View | Details | Raw Unified | Return to bug 30588
Collapse All | Expand All

(-)a/C4/Auth.pm (-2 / +7 lines)
Lines 861-867 sub checkauth { Link Here
861
861
862
    my $session;
862
    my $session;
863
    my $invalid_otp_token;
863
    my $invalid_otp_token;
864
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "opac" ) ? 1 : 0;
864
    my $require_2FA =
865
      ( $type ne "opac" # Only available for the staff interface
866
          && C4::Context->preference('TwoFactorAuthentication') ne "disabled" ) # If "enabled" or "enforced"
867
      ? 1 : 0;
865
868
866
    # Basic authentication is incompatible with the use of Shibboleth,
869
    # Basic authentication is incompatible with the use of Shibboleth,
867
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
870
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 1311-1317 sub checkauth { Link Here
1311
        # Auth is completed unless an additional auth is needed
1314
        # Auth is completed unless an additional auth is needed
1312
        if ( $require_2FA ) {
1315
        if ( $require_2FA ) {
1313
            my $patron = Koha::Patrons->find({userid => $userid});
1316
            my $patron = Koha::Patrons->find({userid => $userid});
1314
            if ( $patron->auth_method eq 'two-factor' ) {
1317
            if ( C4::Context->preference('TwoFactorAuthentication') eq "enforced"
1318
                || $patron->auth_method eq 'two-factor' )
1319
            {
1315
                # Ask for the OTP token
1320
                # Ask for the OTP token
1316
                $auth_state = 'additional-auth-needed';
1321
                $auth_state = 'additional-auth-needed';
1317
                $session->param('waiting-for-2FA', 1);
1322
                $session->param('waiting-for-2FA', 1);
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc (-1 / +1 lines)
Lines 56-62 Link Here
56
                    <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
56
                    <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
57
                [% END %]
57
                [% END %]
58
58
59
                [% IF Koha.Preference('TwoFactorAuthentication') && logged_in_user.borrowernumber == patron.borrowernumber %]
59
                [% IF ( Koha.Preference('TwoFactorAuthentication') == 'enforced' || Koha.Preference('TwoFactorAuthentication') == 'enabled' ) && logged_in_user.borrowernumber == patron.borrowernumber %]
60
                    <li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Manage two-factor authentication</a></li>
60
                    <li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Manage two-factor authentication</a></li>
61
                [% END %]
61
                [% END %]
62
62
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref (-3 / +3 lines)
Lines 209-215 Staff interface: Link Here
209
        -
209
        -
210
            - pref: TwoFactorAuthentication
210
            - pref: TwoFactorAuthentication
211
              choices:
211
              choices:
212
                  "enforce": Enforce
212
                  "enforced": Enforce
213
                  "enable": Enable
213
                  "enabled": Enable
214
                  "disable": "Don't enable"
214
                  "disabled": "Don't enable"
215
            - two-factor authentication (2FA) for staff members.
215
            - two-factor authentication (2FA) for staff members.
(-)a/members/two_factor_auth.pl (-1 / +2 lines)
Lines 37-43 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
37
    }
37
    }
38
);
38
);
39
39
40
unless ( C4::Context->preference('TwoFactorAuthentication') ) {
40
my $TwoFactorAuthentication = C4::Context->preference('TwoFactorAuthentication');
41
if ( $TwoFactorAuthentication ne 'enabled' && $TwoFactorAuthentication ne 'enforced' ) {
41
    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
42
    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
42
    exit;
43
    exit;
43
}
44
}
(-)a/t/db_dependent/Auth.t (-3 / +3 lines)
Lines 150-156 subtest 'checkauth() tests' => sub { Link Here
150
            $logout = 0;
150
            $logout = 0;
151
        }
151
        }
152
152
153
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 0 );
153
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 'disabled' );
154
        $patron->auth_method('password')->store;
154
        $patron->auth_method('password')->store;
155
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
155
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
156
        is( $userid, $patron->userid, 'Succesful login' );
156
        is( $userid, $patron->userid, 'Succesful login' );
Lines 163-169 subtest 'checkauth() tests' => sub { Link Here
163
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'Second auth not required' );
163
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'Second auth not required' );
164
        logout($cgi);
164
        logout($cgi);
165
165
166
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 1 );
166
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 'enabled' );
167
        t::lib::Mocks::mock_config('encryption_key', '1234tH1s=t&st');
167
        t::lib::Mocks::mock_config('encryption_key', '1234tH1s=t&st');
168
        $patron->auth_method('password')->store;
168
        $patron->auth_method('password')->store;
169
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
169
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
Lines 198-204 subtest 'checkauth() tests' => sub { Link Here
198
        is( $userid, $patron->userid, 'Succesful login at the OPAC' );
198
        is( $userid, $patron->userid, 'Succesful login at the OPAC' );
199
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'No second auth required at the OPAC' );
199
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'No second auth required at the OPAC' );
200
200
201
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 0 );
201
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 'disabled' );
202
    };
202
    };
203
203
204
    C4::Context->_new_userenv; # For next tests
204
    C4::Context->_new_userenv; # For next tests
(-)a/t/db_dependent/Koha/Auth/TwoFactorAuth.t (-2 / +2 lines)
Lines 21-27 subtest 'new' => sub { Link Here
21
    plan tests => 10;
21
    plan tests => 10;
22
    $schema->storage->txn_begin;
22
    $schema->storage->txn_begin;
23
23
24
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 1);
24
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 'enabled');
25
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
25
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
26
26
27
    # Trivial test: no patron, no object
27
    # Trivial test: no patron, no object
Lines 63-69 subtest 'qr_code' => sub { Link Here
63
63
64
    $schema->storage->txn_begin;
64
    $schema->storage->txn_begin;
65
65
66
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 1);
66
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 'enabled');
67
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
67
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
68
    my $patron = $builder->build_object({ class => 'Koha::Patrons' });
68
    my $patron = $builder->build_object({ class => 'Koha::Patrons' });
69
    $patron->encode_secret('you2wont2guess2it'); # this is base32 btw
69
    $patron->encode_secret('you2wont2guess2it'); # this is base32 btw
(-)a/t/db_dependent/selenium/authentication_2fa.t (-3 / +2 lines)
Lines 55-65 SKIP: { Link Here
55
        fill_login_form($s);
55
        fill_login_form($s);
56
        like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' );
56
        like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' );
57
57
58
        C4::Context->set_preference('TwoFactorAuthentication', 0);
58
        C4::Context->set_preference('TwoFactorAuthentication', 'disabled');
59
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
59
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
60
        like( $driver->get_title, qr(Error 404), 'Must be redirected to 404 is the pref is off' );
60
        like( $driver->get_title, qr(Error 404), 'Must be redirected to 404 is the pref is off' );
61
61
62
        C4::Context->set_preference('TwoFactorAuthentication', 1);
62
        C4::Context->set_preference('TwoFactorAuthentication', 'enabled');
63
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
63
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
64
        like( $driver->get_title, qr(Two-factor authentication), 'Must be on the page with the pref on' );
64
        like( $driver->get_title, qr(Two-factor authentication), 'Must be on the page with the pref on' );
65
65
66
- 

Return to bug 30588