From f283d04b9a30b5a2841cd15f253a67dd290c17db Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 31 Jul 2014 06:21:55 +0000 Subject: [PATCH] BUG 12027: Added shibboleth authentication to the staff client - This patch adds shibboleth authentication to the staff client. - Depending upon how your url structure works, you may or may not need a second native shibboleth service provider profile configured for this to work. --- C4/Auth.pm | 5 ++-- C4/Auth_with_shibboleth.pm | 35 +++++++++++++++++------ koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt | 8 ++++++ 3 files changed, 36 insertions(+), 12 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 788e3ea..2c631d0 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -769,8 +769,7 @@ sub checkauth { } # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint) - if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') { - # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented) + if ( $shib and $shib_login and $shibSuccess) { logout_shib($query); } } @@ -851,7 +850,7 @@ sub checkauth { my ( $return, $cardnumber ); # If shib is enabled and we have a shib login, does the login match a valid koha user - if ( $shib && $shib_login && $type eq 'opac' ) { + if ( $shib && $shib_login ) { my $retuserid; # Do not pass password here, else shib will not be checked in checkpw. ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query ); diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm index 1936c48..741b46b 100644 --- a/C4/Auth_with_shibboleth.pm +++ b/C4/Auth_with_shibboleth.pm @@ -36,28 +36,28 @@ BEGIN { @ISA = qw(Exporter); @EXPORT = qw(logout_shib login_shib_url checkpw_shib get_login_shib); } -my $context = C4::Context->new() or die 'C4::Context->new failed'; + my $shib = C4::Context->config('shibboleth') or croak 'No in koha-conf.xml'; my $shibbolethMatchField = $shib->{matchpoint} or croak 'No defined in koha-conf.xml'; my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml'; -my $protocol = "https://"; # Logout from Shibboleth sub logout_shib { my ($query) = @_; - my $uri = $protocol . C4::Context->preference('OPACBaseURL'); + my $uri = _get_uri(); print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" ); } # Returns Shibboleth login URL with callback to the requesting URL sub login_shib_url { - my ($query) = @_; - my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name(); + my $interface = C4::Context->interface; + $debug and warn "shibboleth interface: " . $interface; + my $param = _get_uri() . $query->script_name(); if ( $query->query_string() ) { $param = $param . '%3F' . $query->query_string(); } - my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param"; + my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param"; return $uri; } @@ -75,7 +75,8 @@ sub get_login_shib { $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute"; $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}"; - return $ENV{$shibbolethMatchAttribute} || ''; + my @attribute = split(';',$ENV{$shibbolethMatchAttribute}); + return $attribute[0] || ''; } # Checks for password correctness @@ -84,7 +85,7 @@ sub checkpw_shib { $debug and warn "checkpw_shib"; my ( $dbh, $match ) = @_; - my $retnumber; + my ( $retnumber, $userid ); $debug and warn "User Shibboleth-authenticated as: $match"; # Does the given shibboleth attribute value ($match) match a valid koha user ? @@ -101,11 +102,27 @@ sub checkpw_shib { if ( $shib->{'autocreate'} ) { return _autocreate( $dbh, $shib, $match ); } else { - $debug and warn "User $userid is not a valid Koha user"; + $debug and warn "User $match is not a valid Koha user"; return 0; } } +sub _get_uri { + + my $protocol = "https://"; + my $interface = C4::Context->interface; + $debug and warn "shibboleth interface: " . $interface; + + my $return; + if ( $interface eq 'intranet' ) { + $return = $protocol . C4::Context->preference('staffClientBaseURL'); + return $return; + } else { + $return = $protocol . C4::Context->preference('OPACBaseURL'); + return $return; + } +} + sub _autocreate { my ( $dbh, $shib, $match ) = @_; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt index 5f97758..035c049 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt @@ -42,6 +42,14 @@
Error: Invalid username or password
[% END %] +[% IF (shibbolethAuthentication) %] + +[% IF (invalidShibLogin ) %] +
Error: Shibboleth login failed
+[% END %] +

If you have a shibboleth account, please click here to login.

+[% END %] +
-- 1.7.10.4