From 3ec16b07e38cfc9f93bb182a1ede02ea46381389 Mon Sep 17 00:00:00 2001 From: Jacob O'Mara Date: Tue, 4 Nov 2025 15:22:22 +0000 Subject: [PATCH] Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication - Remove OPACShibOnly and staffShibOnly sysprefs (now in shibboleth_config table) - Add ShibbolethAuthentication syspref to replace useshibboleth XML config - Update to check syspref instead of XML - Only show Shibboleth configuration link when ShibbolethAuthentication is enabled --- C4/Auth.pm | 9 ++++++--- installer/data/mysql/mandatory/sysprefs.sql | 3 +-- koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc | 2 +- .../intranet-tmpl/prog/en/modules/admin/admin-home.tt | 4 ++++ .../prog/en/modules/admin/preferences/admin.pref | 9 +++++++++ .../prog/en/modules/admin/preferences/opac.pref | 6 ------ .../en/modules/admin/preferences/staff_interface.pref | 8 +------- koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc | 4 ++-- koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt | 8 ++++---- opac/opac-user.pl | 2 +- 10 files changed, 29 insertions(+), 26 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 9bd841eec06..3a49df795b0 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -197,7 +197,7 @@ sub get_template_and_user { my $cookie_mgr = Koha::CookieManager->new; # Get shibboleth login attribute - my $shib = C4::Context->config('useshibboleth') && shib_ok(); + my $shib = C4::Context->preference('ShibbolethAuthentication') && shib_ok(); my $shib_login = $shib ? get_login_shib() : undef; C4::Context->interface( $in->{type} ); @@ -448,6 +448,7 @@ sub get_template_and_user { $template->param( shibbolethAuthentication => $shib, shibbolethLoginUrl => login_shib_url( $in->{'query'} ), + shibbolethOnly => get_force_sso_setting( $in->{'type'} ), ); # If shibboleth is enabled and we have a shibboleth login attribute, @@ -843,7 +844,7 @@ sub checkauth { my $query = shift; # Get shibboleth login attribute - my $shib = C4::Context->config('useshibboleth') && shib_ok(); + my $shib = C4::Context->preference('ShibbolethAuthentication') && shib_ok(); my $shib_login = $shib ? get_login_shib() : undef; # $authnotrequired will be set for scripts which will run without authentication @@ -1492,6 +1493,7 @@ sub checkauth { script_name => get_script_name(), casAuthentication => C4::Context->preference("casAuthentication"), shibbolethAuthentication => $shib, + shibbolethOnly => get_force_sso_setting($type), suggestion => C4::Context->preference("suggestion"), virtualshelves => C4::Context->preference("virtualshelves"), LibraryName => "" . C4::Context->preference("LibraryName"), @@ -1589,6 +1591,7 @@ sub checkauth { $template->param( shibbolethAuthentication => $shib, shibbolethLoginUrl => login_shib_url($query), + shibbolethOnly => get_force_sso_setting($type), ); } @@ -2060,7 +2063,7 @@ sub checkpw { $type = 'opac' unless $type; # Get shibboleth login attribute - my $shib = C4::Context->config('useshibboleth') && shib_ok(); + my $shib = C4::Context->preference('ShibbolethAuthentication') && shib_ok(); my $shib_login = $shib ? get_login_shib() : undef; my $anonymous_patron = C4::Context->preference('AnonymousPatron'); diff --git a/installer/data/mysql/mandatory/sysprefs.sql b/installer/data/mysql/mandatory/sysprefs.sql index b47f27df977..4387a4e5fe6 100644 --- a/installer/data/mysql/mandatory/sysprefs.sql +++ b/installer/data/mysql/mandatory/sysprefs.sql @@ -567,7 +567,6 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('opacSerialDefaultTab','subscriptions','holdings|serialcollection|subscriptions|titlenotes','Define the default tab for serials in OPAC.','Choice'), ('OPACSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the OPAC','Integer'), ('OPACShelfBrowser','1','','Enable/disable Shelf Browser on item details page. WARNING: this feature is very resource consuming on collections with large numbers of items.','YesNo'), -('OPACShibOnly','0','','If ON enables shibboleth only authentication for the opac','YesNo'), ('OPACShowCheckoutName','0','','Displays in the OPAC the name of patron who has checked out the material. WARNING: Most sites should leave this off. It is intended for corporate or special sites which need to track who has the item.','YesNo'), ('OPACShowHoldQueueDetails','none','none|priority|holds|holds_priority','Show holds details in OPAC','Choice'), ('OPACShowLibraries', '1', '', 'If enabled, a link is shown in the OPAC pointing to a page with library information', 'YesNo'), @@ -745,6 +744,7 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('ShelfBrowserUsesCcode','1','0','Use the item collection code when finding items for the shelf browser.','YesNo'), ('ShelfBrowserUsesHomeBranch','1','1','Use the item home branch when finding items for the shelf browser.','YesNo'), ('ShelfBrowserUsesLocation','1','1','Use the item location when finding items for the shelf browser.','YesNo'), +('ShibbolethAuthentication','0','','Enable or disable Shibboleth authentication integration','YesNo'), ('ShowAllCheckins', '0', '', 'Show all checkins', 'YesNo'), ('ShowComponentRecords', 'nowhere', 'nowhere|staff|opac|both','In which record detail pages to show list of the component records, as linked via 773','Choice'), ('ShowHeadingUse', '0', NULL, 'Show whether MARC21 authority record contains an established heading that conforms to descriptive cataloguing rules, and can therefore be used as a main/added entry, or subject, or series title', 'YesNo'), @@ -776,7 +776,6 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('StaffLoginRestrictLibraryByIP','0',NULL,'If ON, IP authentication is enabled, blocking access to the staff interface from unauthorized IP addresses based on branch','YesNo'), ('StaffSearchResultsDisplayBranch','holdingbranch','holdingbranch|homebranch','Controls the display of the home or holding branch for staff search results','Choice'), ('StaffSerialIssueDisplayCount','3','','Number of serial issues to display per subscription in the staff interface','Integer'), -('staffShibOnly','0','','If ON enables shibboleth only authentication for the staff client','YesNo'), ('StaticHoldsQueueWeight','0',NULL,'Specify a list of library location codes separated by commas -- the list of codes will be traversed and weighted with first values given higher weight for holds fulfillment -- alternatively, if RandomizeHoldsQueueWeight is set, the list will be randomly selective','Integer'), ('StatisticsFields','location|itype|ccode', NULL, 'Define Fields (from the items table) used for statistics members','Free'), ('StockRotation','0',NULL,'If ON, enables the stock rotation module','YesNo'), diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc index 7d7e710d060..2116d9b645d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/admin-menu.inc @@ -40,7 +40,7 @@
  • Library transfer limits
  • Transport cost matrix
  • [% END %] - [% IF ( CAN_user_parameters_manage_identity_providers ) %] + [% IF ( CAN_user_parameters_manage_identity_providers && Koha.Preference('ShibbolethAuthentication') ) %]
  • Shibboleth configuration
  • [% END %] [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt index bf92a4c1f8c..9d2d6dfe7c1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/admin-home.tt @@ -109,6 +109,10 @@
    Transport cost matrix
    Define transport costs between branches
    [% END %] + [% IF ( CAN_user_parameters_manage_identity_providers && Koha.Preference('ShibbolethAuthentication') ) %] +
    Shibboleth configuration
    +
    Configure Shibboleth authentication settings, field mappings, and SSO options
    + [% END %] [% IF ( CAN_user_parameters_manage_item_circ_alerts ) %]
    Item circulation alerts
    Define rules for check-in and checkout notifications for combinations of libraries, patron categories, and item types
    diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref index eac9b14907b..23f3b715c18 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -155,6 +155,15 @@ Administration: 0: "Don't force" - "library selection when logging into the staff interface." + Shibboleth authentication: + - + - "Use Shibboleth for login authentication: " + - pref: ShibbolethAuthentication + default: 0 + choices: + 1: "Yes" + 0: "No" + CAS authentication: - - "Use CAS for login authentication: " diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref index 8b4769c17e2..cf3e178279d 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref @@ -1015,9 +1015,3 @@ OPAC: - "fields (separate values with |). Tabs appear in the order listed.
    " - "Currently supported values: Item types (itemtypes), Collection, (ccode) and Shelving location (loc)." Authentication: - - - - pref: OPACShibOnly - choices: - 1: "Don't allow" - 0: Allow - - patrons to login by means other than Shibboleth. diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref index 8dd0817a3a8..cadf43ccb97 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref @@ -204,16 +204,10 @@ Staff interface: - 'records when downloading from the reports module.
    NOTE: Only a positive value will enforce a limit. A specific limit in the report overrides this setting.' Authentication: - - - - pref: staffShibOnly - choices: - 1: "Don't allow" - 0: Allow - - staff to login by means other than shibboleth. - - pref: TwoFactorAuthentication choices: "enforced": Enforce "enabled": Enable "disabled": "Don't enable" - - two-factor authentication (2FA) for staff members. \ No newline at end of file + - two-factor authentication (2FA) for staff members. diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc index c136dfeb29a..98b6935f947 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -135,8 +135,8 @@ Log out [% ELSE %] - [% IF Koha.Preference('casAuthentication') %] - [%# CAS authentication is too complicated for modal window %] + [% IF Koha.Preference('casAuthentication') || shibbolethOnly %] + [%# CAS authentication and Shibboleth force SSO are too complicated for modal window %] Log in to your account diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt index 6d6c135cc1a..be5f6c8fcd5 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt @@ -97,7 +97,7 @@
    - [% UNLESS ( Koha.Preference('OPACShibOnly') ) %] + [% UNLESS ( shibbolethOnly ) %] [% IF ( casAuthentication ) %] [% IF ( invalidCasLogin ) %] @@ -114,7 +114,7 @@

    Shibboleth login

    Log in using a Shibboleth account.

    [% END # /IF invalidShibLogin %] - [% UNLESS ( Koha.Preference('OPACShibOnly') ) %] + [% UNLESS ( shibbolethOnly ) %] [% IF ( casAuthentication ) %]

    CAS login

    If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.

    @@ -125,7 +125,7 @@ [% END %] [% END # /IF shibbolethAuthentication %] - [% UNLESS ( Koha.Preference('OPACShibOnly') ) %] + [% UNLESS ( shibbolethOnly ) %] [% IF ( casAuthentication ) %] [% IF ( shibbolethAuthentication ) %] [% IF ( casServerUrl ) %] @@ -227,7 +227,7 @@ [% ELSE %]

    You must contact the library to reset your password

    [% END %] - [% ELSIF !Koha.Preference('OPACShibOnly') or SCO_login or SCI_login %] + [% ELSIF !shibbolethOnly or SCO_login or SCI_login %] [% SET form_action = script_name %] [% IF SCO_login %] [% form_action = "/cgi-bin/koha/sco/sco-main.pl" %] diff --git a/opac/opac-user.pl b/opac/opac-user.pl index e0671b33aa5..d12d14643b8 100755 --- a/opac/opac-user.pl +++ b/opac/opac-user.pl @@ -82,7 +82,7 @@ for ( C4::Context->preference("OPACShowHoldQueueDetails") ) { my $patronupdate = $query->param('patronupdate'); my $canrenew = 1; -$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') ); +$template->param( shibbolethAuthentication => C4::Context->preference('ShibbolethAuthentication') ); # get borrower information .... my $patron = Koha::Patrons->find($borrowernumber); -- 2.39.5