From 3a5670bdcd1d3178ed60419a18ca1fdb9625e1dd Mon Sep 17 00:00:00 2001 From: Tomas Cohen Arazi Date: Tue, 5 Aug 2025 15:35:17 -0300 Subject: [PATCH] Bug 40596: Integrate CAS and Shibboleth compatibility layers into C4::Auth Integrates the modern CAS and Shibboleth compatibility layers into the legacy authentication system, providing a bridge between old and new implementations. Changes to C4::Auth: * Updated imports to use compatibility layers instead of direct legacy calls * Added calls to CASCompat::authenticate_cas_user() for CAS authentication * Added calls to ShibbolethCompat::authenticate_shibboleth_user() for Shibboleth * Updated CAS provider lookup to use CASCompat::get_cas_providers() * Added runtime loading of compatibility modules for test scenarios * Maintains full backward compatibility with existing authentication flows The compatibility layers use modern client-level architecture internally while presenting the legacy interface expected by C4::Auth. Test plan: 1. Apply patch 2. Test CAS authentication with existing configurations 3. Test Shibboleth authentication with existing configurations 4. Test user auto-creation and updates work as expected 5. Run t/db_dependent/Auth.t and verify CAS/Shibboleth tests pass 6. Verify no regressions in OAuth or internal authentication --- C4/Auth.pm | 39 ++++++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index affc7ee43a2..bf33e313da5 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -48,7 +48,7 @@ use Koha::Patrons; use Koha::Patron::Consents; use List::MoreUtils qw( any ); use Encode; -use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib ); +use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib ); use Net::CIDR; use C4::Log qw( logaction ); use Koha::CookieManager; @@ -78,9 +78,11 @@ BEGIN { $caslogout = C4::Context->preference('casLogout'); if ($cas) { - require C4::Auth_with_cas; # no import - import C4::Auth_with_cas - qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required multipleAuth getMultipleAuth); + require C4::Auth_with_cas; # no import - legacy functions still needed + import C4::Auth_with_cas qw(check_api_auth_cas login_cas logout_cas login_cas_url logout_if_required); + + # Use modern CAS compatibility layer for authentication + require Koha::Auth::CASCompat; } } @@ -152,9 +154,11 @@ BEGIN { $caslogout = C4::Context->preference('casLogout'); if ($cas) { - require C4::Auth_with_cas; # no import - import C4::Auth_with_cas - qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url logout_if_required multipleAuth getMultipleAuth); + require C4::Auth_with_cas; # no import - legacy functions still needed + import C4::Auth_with_cas qw(check_api_auth_cas login_cas logout_cas login_cas_url logout_if_required); + + # Use modern CAS compatibility layer for authentication + require Koha::Auth::CASCompat; } } @@ -1566,9 +1570,8 @@ sub checkauth { if ($cas) { # Is authentication against multiple CAS servers enabled? - require C4::Auth_with_cas; - if ( multipleAuth() && !$casparam ) { - my $casservers = getMultipleAuth(); + my ( $default_cas, $casservers ) = Koha::Auth::CASCompat::get_cas_providers(); + if ( keys %$casservers > 1 && !$casparam ) { my @tmplservers; foreach my $key ( keys %$casservers ) { push @tmplservers, { name => $key, value => login_cas_url( $query, $key, $type ) . "?cas=$key" }; @@ -2099,9 +2102,15 @@ sub checkpw { # In case of a CAS authentication, we use the ticket instead of the password my $ticket = $query->param('ticket'); - $query->delete('ticket'); # remove ticket to come back to original URL + $query->delete('ticket'); # remove ticket to come back to original URL + my $cas_server = $query->param('cas'); # Get CAS server parameter + + # Ensure CASCompat is loaded (needed for tests that set $cas after module load) + require Koha::Auth::CASCompat; + my ( $retval, $retcard, $retuserid, $cas_ticket ); - ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) = checkpw_cas( $ticket, $query, $type ); # EXTERNAL AUTH + ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) = + Koha::Auth::CASCompat::authenticate_cas_user( $ticket, $query, $type, $cas_server ); # EXTERNAL AUTH if ($retval) { @return = ( $retval, $retcard, $retuserid, $patron, $cas_ticket ); } else { @@ -2121,9 +2130,13 @@ sub checkpw { # Then, we check if it matches a valid koha user if ($shib_login) { + + # Ensure ShibbolethCompat is loaded (needed for tests that set $shib after module load) + require Koha::Auth::ShibbolethCompat; + my ( $retval, $retcard, $retuserid ); ( $retval, $retcard, $retuserid, $patron ) = - C4::Auth_with_shibboleth::checkpw_shib($shib_login); # EXTERNAL AUTH + Koha::Auth::ShibbolethCompat::authenticate_shibboleth_user($shib_login); # EXTERNAL AUTH if ($retval) { @return = ( $retval, $retcard, $retuserid, $patron ); } -- 2.50.1