From b4286db0d9676c3719e4ef89ce073a60b82dd9b1 Mon Sep 17 00:00:00 2001 From: Jacob O'Mara Date: Tue, 4 Nov 2025 15:22:18 +0000 Subject: [PATCH] Bug 39224: integrate database-backed shibboleth configuration Update authentication code to read Shibboleth configuration from database instead of koha-conf.xml. Add get_force_sso_setting function to retrieve SSO settings from database. --- C4/Auth.pm | 16 ++++------------ C4/Auth_with_shibboleth.pm | 36 +++++++++++++++++++++++++++++++++--- 2 files changed, 37 insertions(+), 15 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 20242735e1a..9bd841eec06 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -48,7 +48,7 @@ use Koha::Patrons; use Koha::Patron::Consents; use List::MoreUtils qw( any ); use Encode; -use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib ); +use C4::Auth_with_shibboleth qw( shib_ok get_login_shib login_shib_url logout_shib checkpw_shib get_force_sso_setting ); use Net::CIDR; use C4::Log qw( logaction ); use Koha::CookieManager; @@ -1183,15 +1183,9 @@ sub checkauth { } # If shib configured and shibOnly enabled, we should ignore anything other than a shibboleth type login. - if ( - $shib + if ( $shib && !$shibSuccess - && ( - ( ( $type eq 'opac' ) && C4::Context->preference('OPACShibOnly') ) - || ( ( $type ne 'opac' ) - && C4::Context->preference('staffShibOnly') ) - ) - ) + && get_force_sso_setting($type) ) { $return = 0; } @@ -1586,9 +1580,7 @@ sub checkauth { if ($shib) { #If shibOnly is enabled just go ahead and redirect directly - if ( ( ( $type eq 'opac' ) && C4::Context->preference('OPACShibOnly') ) - || ( ( $type ne 'opac' ) && C4::Context->preference('staffShibOnly') ) ) - { + if ( get_force_sso_setting($type) ) { my $redirect_url = login_shib_url($query); print $query->redirect( -uri => "$redirect_url", -status => 303 ); safe_exit; diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm index 45c397a8ba6..47e261bf0d4 100644 --- a/C4/Auth_with_shibboleth.pm +++ b/C4/Auth_with_shibboleth.pm @@ -29,13 +29,14 @@ use Carp qw( carp ); use List::MoreUtils qw( any ); use Koha::Logger; +use Koha::ShibbolethConfigs; our ( @ISA, @EXPORT_OK ); BEGIN { require Exporter; @ISA = qw(Exporter); - @EXPORT_OK = qw(shib_ok logout_shib login_shib_url checkpw_shib get_login_shib); + @EXPORT_OK = qw(shib_ok logout_shib login_shib_url checkpw_shib get_login_shib get_force_sso_setting); } # Check that shib config is not malformed @@ -243,14 +244,34 @@ sub _get_return { return $uri_base_part . URI::Escape::uri_escape_utf8($uri_params_part); } +sub get_force_sso_setting { + my ($interface) = @_; + + my $db_config = Koha::ShibbolethConfigs->new->get_configuration; + return 0 unless $db_config; + + if ( $interface eq 'opac' ) { + return $db_config->get_value('force_opac_sso') || 0; + } else { + return $db_config->get_value('force_staff_sso') || 0; + } +} + sub _get_shib_config { - my $config = C4::Context->config('shibboleth'); + my $db_config = Koha::ShibbolethConfigs->new->get_configuration; - if ( !$config ) { + if ( !$db_config ) { Koha::Logger->get->warn('shibboleth config not defined'); return 0; } + my $config = $db_config->get_combined_config; + + if ( !$config ) { + Koha::Logger->get->warn('shibboleth config could not be loaded'); + return 0; + } + if ( $config->{matchpoint} && defined( $config->{mapping}->{ $config->{matchpoint} }->{is} ) ) { @@ -408,6 +429,15 @@ A sugar function to that simply returns the current page URI with appropriate pr This routine is NOT exported +=head2 get_force_sso_setting + + my $force_sso = get_force_sso_setting($interface); + +Returns the force SSO setting for the given interface (opac or intranet). +Returns 0 if shibboleth is not configured or the setting is disabled. + + $interface - 'opac' or 'intranet' + =head2 _get_shib_config my $config = _get_shib_config(); -- 2.39.5