View | Details | Raw Unified | Return to bug 30588
Collapse All | Expand All

(-)a/C4/Auth.pm (-2 / +7 lines)
Lines 860-866 sub checkauth { Link Here
860
860
861
    my $session;
861
    my $session;
862
    my $invalid_otp_token;
862
    my $invalid_otp_token;
863
    my $require_2FA = ( C4::Context->preference('TwoFactorAuthentication') && $type ne "opac" ) ? 1 : 0;
863
    my $require_2FA =
864
      ( $type ne "opac" # Only available for the staff interface
865
          && C4::Context->preference('TwoFactorAuthentication') ne "disabled" ) # If "enabled" or "enforced"
866
      ? 1 : 0;
864
867
865
    # Basic authentication is incompatible with the use of Shibboleth,
868
    # Basic authentication is incompatible with the use of Shibboleth,
866
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
869
    # as Shibboleth may return REMOTE_USER as a Shibboleth attribute,
Lines 1311-1317 sub checkauth { Link Here
1311
        # Auth is completed unless an additional auth is needed
1314
        # Auth is completed unless an additional auth is needed
1312
        if ( $require_2FA ) {
1315
        if ( $require_2FA ) {
1313
            my $patron = Koha::Patrons->find({userid => $userid});
1316
            my $patron = Koha::Patrons->find({userid => $userid});
1314
            if ( $patron->auth_method eq 'two-factor' ) {
1317
            if ( C4::Context->preference('TwoFactorAuthentication') eq "enforced"
1318
                || $patron->auth_method eq 'two-factor' )
1319
            {
1315
                # Ask for the OTP token
1320
                # Ask for the OTP token
1316
                $auth_state = 'additional-auth-needed';
1321
                $auth_state = 'additional-auth-needed';
1317
                $session->param('waiting-for-2FA', 1);
1322
                $session->param('waiting-for-2FA', 1);
(-)a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc (-1 / +1 lines)
Lines 56-62 Link Here
56
                    <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
56
                    <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
57
                [% END %]
57
                [% END %]
58
58
59
                [% IF Koha.Preference('TwoFactorAuthentication') && logged_in_user.borrowernumber == patron.borrowernumber %]
59
                [% IF ( Koha.Preference('TwoFactorAuthentication') == 'enforced' || Koha.Preference('TwoFactorAuthentication') == 'enabled' ) && logged_in_user.borrowernumber == patron.borrowernumber %]
60
                    <li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Manage two-factor authentication</a></li>
60
                    <li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Manage two-factor authentication</a></li>
61
                [% END %]
61
                [% END %]
62
62
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref (-3 / +3 lines)
Lines 209-215 Staff interface: Link Here
209
        -
209
        -
210
            - pref: TwoFactorAuthentication
210
            - pref: TwoFactorAuthentication
211
              choices:
211
              choices:
212
                  "enforce": Enforce
212
                  "enforced": Enforce
213
                  "enable": Enable
213
                  "enabled": Enable
214
                  "disable": "Don't enable"
214
                  "disabled": "Don't enable"
215
            - two-factor authentication (2FA) for staff members.
215
            - two-factor authentication (2FA) for staff members.
(-)a/members/two_factor_auth.pl (-1 / +2 lines)
Lines 37-43 my ( $template, $loggedinuser, $cookie ) = get_template_and_user( Link Here
37
    }
37
    }
38
);
38
);
39
39
40
unless ( C4::Context->preference('TwoFactorAuthentication') ) {
40
my $TwoFactorAuthentication = C4::Context->preference('TwoFactorAuthentication');
41
if ( $TwoFactorAuthentication ne 'enabled' && $TwoFactorAuthentication ne 'enforced' ) {
41
    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
42
    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
42
    exit;
43
    exit;
43
}
44
}
(-)a/t/db_dependent/Auth.t (-3 / +3 lines)
Lines 190-196 subtest 'checkauth() tests' => sub { Link Here
190
            $logout = 0;
190
            $logout = 0;
191
        }
191
        }
192
192
193
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 0 );
193
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 'disabled' );
194
        $patron->auth_method('password')->store;
194
        $patron->auth_method('password')->store;
195
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
195
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
196
        is( $userid, $patron->userid, 'Succesful login' );
196
        is( $userid, $patron->userid, 'Succesful login' );
Lines 203-209 subtest 'checkauth() tests' => sub { Link Here
203
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'Second auth not required' );
203
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'Second auth not required' );
204
        logout($cgi);
204
        logout($cgi);
205
205
206
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 1 );
206
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 'enabled' );
207
        t::lib::Mocks::mock_config('encryption_key', '1234tH1s=t&st');
207
        t::lib::Mocks::mock_config('encryption_key', '1234tH1s=t&st');
208
        $patron->auth_method('password')->store;
208
        $patron->auth_method('password')->store;
209
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
209
        ( $userid, $cookie, $sessionID, $flags ) = C4::Auth::checkauth( $cgi, 'authrequired', undef, 'intranet' );
Lines 238-244 subtest 'checkauth() tests' => sub { Link Here
238
        is( $userid, $patron->userid, 'Succesful login at the OPAC' );
238
        is( $userid, $patron->userid, 'Succesful login at the OPAC' );
239
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'No second auth required at the OPAC' );
239
        is( C4::Auth::get_session($sessionID)->param('waiting-for-2FA'), undef, 'No second auth required at the OPAC' );
240
240
241
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 0 );
241
        t::lib::Mocks::mock_preference( 'TwoFactorAuthentication', 'disabled' );
242
    };
242
    };
243
243
244
    C4::Context->_new_userenv; # For next tests
244
    C4::Context->_new_userenv; # For next tests
(-)a/t/db_dependent/Koha/Auth/TwoFactorAuth.t (-2 / +2 lines)
Lines 21-27 subtest 'new' => sub { Link Here
21
    plan tests => 10;
21
    plan tests => 10;
22
    $schema->storage->txn_begin;
22
    $schema->storage->txn_begin;
23
23
24
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 1);
24
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 'enabled');
25
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
25
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
26
26
27
    # Trivial test: no patron, no object
27
    # Trivial test: no patron, no object
Lines 63-69 subtest 'qr_code' => sub { Link Here
63
63
64
    $schema->storage->txn_begin;
64
    $schema->storage->txn_begin;
65
65
66
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 1);
66
    t::lib::Mocks::mock_preference('TwoFactorAuthentication', 'enabled');
67
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
67
    t::lib::Mocks::mock_config('encryption_key', 'bad_example');
68
    my $patron = $builder->build_object({ class => 'Koha::Patrons' });
68
    my $patron = $builder->build_object({ class => 'Koha::Patrons' });
69
    $patron->encode_secret('you2wont2guess2it'); # this is base32 btw
69
    $patron->encode_secret('you2wont2guess2it'); # this is base32 btw
(-)a/t/db_dependent/selenium/authentication_2fa.t (-3 / +2 lines)
Lines 55-65 SKIP: { Link Here
55
        fill_login_form($s);
55
        fill_login_form($s);
56
        like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' );
56
        like( $driver->get_title, qr(Koha staff interface), 'Patron with flags superlibrarian should be able to login' );
57
57
58
        C4::Context->set_preference('TwoFactorAuthentication', 0);
58
        C4::Context->set_preference('TwoFactorAuthentication', 'disabled');
59
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
59
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
60
        like( $driver->get_title, qr(Error 404), 'Must be redirected to 404 is the pref is off' );
60
        like( $driver->get_title, qr(Error 404), 'Must be redirected to 404 is the pref is off' );
61
61
62
        C4::Context->set_preference('TwoFactorAuthentication', 1);
62
        C4::Context->set_preference('TwoFactorAuthentication', 'enabled');
63
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
63
        $driver->get($s->base_url . q|members/two_factor_auth.pl|);
64
        like( $driver->get_title, qr(Two-factor authentication), 'Must be on the page with the pref on' );
64
        like( $driver->get_title, qr(Two-factor authentication), 'Must be on the page with the pref on' );
65
65
66
- 

Return to bug 30588