View | Details | Raw Unified | Return to bug 8446
Collapse All | Expand All

(-)a/C4/Auth.pm (-15 / +35 lines)
Lines 64-71 BEGIN { Link Here
64
    import C4::Auth_with_ldap qw(checkpw_ldap);
64
    import C4::Auth_with_ldap qw(checkpw_ldap);
65
    }
65
    }
66
    if ($shib) {
66
    if ($shib) {
67
        import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib);
67
        import C4::Auth_with_Shibboleth
68
        # Getting user login
68
          qw(checkpw_shib logout_shib login_shib_url get_login_shib);
69
70
        # Get shibboleth login attribute
69
        $shib_login = get_login_shib();
71
        $shib_login = get_login_shib();
70
    }
72
    }
71
    if ($cas) {
73
    if ($cas) {
Lines 295-300 sub get_template_and_user { Link Here
295
    }
297
    }
296
    else {    # if this is an anonymous session, setup to display public lists...
298
    else {    # if this is an anonymous session, setup to display public lists...
297
299
300
	# If shibboleth is enabled, and we have a shibboleth login attribute,
301
	# but we are in an anonymouse session, we clearly have an invalid
302
	# Shibboleth account.
303
	if ( $shib && $shib_login ) {
304
	    $template->param( invalidShibLogin => '1');
305
        }
306
298
        $template->param( sessionID        => $sessionID );
307
        $template->param( sessionID        => $sessionID );
299
        
308
        
300
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
309
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
Lines 735-740 sub checkauth { Link Here
735
        }
744
        }
736
        elsif ($logout) {
745
        elsif ($logout) {
737
            # voluntary logout the user
746
            # voluntary logout the user
747
	    # check wether the user was using their shibboleth session or a local one
748
            my $shibSuccess = C4::Context->userenv->{'shibboleth'};
738
            $session->delete();
749
            $session->delete();
739
            $session->flush;
750
            $session->flush;
740
            C4::Context->_unset_userenv($sessionID);
751
            C4::Context->_unset_userenv($sessionID);
Lines 746-753 sub checkauth { Link Here
746
                logout_cas($query);
757
                logout_cas($query);
747
            }
758
            }
748
759
749
            # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set)
760
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
750
            if ( $shib and $shib_login and $type eq 'opac') {
761
            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
751
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
762
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
752
                logout_shib($query);
763
                logout_shib($query);
753
            }
764
            }
Lines 820-839 sub checkauth { Link Here
820
        }
831
        }
821
        if (   ( $cas && $query->param('ticket') )
832
        if (   ( $cas && $query->param('ticket') )
822
            || $userid
833
            || $userid
823
            || $shib
834
            || ( $shib && $shib_login )
824
            || $pki_field ne 'None'
835
            || $pki_field ne 'None'
825
            || $persona )
836
            || $persona )
826
        {
837
        {
827
            my $password = $query->param('password');
838
            my $password = $query->param('password');
839
	    my $shibSuccess = 0;
828
840
829
            my ( $return, $cardnumber );
841
            my ( $return, $cardnumber );
830
            if ($shib && $shib_login && $type eq 'opac' && !$password) {
842
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
843
            if ( $shib && $shib_login && $type eq 'opac' ) {
831
                my $retuserid;
844
                my $retuserid;
832
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
845
		# Do not pass password here, else shib will not be checked in checkpw.
846
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
833
                $userid = $retuserid;
847
                $userid = $retuserid;
848
		$shibSuccess = $return;
834
                $info{'invalidShibLogin'} = 1 unless ($return);
849
                $info{'invalidShibLogin'} = 1 unless ($return);
835
850
            }
836
            } elsif ( $cas && $query->param('ticket') ) {
851
	    # If shib login and match were successfull, skip further login methods
852
	    unless ( $shibSuccess ) {
853
	    if ( $cas && $query->param('ticket') ) {
837
                my $retuserid;
854
                my $retuserid;
838
                ( $return, $cardnumber, $retuserid ) =
855
                ( $return, $cardnumber, $retuserid ) =
839
                  checkpw( $dbh, $userid, $password, $query );
856
                  checkpw( $dbh, $userid, $password, $query );
Lines 900-906 sub checkauth { Link Here
900
                ( $return, $cardnumber, $retuserid ) =
917
                ( $return, $cardnumber, $retuserid ) =
901
                  checkpw( $dbh, $userid, $password, $query );
918
                  checkpw( $dbh, $userid, $password, $query );
902
                $userid = $retuserid if ( $retuserid );
919
                $userid = $retuserid if ( $retuserid );
903
        }
920
		$info{'invalid_username_or_password'} = 1 unless ($return);
921
        } }
904
        if ($return) {
922
        if ($return) {
905
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
923
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
906
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
924
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
Lines 988-993 sub checkauth { Link Here
988
                    $session->param('emailaddress',$emailaddress);
1006
                    $session->param('emailaddress',$emailaddress);
989
                    $session->param('ip',$session->remote_addr());
1007
                    $session->param('ip',$session->remote_addr());
990
                    $session->param('lasttime',time());
1008
                    $session->param('lasttime',time());
1009
		    $session->param('shibboleth',$shibSuccess);
991
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
1010
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
992
                }
1011
                }
993
                elsif ( $return == 2 ) {
1012
                elsif ( $return == 2 ) {
Lines 1014-1020 sub checkauth { Link Here
1014
                    $session->param('surname'),      $session->param('branch'),
1033
                    $session->param('surname'),      $session->param('branch'),
1015
                    $session->param('branchname'),   $session->param('flags'),
1034
                    $session->param('branchname'),   $session->param('flags'),
1016
                    $session->param('emailaddress'), $session->param('branchprinter'),
1035
                    $session->param('emailaddress'), $session->param('branchprinter'),
1017
                    $session->param('persona')
1036
                    $session->param('persona'),      $session->param('shibboleth')
1018
                );
1037
                );
1019
1038
1020
            }
1039
            }
Lines 1574-1580 sub get_session { Link Here
1574
1593
1575
sub checkpw {
1594
sub checkpw {
1576
    my ( $dbh, $userid, $password, $query ) = @_;
1595
    my ( $dbh, $userid, $password, $query ) = @_;
1577
1578
    if ($ldap) {
1596
    if ($ldap) {
1579
        $debug and print STDERR "## checkpw - checking LDAP\n";
1597
        $debug and print STDERR "## checkpw - checking LDAP\n";
1580
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
1598
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
Lines 1591-1602 sub checkpw { Link Here
1591
        return 0;
1609
        return 0;
1592
    }
1610
    }
1593
1611
1594
    # If we are in a shibboleth session (shibboleth is enabled and no password has been provided)
1612
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1595
    if ($shib && !$password) {
1613
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1614
    # time around.
1615
    if ($shib && $shib_login && !$password) {
1596
1616
1597
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1617
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1598
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1618
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1599
        # (defined in the shibbolethLoginAttribute) tto contain the login of the
1619
        # (defined under shibboleth mapping in koha-conf.xml) to contain the login of the
1600
        # shibboleth-authenticated user
1620
        # shibboleth-authenticated user
1601
1621
1602
        # Then, we check if it matches a valid koha user
1622
        # Then, we check if it matches a valid koha user
(-)a/C4/Auth_with_Shibboleth.pm (+83 lines)
Lines 105-107 sub checkpw_shib { Link Here
105
}
105
}
106
106
107
1;
107
1;
108
__END__
109
110
=head1 NAME
111
112
C4::Auth_with_shibboleth
113
114
=head1 SYNOPSIS
115
116
use C4::Auth_with_shibboleth
117
118
=head1 DESCRIPTION
119
120
This module is specific to Shibboleth authentication in koha and relies heavily upon the native shibboleth service provider package in your operating system.
121
122
=head1 CONFIGURATION
123
124
To use this type of authentication these additional packages are required:
125
126
=over
127
128
=item *
129
130
libapache2-mod-shib2
131
132
=item *
133
134
libshibsp5:amd64
135
136
=item *
137
138
shibboleth-sp2-schemas
139
140
=back
141
142
We let the native shibboleth service provider packages handle all the complexities of shibboleth negotiation for use and configuring this is beyond the scope of this documentation; But to sum up, you will need to:
143
144
=over
145
146
=item 1.
147
148
Create some metadata for your koha instance (if you're in a single instance setup then the default metadata available at https://youraddress.com/Shibboleth.sso/Metadata should be adequate)
149
150
=item 2.
151
152
Swap metadata with your Identidy Provider (IdP)
153
154
=item 3.
155
156
Map their attributes to what you want to see in koha
157
158
=item 4.
159
160
Tell apache that we wish to allow koha to authenticate via shibboleth; This is as simple as adding the below to your virtualhost config:
161
162
=begin text
163
164
<Location />
165
  AuthType shibboleth
166
  Require shibboleth
167
</Location>
168
169
=end text
170
171
=item 5.
172
173
Configure koha to listen for shibboleth environment variables; To do this we add <useshibboleth>1</useshibboleth> for the koha-conf.xml file
174
175
=item 6.
176
177
Map shibboleth attributes to koha fields in koha-conf.xml.
178
179
<shibboleth>
180
  <mapping>
181
    <userid match="1" default="">eduPersonID</userid>
182
    <categorycode default=""></categorycode>
183
  </mapping>
184
</shibboleth>
185
186
=back
187
188
=head1 FUNCTIONS
189
190
=cut
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (+12 lines)
Lines 277-282 Link Here
277
        </div>
277
        </div>
278
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
278
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
279
            <div class="modal-body">
279
            <div class="modal-body">
280
                    [% IF ( shibbolethAuthentication ) %]
281
                    [% IF ( invalidShibLogin ) %]
282
                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
283
                    <div class="alert alert-info">
284
                        <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
285
                    </div>
286
                    [% ELSE %]
287
                    <h4>Shibboleth Login</h4>
288
                    <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
289
                    <h4>Local Login</h4>
290
                    [% END %]
291
		    [% END %]
280
                    <input type="hidden" name="koha_login_context" value="opac" />
292
                    <input type="hidden" name="koha_login_context" value="opac" />
281
                    <fieldset class="brief">
293
                    <fieldset class="brief">
282
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
294
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-6 / +8 lines)
Lines 58-75 Link Here
58
                            [% END %]
58
                            [% END %]
59
59
60
                            [% IF ( shibbolethAuthentication ) %]
60
                            [% IF ( shibbolethAuthentication ) %]
61
                                <h4>Shibboleth Login</h4>
62
61
63
                                [% IF ( invalidShibLogin ) %]
62
                                [% IF ( invalidShibLogin ) %]
64
                                <!-- This is what is displated if shibboleth login has failed -->
63
                                <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
65
                                <p>Sorry, the Shibboleth login failed.</p>
64
                                <div class="alert alert-info">
66
                                [% END %]
65
                                    <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
66
                                </div>
67
                                [% ELSE %]
68
                                <h4>Shibboleth Login</h4>
67
69
68
                                <p>If you have a Shibboleth account,
70
                                <p>If you have a Shibboleth account,
69
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
71
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
70
72
                                [% END %]
71
                                <h4>Local Login</h4>
73
                                <h4>Local Login</h4>
72
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in : </p>
74
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in: </p>
73
75
74
                            [% END %]
76
                            [% END %]
75
77
(-)a/opac/opac-main.pl (-2 / +7 lines)
Lines 21-26 Link Here
21
use Modern::Perl;
21
use Modern::Perl;
22
use CGI;
22
use CGI;
23
use C4::Auth;    # get_template_and_user
23
use C4::Auth;    # get_template_and_user
24
use C4::Auth_with_Shibboleth qw( login_shib_url );
24
use C4::Output;
25
use C4::Output;
25
use C4::NewsChannels;    # GetNewsToDisplay
26
use C4::NewsChannels;    # GetNewsToDisplay
26
use C4::Languages qw(getTranslatedLanguages accept_language);
27
use C4::Languages qw(getTranslatedLanguages accept_language);
Lines 44-50 $template->param( Link Here
44
    casAuthentication   => $casAuthentication,
45
    casAuthentication   => $casAuthentication,
45
);
46
);
46
47
47
$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') );
48
if ( C4::Context->config('useshibboleth') ) {
49
    $template->param(
50
        shibbolethAuthentication => C4::Context->config('useshibboleth'),
51
        shibbolethLoginUrl => C4::Auth_with_Shibboleth::login_shib_url($input)
52
    );
53
};
48
54
49
# display news
55
# display news
50
# use cookie setting for language, bug default to syspref if it's not set
56
# use cookie setting for language, bug default to syspref if it's not set
51
- 

Return to bug 8446