From a0b5a59e5192b567eeefe83e41cd50f2cc2d1a5e Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 24 Jul 2014 10:45:27 +0000 Subject: [PATCH] BUG8446, Follow up: Implimented single sign out - This followup rebases the code against 3.16+ which managed to break some of the original logic. - As a side effect of the rebasing, we've also implimented the single sign out element. Upon logout, koha will request that the shibboleth session is destroyed, and then clear the local koha session upon return to koha. Due to the nature of shibboleth however, you will only truly be signed out of the IdP if they properly support Single Sign Out (which many do not). As a consequence, although you may appear to be logged out in koha, you might find that upon clicking 'login' the IdP does NOT request your login details again, but instead logs you silently back into your koha session. This is NOT a koha bug, but a shibboleth implimentation issue that is well known. --- C4/Auth.pm | 4 ++-- C4/Context.pm | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index e72c3de..16a628a 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -723,7 +723,7 @@ sub checkauth { $session->param('surname'), $session->param('branch'), $session->param('branchname'), $session->param('flags'), $session->param('emailaddress'), $session->param('branchprinter'), - $session->param('persona') + $session->param('persona'), $session->param('shibboleth') ); C4::Context::set_shelves_userenv('bar',$session->param('barshelves')); C4::Context::set_shelves_userenv('pub',$session->param('pubshelves')); @@ -735,7 +735,7 @@ sub checkauth { $sessiontype = $session->param('sessiontype') || ''; } if ( ( $query->param('koha_login_context') && ($q_userid ne $s_userid) ) - || ( $cas && $query->param('ticket') ) ) { + || ( $cas && $query->param('ticket') ) || ( $shib && $shib_login && !$logout ) ) { #if a user enters an id ne to the id in the current session, we need to log them in... #first we need to clear the anonymous session... $debug and warn "query id = $q_userid but session id = $s_userid"; diff --git a/C4/Context.pm b/C4/Context.pm index 9a7b75d..8919251 100644 --- a/C4/Context.pm +++ b/C4/Context.pm @@ -1112,7 +1112,7 @@ set_userenv is called in Auth.pm #' sub set_userenv { - my ($usernum, $userid, $usercnum, $userfirstname, $usersurname, $userbranch, $branchname, $userflags, $emailaddress, $branchprinter, $persona)= @_; + my ($usernum, $userid, $usercnum, $userfirstname, $usersurname, $userbranch, $branchname, $userflags, $emailaddress, $branchprinter, $persona, $shibboleth)= @_; my $var=$context->{"activeuser"} || ''; my $cell = { "number" => $usernum, @@ -1127,6 +1127,7 @@ sub set_userenv { "emailaddress" => $emailaddress, "branchprinter" => $branchprinter, "persona" => $persona, + "shibboleth" => $shibboleth, }; $context->{userenv}->{$var} = $cell; return $cell; @@ -1300,4 +1301,3 @@ Andrew Arensburger Joshua Ferraro -=cut -- 1.7.10.4