a/C4/Auth.pm
+++ a/C4/Auth.pm
@@ -1478,6 +1478,13 @@ sub checkauth {
}
}
+ if (C4::Context->preference('OIDC')) {
+ if ($query->param("OIDCFailed")) {
+ my $reason = $query->param('OIDCFailed');
+ $template->param(invalidOIDCLogin => $reason);
+ }
+ }
+
$template->param(
LibraryName => C4::Context->preference("LibraryName"),
);
--- a/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl
+++ a/installer/data/mysql/atomicupdate/bug_30988-add_oidc_syspref.pl
@@ -0,0 +1,24 @@
+use Modern::Perl;
+
+return {
+ bug_number => "30988",
+ description => "Add OIDC related system preferences",
+ up => sub {
+ my ($args) = @_;
+ my ($dbh, $out) = @$args{qw(dbh out)};
+
+ $dbh->do(q{
+ INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type)
+ VALUES
+ ('OIDC','0',NULL,'if ON, allows the use of OpenID Connect for login','YesNo'),
+ ('OIDCConfigURL','',NULL,"URL to identity provider's OpenID Connect config",'Free'),
+ ('OIDCClientID','', NULL,'Client ID for the web app','Free'),
+ ('OIDCClientSecret','',NULL,'Client Secret for the web app','Free'),
+ ('OIDCAutoRegister','0',NULL,'OpenID Connect logins to auto-register patrons','YesNo'),
+ ('OIDCDefaultBranch', '','','This branch code will be used to create OpenID Connect patrons.','Textarea'),
+ ('OIDCDefaultCategory','','','This category code will be used to create OpenID Connect patrons.','Textarea'),
+ ('OIDCDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all domains', 'Free'),
+ ('OIDCProviderName', 'OpenID Connect', NULL, 'Name of identity provider to display', 'Free')
+ });
+ },
+};
--- a/installer/data/mysql/mandatory/sysprefs.sql
+++ a/installer/data/mysql/mandatory/sysprefs.sql
@@ -393,6 +393,15 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, `
('OAI-PMH:ConfFile','',NULL,'If empty, Koha OAI Server operates in normal mode, otherwise it operates in extended mode.','File'),
('OAI-PMH:DeletedRecord','persistent','Koha\'s deletedbiblio table will never be deleted (persistent), might be deleted (transient), or will never have any data in it (no)','transient|persistent|no','Choice'),
('OAI-PMH:MaxCount','50',NULL,'OAI-PMH maximum number of records by answer to ListRecords and ListIdentifiers queries','Integer'),
+('OIDC','0',NULL,'if ON, allows the use of OpenID Connect for login','YesNo'),
+('OIDCAutoRegister','0',NULL,'OpenID Connect logins to auto-register patrons','YesNo'),
+('OIDCClientID', '', NULL, 'Client ID for the web app', 'Free'),
+('OIDCClientSecret', '', NULL, 'Client Secret for the web app', 'Free'),
+('OIDCConfigURL','',NULL,"URL to identity provider's OpenID Connect config",'Free'),
+('OIDCDefaultBranch', '','','This branch code will be used to create OpenID Connect patrons.','Textarea'),
+('OIDCDefaultCategory','','','This category code will be used to create OpenID Connect patrons.','Textarea'),
+('OIDCDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all domains', 'Free'),
+('OIDCProviderName', 'OpenID Connect', NULL, 'Name of identity provider to display', 'Free'),
('OPACAcquisitionDetails','0','','Show the acquisition details at the OPAC','YesNo'),
('OpacAddMastheadLibraryPulldown','0','','Adds a pulldown menu to select the library to search on the opac masthead.','YesNo'),
('OpacAdvSearchMoreOptions','pubdate,itemtype,language,subtype,sorting,location','Show search options for the expanded view (More options)','pubdate|itemtype|language|subtype|sorting|location','multiple'),
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
+++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref
@@ -171,6 +171,49 @@ Administration:
None: "None"
Common Name: Common Name
emailAddress: emailAddress
+ OpenID Connect:
+ -
+ - "Use OpenID Connect login in the OPAC: "
+ - pref: OIDC
+ choices:
+ 1: "Yes"
+ 0: "No"
+ - You will need to create an app in your chosen identity provider and activate OAuth2. Requires OIDCConfigURL, OIDCClientID and OIDCClientSecret
+ -
+ - "URL to your identity provider's OpenID Connect configuration: "
+ - pref: OIDCConfigURL
+ - Along with OIDCClientID and OIDCClientSecret. Enables OIDC.
+ -
+ - "OIDC Client ID: "
+ - pref: OIDCClientID
+ - Along with OIDCConfigURL and OIDCClientSecret. Enables OIDC.
+ -
+ - "OIDC Client Secret: "
+ - pref: OIDCClientSecret
+ - Along with OIDCConfigURL and OIDCClientID. Enables OIDC.
+ -
+ - pref: OIDCAutoRegister
+ choices:
+ 1: Allow
+ 0: "Don't allow"
+ - patrons logging in with OpenID Connect to automatically register. Requires OIDC.
+ -
+ - "Use this category code when automatically registering a patron using OpenID Connect: "
+ - pref: OIDCDefaultCategory
+ choices: patron-categories
+ - Requires OIDC.
+ -
+ - "Use this branch code when automatically registering a patron using OpenID Connect: "
+ - pref: OIDCDefaultBranch
+ - Requires OIDC.
+ -
+ - "Restrict OpenID Connect to this domain (or subdomain of this domain): "
+ - pref: OIDCDomain
+ - Leave blank for all domains. Requires OIDC.
+ -
+ - "Name of identity provider : "
+ - pref: OIDCProviderName
+ - Associated with OIDCConfigURL.
Google OpenID Connect:
-
- "Use Google OpenID Connect login in the OPAC: "
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
@@ -101,6 +101,8 @@
Log in to your account
[% ELSIF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
Log in to your account
+ [% ELSIF ( Koha.Preference('OIDC') == 1 ) %]
+ Log in to your account
[% ELSE %]
Log in to your account
[% END %]
@@ -368,6 +370,9 @@
Log in with Google
If you do not have a Google account, but do have a local account, you can still log in:
[% END # /IF GoogleOpenIDConnect %]
+ [% IF ( Koha.Preference('OIDC') == 1 ) %]
+ Log in with [% Koha.Preference('OIDCProviderName') | html %]
+ [% END # /IF OIDC %]
[% IF ( shibbolethAuthentication ) %]
[% IF ( invalidShibLogin ) %]
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
@@ -165,6 +165,14 @@
Log in with Google
If you do not have a Google account, but do have a local account, you can still log in:
[% END # /IF GoogleOpenIDConnect %]
+ [% IF ( Koha.Preference('OIDC') == 1 ) %]
+ [% IF ( invalidOIDCLogin ) %]
+
OpenID login
+
Sorry, your login using [% Koha.Preference('OIDCProviderName') | html %] failed. [% invalidOIDCLogin | html %]
+
Please note that the login will only work if you are using the e-mail address registered with this library.
+ [% END %]
+ Log in with [% Koha.Preference('OIDCProviderName') | html %]
+ [% END # /IF OIDC %]
[% END # /UNLESS OPACShibOnly %]
[% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %]
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
+++ a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-main.tt
@@ -189,6 +189,9 @@
Log in with Google
If you do not have a Google account, but do have a local account, you can still log in: