View | Details | Raw Unified | Return to bug 10988
Collapse All | Expand All

(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref (-1 / +1 lines)
Lines 120-126 Administration: Link Here
120
                yes: Use
120
                yes: Use
121
                no: "Don't Use"
121
                no: "Don't Use"
122
            - Google OAuth2 login.
122
            - Google OAuth2 login.
123
            - You will need to select OAuth2 when creating an app in the google cloud console, and set the web origin to your_opac_url and the redirect url to your_opac_url/cgi-bin/koha/svc/oauthlogin .
123
            - You will need to select OAuth2 when creating an app in the google cloud console, and set the web origin to your_opac_url and the redirect url to your_opac_url/cgi-bin/koha/svc/googleoauth2 .
124
124
125
        -
125
        -
126
            - Google OAuth2 Client ID
126
            - Google OAuth2 Client ID
(-)a/opac/svc/googleoauth2 (-7 / +4 lines)
Lines 1-5 Link Here
1
#!/bin/perl -w
1
#!/bin/perl -w
2
# Copyright chris@bigballofwax.co.nz 2013
2
# Copyright vanoudt@gmail.com 2013
3
#
3
#
4
# This file is part of Koha.
4
# This file is part of Koha.
5
#
5
#
Lines 19-25 Link Here
19
#
19
#
20
# Basic OAuth2 authentication for google goes like this
20
# Basic OAuth2 authentication for google goes like this
21
# First: get your clientid, clientsecret from google. At this stage, tell google that
21
# First: get your clientid, clientsecret from google. At this stage, tell google that
22
# your redirect url is /cgi-bin/koha/svc/oauthlogin
22
# your redirect url is /cgi-bin/koha/svc/googleoauth2
23
#
23
#
24
# The first thing that happens when this script is called is that one gets redirected
24
# The first thing that happens when this script is called is that one gets redirected
25
# to an authentication url from google
25
# to an authentication url from google
Lines 29-38 Link Here
29
# json id_token, which we round-trip back to google to decrypt. Finally, we can extract
29
# json id_token, which we round-trip back to google to decrypt. Finally, we can extract
30
# the email address from this.
30
# the email address from this.
31
#
31
#
32
# There is LOTS of room for improvement here.
32
# There is some room for improvement here.
33
# 1. move the clientid, clientsecret to systempreferences
33
# 1. Google recommends verifying and decrypting the id_token locally, which means caching
34
# 2. use the OPACBaseURL preference to compute the redirecturl
35
# 4. Google recommends verifying and decrypting the id_token locally, which means caching
36
# some information and updating it daily. But that would make things a lot faster
34
# some information and updating it daily. But that would make things a lot faster
37
35
38
use strict;
36
use strict;
39
- 

Return to bug 10988