View | Details | Raw Unified | Return to bug 8446
Collapse All | Expand All

(-)a/C4/Auth.pm (-19 / +47 lines)
Lines 58-71 BEGIN { Link Here
58
    $shib        = C4::Context->config('useshibboleth') || 0;
58
    $shib        = C4::Context->config('useshibboleth') || 0;
59
    $caslogout   = C4::Context->preference('casLogout');
59
    $caslogout   = C4::Context->preference('casLogout');
60
    require C4::Auth_with_cas;             # no import
60
    require C4::Auth_with_cas;             # no import
61
    require C4::Auth_with_Shibboleth;
61
    require C4::Auth_with_shibboleth;
62
    if ($ldap) {
62
    if ($ldap) {
63
    require C4::Auth_with_ldap;
63
    require C4::Auth_with_ldap;
64
    import C4::Auth_with_ldap qw(checkpw_ldap);
64
    import C4::Auth_with_ldap qw(checkpw_ldap);
65
    }
65
    }
66
    if ($shib) {
66
    if ($shib) {
67
        import C4::Auth_with_Shibboleth qw(checkpw_shib logout_shib login_shib_url get_login_shib);
67
        import C4::Auth_with_shibboleth
68
        # Getting user login
68
          qw(checkpw_shib logout_shib login_shib_url get_login_shib);
69
70
        # Get shibboleth login attribute
69
        $shib_login = get_login_shib();
71
        $shib_login = get_login_shib();
70
    }
72
    }
71
    if ($cas) {
73
    if ($cas) {
Lines 296-301 sub get_template_and_user { Link Here
296
    }
298
    }
297
    else {    # if this is an anonymous session, setup to display public lists...
299
    else {    # if this is an anonymous session, setup to display public lists...
298
300
301
	# If shibboleth is enabled, and we're in an anonymous session, we should allow
302
    # the user to attemp login via shibboleth.
303
	if ( $shib ) {
304
	    $template->param( shibbolethAuthentication => $shib,
305
                shibbolethLoginUrl    => login_shib_url($in->{'query'}),
306
            );
307
            # If shibboleth is enabled and we have a shibboleth login attribute,
308
            # but we are in an anonymous session, then we clearly have an invalid
309
            # shibboleth koha account.
310
            if ( $shib_login ) {
311
                $template->param( invalidShibLogin => '1');
312
            }
313
        }
314
299
        $template->param( sessionID        => $sessionID );
315
        $template->param( sessionID        => $sessionID );
300
        
316
        
301
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
317
        my ($total, $pubshelves) = C4::VirtualShelves::GetSomeShelfNames(undef, 'MASTHEAD');
Lines 714-720 sub checkauth { Link Here
714
                $session->param('surname'),      $session->param('branch'),
730
                $session->param('surname'),      $session->param('branch'),
715
                $session->param('branchname'),   $session->param('flags'),
731
                $session->param('branchname'),   $session->param('flags'),
716
                $session->param('emailaddress'), $session->param('branchprinter'),
732
                $session->param('emailaddress'), $session->param('branchprinter'),
717
                $session->param('persona')
733
                $session->param('persona'),      $session->param('shibboleth')
718
            );
734
            );
719
            C4::Context::set_shelves_userenv('bar',$session->param('barshelves'));
735
            C4::Context::set_shelves_userenv('bar',$session->param('barshelves'));
720
            C4::Context::set_shelves_userenv('pub',$session->param('pubshelves'));
736
            C4::Context::set_shelves_userenv('pub',$session->param('pubshelves'));
Lines 726-732 sub checkauth { Link Here
726
            $sessiontype = $session->param('sessiontype') || '';
742
            $sessiontype = $session->param('sessiontype') || '';
727
        }
743
        }
728
        if ( ( $query->param('koha_login_context') && ($q_userid ne $s_userid) )
744
        if ( ( $query->param('koha_login_context') && ($q_userid ne $s_userid) )
729
          || ( $cas && $query->param('ticket') ) ) {
745
          || ( $cas && $query->param('ticket') ) || ( $shib && $shib_login && !$logout ) ) {
730
            #if a user enters an id ne to the id in the current session, we need to log them in...
746
            #if a user enters an id ne to the id in the current session, we need to log them in...
731
            #first we need to clear the anonymous session...
747
            #first we need to clear the anonymous session...
732
            $debug and warn "query id = $q_userid but session id = $s_userid";
748
            $debug and warn "query id = $q_userid but session id = $s_userid";
Lines 739-744 sub checkauth { Link Here
739
        }
755
        }
740
        elsif ($logout) {
756
        elsif ($logout) {
741
            # voluntary logout the user
757
            # voluntary logout the user
758
	    # check wether the user was using their shibboleth session or a local one
759
            my $shibSuccess = C4::Context->userenv->{'shibboleth'};
742
            $session->delete();
760
            $session->delete();
743
            $session->flush;
761
            $session->flush;
744
            C4::Context->_unset_userenv($sessionID);
762
            C4::Context->_unset_userenv($sessionID);
Lines 750-757 sub checkauth { Link Here
750
                logout_cas($query);
768
                logout_cas($query);
751
            }
769
            }
752
770
753
            # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth username is set)
771
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
754
            if ( $shib and $shib_login and $type eq 'opac') {
772
            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
755
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
773
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
756
                logout_shib($query);
774
                logout_shib($query);
757
            }
775
            }
Lines 824-843 sub checkauth { Link Here
824
        }
842
        }
825
        if (   ( $cas && $query->param('ticket') )
843
        if (   ( $cas && $query->param('ticket') )
826
            || $userid
844
            || $userid
827
            || $shib
845
            || ( $shib && $shib_login )
828
            || $pki_field ne 'None'
846
            || $pki_field ne 'None'
829
            || $persona )
847
            || $persona )
830
        {
848
        {
831
            my $password = $query->param('password');
849
            my $password = $query->param('password');
850
	    my $shibSuccess = 0;
832
851
833
            my ( $return, $cardnumber );
852
            my ( $return, $cardnumber );
834
            if ($shib && $shib_login && $type eq 'opac' && !$password) {
853
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
854
            if ( $shib && $shib_login && $type eq 'opac' ) {
835
                my $retuserid;
855
                my $retuserid;
836
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
856
		# Do not pass password here, else shib will not be checked in checkpw.
857
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
837
                $userid = $retuserid;
858
                $userid = $retuserid;
859
		$shibSuccess = $return;
838
                $info{'invalidShibLogin'} = 1 unless ($return);
860
                $info{'invalidShibLogin'} = 1 unless ($return);
839
861
            }
840
            } elsif ( $cas && $query->param('ticket') ) {
862
	    # If shib login and match were successfull, skip further login methods
863
	    unless ( $shibSuccess ) {
864
	    if ( $cas && $query->param('ticket') ) {
841
                my $retuserid;
865
                my $retuserid;
842
                ( $return, $cardnumber, $retuserid ) =
866
                ( $return, $cardnumber, $retuserid ) =
843
                  checkpw( $dbh, $userid, $password, $query );
867
                  checkpw( $dbh, $userid, $password, $query );
Lines 904-910 sub checkauth { Link Here
904
                ( $return, $cardnumber, $retuserid ) =
928
                ( $return, $cardnumber, $retuserid ) =
905
                  checkpw( $dbh, $userid, $password, $query );
929
                  checkpw( $dbh, $userid, $password, $query );
906
                $userid = $retuserid if ( $retuserid );
930
                $userid = $retuserid if ( $retuserid );
907
        }
931
		$info{'invalid_username_or_password'} = 1 unless ($return);
932
        } }
908
        if ($return) {
933
        if ($return) {
909
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
934
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
910
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
935
                if ( $flags = haspermission(  $userid, $flagsrequired ) ) {
Lines 992-997 sub checkauth { Link Here
992
                    $session->param('emailaddress',$emailaddress);
1017
                    $session->param('emailaddress',$emailaddress);
993
                    $session->param('ip',$session->remote_addr());
1018
                    $session->param('ip',$session->remote_addr());
994
                    $session->param('lasttime',time());
1019
                    $session->param('lasttime',time());
1020
		    $session->param('shibboleth',$shibSuccess);
995
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
1021
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
996
                }
1022
                }
997
                elsif ( $return == 2 ) {
1023
                elsif ( $return == 2 ) {
Lines 1018-1024 sub checkauth { Link Here
1018
                    $session->param('surname'),      $session->param('branch'),
1044
                    $session->param('surname'),      $session->param('branch'),
1019
                    $session->param('branchname'),   $session->param('flags'),
1045
                    $session->param('branchname'),   $session->param('flags'),
1020
                    $session->param('emailaddress'), $session->param('branchprinter'),
1046
                    $session->param('emailaddress'), $session->param('branchprinter'),
1021
                    $session->param('persona')
1047
                    $session->param('persona'),      $session->param('shibboleth')
1022
                );
1048
                );
1023
1049
1024
            }
1050
            }
Lines 1157-1162 sub checkauth { Link Here
1157
1183
1158
    if ($shib) {
1184
    if ($shib) {
1159
            $template->param(
1185
            $template->param(
1186
                shibbolethAuthentication => $shib,
1160
                shibbolethLoginUrl    => login_shib_url($query),
1187
                shibbolethLoginUrl    => login_shib_url($query),
1161
            );
1188
            );
1162
    }
1189
    }
Lines 1577-1583 sub get_session { Link Here
1577
1604
1578
sub checkpw {
1605
sub checkpw {
1579
    my ( $dbh, $userid, $password, $query ) = @_;
1606
    my ( $dbh, $userid, $password, $query ) = @_;
1580
1581
    if ($ldap) {
1607
    if ($ldap) {
1582
        $debug and print STDERR "## checkpw - checking LDAP\n";
1608
        $debug and print STDERR "## checkpw - checking LDAP\n";
1583
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
1609
        my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
Lines 1594-1610 sub checkpw { Link Here
1594
        return 0;
1620
        return 0;
1595
    }
1621
    }
1596
1622
1597
    # If we are in a shibboleth session (shibboleth is enabled and no password has been provided)
1623
    # If we are in a shibboleth session (shibboleth is enabled, and a shibboleth match attribute is present)
1598
    if ($shib && !$password) {
1624
    # Check for password to asertain whether we want to be testing against shibboleth or another method this
1625
    # time around.
1626
    if ($shib && $shib_login && !$password) {
1599
1627
1600
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1628
        $debug and print STDERR "## checkpw - checking Shibboleth\n";
1601
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1629
        # In case of a Shibboleth authentication, we expect a shibboleth user attribute
1602
        # (defined in the shibbolethLoginAttribute) tto contain the login of the
1630
        # (defined under shibboleth mapping in koha-conf.xml) to contain the login of the
1603
        # shibboleth-authenticated user
1631
        # shibboleth-authenticated user
1604
1632
1605
        # Then, we check if it matches a valid koha user
1633
        # Then, we check if it matches a valid koha user
1606
        if ($shib_login) {
1634
        if ($shib_login) {
1607
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_Shibboleth::checkpw_shib( $dbh, $shib_login );    # EXTERNAL AUTH
1635
            my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib( $dbh, $shib_login );    # EXTERNAL AUTH
1608
            ($retval) and return ( $retval, $retcard, $retuserid );
1636
            ($retval) and return ( $retval, $retcard, $retuserid );
1609
            return 0;
1637
            return 0;
1610
        }
1638
        }
(-)a/C4/Auth_with_Shibboleth.pm (-107 lines)
Lines 1-107 Link Here
1
package C4::Auth_with_Shibboleth;
2
3
# Copyright 2011 BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use strict;
21
use warnings;
22
23
use C4::Debug;
24
use C4::Context;
25
use Carp;
26
use CGI;
27
28
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
29
30
BEGIN {
31
    require Exporter;
32
    $VERSION = 3.03;                                                                    # set the version for version checking
33
    $debug   = $ENV{DEBUG};
34
    @ISA     = qw(Exporter);
35
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
36
}
37
my $context = C4::Context->new() or die 'C4::Context->new failed';
38
my $protocol = "https://";
39
40
# Logout from Shibboleth
41
sub logout_shib {
42
    my ($query) = @_;
43
    my $uri = $protocol . C4::Context->preference('OPACBaseURL');
44
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
45
}
46
47
# Returns Shibboleth login URL with callback to the requesting URL
48
sub login_shib_url {
49
50
    my ($query) = @_;
51
    my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name();
52
    if ( $query->query_string() ) {
53
        $param = $param . '%3F' . $query->query_string();
54
    }
55
    my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param";
56
    return $uri;
57
}
58
59
# Returns shibboleth user login
60
sub get_login_shib {
61
62
    # In case of a Shibboleth authentication, we expect a shibboleth user attribute (defined in the shibbolethLoginAttribute)
63
    # to contain the login of the shibboleth-authenticated user
64
65
    # Shibboleth attributes are mapped into http environmement variables,
66
    # so we're getting the login of the user this way
67
68
    my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
69
70
    my $shibbolethLoginAttribute = $shib->{'userid'};
71
    $debug and warn "shibboleth->userid value: $shibbolethLoginAttribute";
72
    $debug and warn "$shibbolethLoginAttribute value: " . $ENV{$shibbolethLoginAttribute};
73
74
    return $ENV{$shibbolethLoginAttribute} || '';
75
}
76
77
# Checks for password correctness
78
# In our case : does the given username matches one of our users ?
79
sub checkpw_shib {
80
    $debug and warn "checkpw_shib";
81
82
    my ( $dbh, $userid ) = @_;
83
    my $retnumber;
84
    $debug and warn "User Shibboleth-authenticated as: $userid";
85
86
    my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
87
88
    # Does it match one of our users ?
89
    my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
90
    $sth->execute($userid);
91
    if ( $sth->rows ) {
92
        $retnumber = $sth->fetchrow;
93
        return ( 1, $retnumber, $userid );
94
    }
95
    $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
96
    $sth->execute($userid);
97
    if ( $sth->rows ) {
98
        $retnumber = $sth->fetchrow;
99
        return ( 1, $retnumber, $userid );
100
    }
101
102
    # If we reach this point, the user is not a valid koha user
103
    $debug and warn "User $userid is not a valid Koha user";
104
    return 0;
105
}
106
107
1;
(-)a/C4/Auth_with_shibboleth.pm (+222 lines)
Line 0 Link Here
1
package C4::Auth_with_shibboleth;
2
3
# Copyright 2011 BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
20
use strict;
21
use warnings;
22
23
use C4::Debug;
24
use C4::Context;
25
use Carp;
26
use CGI;
27
28
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
29
30
BEGIN {
31
    require Exporter;
32
    $VERSION = 3.03;                                                                    # set the version for version checking
33
    $debug   = $ENV{DEBUG};
34
    @ISA     = qw(Exporter);
35
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
36
}
37
my $context = C4::Context->new() or die 'C4::Context->new failed';
38
my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
39
my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
40
my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{content} or croak 'Matchpoint not mapped in koha-conf.xml';
41
my $protocol = "https://";
42
43
# Logout from Shibboleth
44
sub logout_shib {
45
    my ($query) = @_;
46
    my $uri = $protocol . C4::Context->preference('OPACBaseURL');
47
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
48
}
49
50
# Returns Shibboleth login URL with callback to the requesting URL
51
sub login_shib_url {
52
53
    my ($query) = @_;
54
    my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name();
55
    if ( $query->query_string() ) {
56
        $param = $param . '%3F' . $query->query_string();
57
    }
58
    my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param";
59
    return $uri;
60
}
61
62
# Returns shibboleth user login
63
sub get_login_shib {
64
65
    # In case of a Shibboleth authentication, we expect a shibboleth user attribute 
66
    # to contain the login match point of the shibboleth-authenticated user. This match
67
    # point is configured in koha-conf.xml
68
69
    # Shibboleth attributes are mapped into http environmement variables, so we're getting
70
    # the match point of the user this way
71
72
    $debug and warn "koha borrower field to match: $shibbolethMatchField";
73
    $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
74
    $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
75
76
    return $ENV{$shibbolethMatchAttribute} || '';
77
}
78
79
# Checks for password correctness
80
# In our case : does the given attribute match one of our users ?
81
sub checkpw_shib {
82
    $debug and warn "checkpw_shib";
83
84
    my ( $dbh, $userid ) = @_;
85
    my $retnumber;
86
    $debug and warn "User Shibboleth-authenticated as: $userid";
87
88
    # Does the given shibboleth attribute value ($userid) match a valid koha user ?
89
    my $sth = $dbh->prepare("select cardnumber, userid from borrowers where $shibbolethMatchField=?");
90
    $sth->execute($userid);
91
    if ( $sth->rows ) {
92
        my @retvals = $sth->fetchrow;
93
        $retnumber = $retvals[1];
94
        $userid = $retvals[0];
95
        return ( 1, $retnumber, $userid );
96
    }
97
98
    # If we reach this point, the user is not a valid koha user
99
    $debug and warn "User $userid is not a valid Koha user";
100
    return 0;
101
}
102
103
1;
104
__END__
105
106
=head1 NAME
107
108
C4::Auth_with_shibboleth
109
110
=head1 SYNOPSIS
111
112
use C4::Auth_with_shibboleth;
113
114
=head1 DESCRIPTION
115
116
This module is specific to Shibboleth authentication in koha and relies heavily upon the native shibboleth service provider package in your operating system.
117
118
=head1 CONFIGURATION
119
120
To use this type of authentication these additional packages are required:
121
122
=over
123
124
=item *
125
126
libapache2-mod-shib2
127
128
=item *
129
130
libshibsp5:amd64
131
132
=item *
133
134
shibboleth-sp2-schemas
135
136
=back
137
138
We let the native shibboleth service provider packages handle all the complexities of shibboleth negotiation for us, and configuring this is beyond the scope of this documentation.
139
140
But to sum up, to get shibboleth working in koha, as a minimum you will need to:
141
142
=over
143
144
=item 1.
145
146
Create some metadata for your koha instance (if you're in a single instance setup then the default metadata available at https://youraddress.com/Shibboleth.sso/Metadata should be adequate)
147
148
=item 2.
149
150
Swap metadata with your Identidy Provider (IdP)
151
152
=item 3.
153
154
Map their attributes to what you want to see in koha
155
156
=item 4.
157
158
Tell apache that we wish to allow koha to authenticate via shibboleth.
159
160
This is as simple as adding the below to your virtualhost config:
161
162
 <Location />
163
   AuthType shibboleth
164
   Require shibboleth
165
 </Location>
166
167
=item 5.
168
169
Configure koha to listen for shibboleth environment variables.
170
171
This is as simple as enabling B<useshibboleth> in koha-conf.xml:
172
173
 <useshibboleth>1</useshibboleth>
174
175
=item 6.
176
177
Map shibboleth attributes to koha fields, and configure authentication match point in koha-conf.xml.
178
179
 <shibboleth>
180
   <matchpoint>userid<matchpoint>
181
   <mapping>
182
     <userid>eduPersonID</userid>
183
   </mapping>
184
 </shibboleth>
185
186
Note: The minimum you need here is a <matchpoint> block, containing a valid column name from the koha borrowers table, and a <mapping> block containing a relation between the chosen matchpoint and the shibboleth attribute name.
187
188
=back
189
190
It should be as simple as that; you should now be able to login via shibboleth in the opac.
191
192
If you need more help configuring your B<S>ervice B<P>rovider to authenticate against a chosen B<Id>entity B<P>rovider then it might be worth taking a look at the community wiki L<page|http://wiki.koha-community.org/wiki/Shibboleth_Configuration>
193
194
=head1 FUNCTIONS
195
196
=head2 logout_shib
197
198
Sends a logout signal to the native shibboleth service provider and then logs out of koha.  Depending upon the native service provider configuration and identity provider capabilities this may or may not perform a single sign out action.
199
200
  logout_shib($query);
201
202
=head2 login_shib_url
203
204
Given a query, this will return a shibboleth login url with return code to page with given given query.
205
206
  my $shibLoginURL = login_shib_url($query);
207
208
=head2 get_login_shib
209
210
Returns the shibboleth login attribute should it be found present in the http session
211
212
  my $shib_login = get_login_shib();
213
214
=head2 checkpw_shib
215
216
Given a database handle and a shib_login attribute, this routine checks for a matching local user and if found returns true, their cardnumber and their userid.  If a match is not found, then this returns false.
217
218
  my ( $retval, $retcard, $retuserid ) = C4::Auth_with_shibboleth::checkpw_shib( $dbh, $shib_login );
219
220
=head1 SEE ALSO
221
222
=cut
(-)a/C4/Context.pm (-2 / +2 lines)
Lines 1112-1118 set_userenv is called in Auth.pm Link Here
1112
1112
1113
#'
1113
#'
1114
sub set_userenv {
1114
sub set_userenv {
1115
    my ($usernum, $userid, $usercnum, $userfirstname, $usersurname, $userbranch, $branchname, $userflags, $emailaddress, $branchprinter, $persona)= @_;
1115
    my ($usernum, $userid, $usercnum, $userfirstname, $usersurname, $userbranch, $branchname, $userflags, $emailaddress, $branchprinter, $persona, $shibboleth)= @_;
1116
    my $var=$context->{"activeuser"} || '';
1116
    my $var=$context->{"activeuser"} || '';
1117
    my $cell = {
1117
    my $cell = {
1118
        "number"     => $usernum,
1118
        "number"     => $usernum,
Lines 1127-1132 sub set_userenv { Link Here
1127
        "emailaddress"     => $emailaddress,
1127
        "emailaddress"     => $emailaddress,
1128
        "branchprinter"    => $branchprinter,
1128
        "branchprinter"    => $branchprinter,
1129
        "persona"    => $persona,
1129
        "persona"    => $persona,
1130
        "shibboleth" => $shibboleth,
1130
    };
1131
    };
1131
    $context->{userenv}->{$var} = $cell;
1132
    $context->{userenv}->{$var} = $cell;
1132
    return $cell;
1133
    return $cell;
Lines 1300-1303 Andrew Arensburger <arensb at ooblick dot com> Link Here
1300
1301
1301
Joshua Ferraro <jmf at liblime dot com>
1302
Joshua Ferraro <jmf at liblime dot com>
1302
1303
1303
=cut
(-)a/etc/koha-conf.xml (+1 lines)
Lines 109-114 __PAZPAR2_TOGGLE_XML_POST__ Link Here
109
 <pazpar2url>http://__PAZPAR2_HOST__:__PAZPAR2_PORT__/search.pz2</pazpar2url>
109
 <pazpar2url>http://__PAZPAR2_HOST__:__PAZPAR2_PORT__/search.pz2</pazpar2url>
110
 <install_log>__MISC_DIR__/koha-install-log</install_log>
110
 <install_log>__MISC_DIR__/koha-install-log</install_log>
111
 <useldapserver>0</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on -->
111
 <useldapserver>0</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on -->
112
 <useshibboleth>0</useshibboleth><!-- see C4::Auth_with_shibboleth for extra configs you must do to turn this on -->
112
 <zebra_bib_index_mode>__BIB_INDEX_MODE__</zebra_bib_index_mode>
113
 <zebra_bib_index_mode>__BIB_INDEX_MODE__</zebra_bib_index_mode>
113
 <zebra_auth_index_mode>__AUTH_INDEX_MODE__</zebra_auth_index_mode>
114
 <zebra_auth_index_mode>__AUTH_INDEX_MODE__</zebra_auth_index_mode>
114
 <zebra_lockdir>__ZEBRA_LOCK_DIR__</zebra_lockdir>
115
 <zebra_lockdir>__ZEBRA_LOCK_DIR__</zebra_lockdir>
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (+12 lines)
Lines 281-286 Link Here
281
        </div>
281
        </div>
282
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
282
        <form action="/cgi-bin/koha/opac-user.pl" method="post" name="auth" id="modalAuth">
283
            <div class="modal-body">
283
            <div class="modal-body">
284
                    [% IF ( shibbolethAuthentication ) %]
285
                    [% IF ( invalidShibLogin ) %]
286
                    <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
287
                    <div class="alert alert-info">
288
                        <p>Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login, you may use that below.</p>
289
                    </div>
290
                    [% ELSE %]
291
                    <h4>Shibboleth Login</h4>
292
                    <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
293
                    <h4>Local Login</h4>
294
                    [% END %]
295
		    [% END %]
284
                    <input type="hidden" name="koha_login_context" value="opac" />
296
                    <input type="hidden" name="koha_login_context" value="opac" />
285
                    <fieldset class="brief">
297
                    <fieldset class="brief">
286
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
298
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt (-9 / +47 lines)
Lines 58-79 Link Here
58
                            [% END %]
58
                            [% END %]
59
59
60
                            [% IF ( shibbolethAuthentication ) %]
60
                            [% IF ( shibbolethAuthentication ) %]
61
                                <h4>Shibboleth Login</h4>
62
61
63
                                [% IF ( invalidShibLogin ) %]
62
                                [% IF ( invalidShibLogin ) %]
64
                                <!-- This is what is displated if shibboleth login has failed -->
63
                                <!-- This is what is displayed if shibboleth login has failed to match a koha user -->
65
                                <p>Sorry, the Shibboleth login failed.</p>
64
                                <div class="alert alert-info">
66
                                [% END %]
65
                                    <p>
66
                                    Sorry, your Shibboleth identity does not match a valid library identity.
67
                                    [% IF ( casAuthentication ) %]
68
                                    [% IF ( invalidCasLogin ) %]
69
                                    <!-- This is what is displayed if cas login has failed -->
70
                                    <p>Sorry, the CAS login also failed, if you have a local login you may use that below.</p>
71
                                    [% ELSE %]
72
                                    If you have a <acronym title="Central Authentication Service">CAS</acronym> account, you may use that below.
73
                                    [% END %]
74
                                    [% ELSE %]
75
                                    If you have a local account, you may use that below.
76
                                    [% END %]
77
                                    </p>
78
                                </div>
79
                                [% ELSE %]
80
                                <h4>Shibboleth Login</h4>
67
81
68
                                <p>If you have a Shibboleth account,
82
                                <p>If you have a Shibboleth account,
69
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
83
                                please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
70
84
                                [% END %]
71
                                <h4>Local Login</h4>
85
                                [% IF ( casAuthentication ) %]
72
                                <p>If you do not have a Shibboleth account, but a local account, you can still log in : </p>
86
                                <h4>CAS login</h4>
87
                                <p>If you do not have a Shibboleth account, but you do have a <acronym title="Central Authentication Service">CAS</acronym> account,
88
                                [% ELSE %]
89
                                <h4>Local login</h4>
90
                                <p>If you do not have a Shibboleth account, but you do have a local login, then you may login below:</p>
91
                                [% END %]
73
92
74
                            [% END %]
93
                            [% END %]
75
94
76
                            [% IF ( casAuthentication ) %]
95
                            [% IF ( casAuthentication ) %]
96
                                [% IF ( shibbolethAuthentication ) %]
97
                                [% IF ( casServerUrl ) %]
98
                                    please <a href="[% casServerUrl %]">click here to login</a>.<p>
99
                                [% END %]
100
101
                                [% IF ( casServersLoop ) %]
102
                                    please choose against which one you would like to authenticate: </p>
103
                                    <ul>
104
                                        [% FOREACH casServer IN casServersLoop %]
105
                                        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
106
                                        [% END %]
107
                                    </ul>
108
                                [% END %]
109
                                [% ELSE %]
77
                                <h4>CAS login</h4>
110
                                <h4>CAS login</h4>
78
111
79
                                [% IF ( invalidCasLogin ) %]
112
                                [% IF ( invalidCasLogin ) %]
Lines 87-102 Link Here
87
                                [% END %]
120
                                [% END %]
88
121
89
                                [% IF ( casServersLoop ) %]
122
                                [% IF ( casServersLoop ) %]
90
                                    Please choose against which one you would like to authenticate: </p>
123
                                    please choose against which one you would like to authenticate: </p>
91
                                    <ul>
124
                                    <ul>
92
                                        [% FOREACH casServer IN casServersLoop %]
125
                                        [% FOREACH casServer IN casServersLoop %]
93
                                        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
126
                                        <li><a href="[% casServer.value %]">[% casServer.name %]</a></li>
94
                                        [% END %]
127
                                        [% END %]
95
                                    </ul>
128
                                    </ul>
96
                                [% END %]
129
                                [% END %]
130
                                [% END %]
97
131
132
                                [% IF ( shibbolethAuthentication ) %]
133
                                <p>Nothing</p>
134
                                [% ELSE %]
98
                                <h4>Local login</h4>
135
                                <h4>Local login</h4>
99
                                <p>If you do not have a CAS account, but a local account, you can still log in: </p>
136
                                <p>If you do not have a CAS account, but do have a local account, you can still log in: </p>
137
                                [% END %]
100
138
101
                            [% END # / IF casAuthentication %]
139
                            [% END # / IF casAuthentication %]
102
140
(-)a/opac/opac-main.pl (-3 lines)
Lines 44-51 $template->param( Link Here
44
    casAuthentication   => $casAuthentication,
44
    casAuthentication   => $casAuthentication,
45
);
45
);
46
46
47
$template->param( shibbolethAuthentication => C4::Context->config('useshibboleth') );
48
49
# display news
47
# display news
50
# use cookie setting for language, bug default to syspref if it's not set
48
# use cookie setting for language, bug default to syspref if it's not set
51
my ($theme, $news_lang, $availablethemes) = C4::Templates::themelanguage(C4::Context->config('opachtdocs'),'opac-main.tt','opac',$input);
49
my ($theme, $news_lang, $availablethemes) = C4::Templates::themelanguage(C4::Context->config('opachtdocs'),'opac-main.tt','opac',$input);
52
- 

Return to bug 8446