View | Details | Raw Unified | Return to bug 8446
Collapse All | Expand All

(-)a/C4/Auth.pm (-15 / +35 lines)
Lines 63-70 BEGIN { Link Here
63
    import C4::Auth_with_ldap qw(checkpw_ldap);
63
    import C4::Auth_with_ldap qw(checkpw_ldap);
64
    }
64
    }
65
    if ($shib) {
65
    if ($shib) {
66
        import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib);
66
        import C4::Auth_with_Shibboleth
67
        # Getting user login
67
          qw(checkpw_shib logout_shib login_shib_url get_login_shib);
68
69
        # Get shibboleth login attribute
68
        $shib_login = get_login_shib();
70
        $shib_login = get_login_shib();
69
    }
71
    }
70
    if ($cas) {
72
    if ($cas) {
Lines 288-293 sub get_template_and_user { Link Here
288
    }
290
    }
289
    else {    # if this is an anonymous session, setup to display public lists...
291
    else {    # if this is an anonymous session, setup to display public lists...
290
292
293
	# If shibboleth is enabled, and we have a shibboleth login attribute,
294
	# but we are in an anonymouse session, we clearly have an invalid
295
	# Shibboleth account.
296
	if ( $shib && $shib_login ) {
297
	    $template->param( invalidShibLogin => '1');
298
        }
299
291
        $template->param( sessionID        => $sessionID );
300
        $template->param( sessionID        => $sessionID );
292
        
301
        
293
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
302
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
Lines 718-723 sub checkauth { Link Here
718
        }
727
        }
719
        elsif ($logout) {
728
        elsif ($logout) {
720
            # voluntary logout the user
729
            # voluntary logout the user
730
	    # check wether the user was using their shibboleth session or a local one
731
            my $shibSuccess = C4::Context->userenv->{'shibboleth'};
721
            $session->delete();
732
            $session->delete();
722
            $session->flush;
733
            $session->flush;
723
            C4::Context->_unset_userenv($sessionID);
734
            C4::Context->_unset_userenv($sessionID);
Lines 729-736 sub checkauth { Link Here
729
                logout_cas($query);
740
                logout_cas($query);
730
            }
741
            }
731
742
732
            # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set)
743
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
733
            if ( $shib and $shib_login and $type eq 'opac') {
744
            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
734
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
745
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
735
                logout_shib($query);
746
                logout_shib($query);
736
            }
747
            }
Lines 803-822 sub checkauth { Link Here
803
        }
814
        }
804
        if (   ( $cas && $query->param('ticket') )
815
        if (   ( $cas && $query->param('ticket') )
805
            || $userid
816
            || $userid
806
            || $shib
817
            || ( $shib && $shib_login )
807
            || $pki_field ne 'None'
818
            || $pki_field ne 'None'
808
            || $persona )
819
            || $persona )
809
        {
820
        {
810
            my $password = $query->param('password');
821
            my $password = $query->param('password');
822
	    my $shibSuccess = 0;
811
823
812
            my ( $return, $cardnumber );
824
            my ( $return, $cardnumber );
813
            if ($shib && $shib_login && $type eq 'opac' && !$password) {
825
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
826
            if ( $shib && $shib_login && $type eq 'opac' ) {
814
                my $retuserid;
827
                my $retuserid;
815
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
828
		# Do not pass password here, else shib will not be checked in checkpw.
829
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
816
                $userid = $retuserid;
830
                $userid = $retuserid;
831
		$shibSuccess = $return;
817
                $info{'invalidShibLogin'} = 1 unless ($return);
832
                $info{'invalidShibLogin'} = 1 unless ($return);
818
833
            }
819
            } elsif ( $cas && $query->param('ticket') ) {
834
	    # If shib login and match were successfull, skip further login methods
835
	    unless ( $shibSuccess ) {
836
	    if ( $cas && $query->param('ticket') ) {
820
                my $retuserid;
837
                my $retuserid;
821
                ( $return, $cardnumber, $retuserid ) =
838
                ( $return, $cardnumber, $retuserid ) =
822
                  checkpw( $dbh, $userid, $password, $query );
839
                  checkpw( $dbh, $userid, $password, $query );
Lines 883-889 sub checkauth { Link Here
883
                ( $return, $cardnumber, $retuserid ) =
900
                ( $return, $cardnumber, $retuserid ) =
884
                  checkpw( $dbh, $userid, $password, $query );
901
                  checkpw( $dbh, $userid, $password, $query );
885
                $userid = $retuserid if ( $retuserid );
902
                $userid = $retuserid if ( $retuserid );
886
        }
903
		$info{'invalid_username_or_password'} = 1 unless ($return);
904
        } }
887
        if ($return) {
905
        if ($return) {
888
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
906
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
889
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
907
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
Lines 971-976 sub checkauth { Link Here
971
                    $session->param('emailaddress',$emailaddress);
989
                    $session->param('emailaddress',$emailaddress);
972
                    $session->param('ip',$session->remote_addr());
990
                    $session->param('ip',$session->remote_addr());
973
                    $session->param('lasttime',time());
991
                    $session->param('lasttime',time());
992
		    $session->param('shibboleth',$shibSuccess);
974
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
993
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
975
                }
994
                }
976
                elsif ( $return == 2 ) {
995
                elsif ( $return == 2 ) {
Lines 997-1003 sub checkauth { Link Here
997
                    $session->param('surname'),      $session->param('branch'),
1016
                    $session->param('surname'),      $session->param('branch'),
998
                    $session->param('branchname'),   $session->param('flags'),
1017
                    $session->param('branchname'),   $session->param('flags'),
999
                    $session->param('emailaddress'), $session->param('branchprinter'),
1018
                    $session->param('emailaddress'), $session->param('branchprinter'),
1000
                    $session->param('persona')
1019
                    $session->param('persona'),      $session->param('shibboleth')
1001
                );
1020
                );
1002
1021
1003
            }
1022
            }
Lines 1557-1563 sub get_session { Link Here
1557
1576
1558
sub checkpw {
1577
sub checkpw {
1559
    my ( $dbh, $userid, $password, $query ) = @_;
1578
    my ( $dbh, $userid, $password, $query ) = @_;
1560
1561
    if ($ldap) {
1579
    if ($ldap) {
1562
        $debug and print STDERR "## checkpw - checking LDAP\n";
1580
        $debug and print STDERR "## checkpw - checking LDAP\n";
1563
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
1581
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
Lines 1573-1584 sub checkpw { Link Here
1573
        return 0;
1591
        return 0;
1574
    }
1592
    }
1575
1593
1576
    # If we are in a shibboleth session (shibboleth is enabled and no password has been provided)
1594
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1577
    if ($shib && !$password) {
1595
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1596
    # time around.
1597
    if ($shib && $shib_login && !$password) {
1578
1598
1579
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1599
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1580
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1600
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1581
        # (defined in the shibbolethLoginAttribute) tto contain the login of the
1601
        # (defined under shibboleth mapping in koha-conf.xml) to contain the login of the
1582
        # shibboleth-authenticated user
1602
        # shibboleth-authenticated user
1583
1603
1584
        # Then, we check if it matches a valid koha user
1604
        # Then, we check if it matches a valid koha user
(-)a/C4/Auth_with_Shibboleth.pm (+83 lines)
Lines 105-107 sub checkpw_shib { Link Here
105
}
105
}
106
106
107
1;
107
1;
108
__END__
109
110
=head1 NAME
111
112
C4::Auth_with_shibboleth
113
114
=head1 SYNOPSIS
115
116
use C4::Auth_with_shibboleth
117
118
=head1 DESCRIPTION
119
120
This module is specific to Shibboleth authentication in koha and relies heavily upon the native shibboleth service provider package in your operating system.
121
122
=head1 CONFIGURATION
123
124
To use this type of authentication these additional packages are required:
125
126
=over
127
128
=item *
129
130
libapache2-mod-shib2
131
132
=item *
133
134
libshibsp5:amd64
135
136
=item *
137
138
shibboleth-sp2-schemas
139
140
=back
141
142
We let the native shibboleth service provider packages handle all the complexities of shibboleth negotiation for use and configuring this is beyond the scope of this documentation; But to sum up, you will need to:
143
144
=over
145
146
=item 1.
147
148
Create some metadata for your koha instance (if you're in a single instance setup then the default metadata available at https://youraddress.com/Shibboleth.sso/Metadata should be adequate)
149
150
=item 2.
151
152
Swap metadata with your Identidy Provider (IdP)
153
154
=item 3.
155
156
Map their attributes to what you want to see in koha
157
158
=item 4.
159
160
Tell apache that we wish to allow koha to authenticate via shibboleth; This is as simple as adding the below to your virtualhost config:
161
162
=begin text
163
164
<Location />
165
  AuthType shibboleth
166
  Require shibboleth
167
</Location>
168
169
=end text
170
171
=item 5.
172
173
Configure koha to listen for shibboleth environment variables; To do this we add <useshibboleth>1</useshibboleth> for the koha-conf.xml file
174
175
=item 6.
176
177
Map shibboleth attributes to koha fields in koha-conf.xml.
178
179
<shibboleth>
180
  <mapping>
181
    <userid match="1" default="">eduPersonID</userid>
182
    <categorycode default=""></categorycode>
183
  </mapping>
184
</shibboleth>
185
186
=back
187
188
=head1 FUNCTIONS
189
190
=cut
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (-1 / +13 lines)
Lines 272-277 Link Here
272
        </div>
272
        </div>
273
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
273
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
274
            <div class="modal-body">
274
            <div class="modal-body">
275
                    [% IF ( shibbolethAuthentication ) %]
276
                    [% IF ( invalidShibLogin ) %]
277
                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
278
                    <div class="alert alert-info">
279
                        <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
280
                    </div>
281
                    [% ELSE %]
282
                    <h4>Shibboleth Login</h4>
283
                    <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
284
                    <h4>Local Login</h4>
285
                    [% END %]
286
		    [% END %]
275
                    <input type="hidden" name="koha_login_context" value="opac" />
287
                    <input type="hidden" name="koha_login_context" value="opac" />
276
                    <fieldset class="brief">
288
                    <fieldset class="brief">
277
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
289
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
Lines 284-287 Link Here
284
                <a href="#" data-dismiss="modal" aria-hidden="true" class="cancel">Cancel</a>
296
                <a href="#" data-dismiss="modal" aria-hidden="true" class="cancel">Cancel</a>
285
            </div>
297
            </div>
286
        </form> <!-- /#auth -->
298
        </form> <!-- /#auth -->
287
    </div>  <!-- /#modalAuth  -->
299
    </div>  <!-- /#modalAuth  -->
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-6 / +8 lines)
Lines 58-75 Link Here
58
                            [% END %]
58
                            [% END %]
59
59
60
                            [% IF ( shibbolethAuthentication ) %]
60
                            [% IF ( shibbolethAuthentication ) %]
61
                                <h4>Shibboleth Login</h4>
62
61
63
                                [% IF ( invalidShibLogin ) %]
62
                                [% IF ( invalidShibLogin ) %]
64
                                <!-- This is what is displated if shibboleth login has failed -->
63
                                <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
65
                                <p>Sorry, the Shibboleth login failed.</p>
64
                                <div class="alert alert-info">
66
                                [% END %]
65
                                    <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
66
                                </div>
67
                                [% ELSE %]
68
                                <h4>Shibboleth Login</h4>
67
69
68
                                <p>If you have a Shibboleth account,
70
                                <p>If you have a Shibboleth account,
69
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
71
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
70
72
                                [% END %]
71
                                <h4>Local Login</h4>
73
                                <h4>Local Login</h4>
72
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in : </p>
74
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in: </p>
73
75
74
                            [% END %]
76
                            [% END %]
75
77
(-)a/opac/opac-main.pl (-2 / +7 lines)
Lines 20-25 use strict; Link Here
20
use warnings;
20
use warnings;
21
use CGI;
21
use CGI;
22
use C4::Auth;    # get_template_and_user
22
use C4::Auth;    # get_template_and_user
23
use C4::Auth_with_Shibboleth qw( login_shib_url );
23
use C4::Output;
24
use C4::Output;
24
use C4::NewsChannels;    # get_opac_news
25
use C4::NewsChannels;    # get_opac_news
25
use C4::Languages qw(getTranslatedLanguages accept_language);
26
use C4::Languages qw(getTranslatedLanguages accept_language);
Lines 43-49 $template->param( Link Here
43
    casAuthentication   => $casAuthentication,
44
    casAuthentication   => $casAuthentication,
44
);
45
);
45
46
46
$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') );
47
if ( C4::Context->config('useshibboleth') ) {
48
    $template->param(
49
        shibbolethAuthentication => C4::Context->config('useshibboleth'),
50
        shibbolethLoginUrl => C4::Auth_with_Shibboleth::login_shib_url($input)
51
    );
52
};
47
53
48
# display news
54
# display news
49
# use cookie setting for language, bug default to syspref if it's not set
55
# use cookie setting for language, bug default to syspref if it's not set
50
- 

Return to bug 8446