View | Details | Raw Unified | Return to bug 12027
Collapse All | Expand All

(-)a/C4/Auth.pm (-3 / +2 lines)
Lines 769-776 sub checkauth { Link Here
769
            }
769
            }
770
770
771
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
771
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
772
            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
772
            if ( $shib and $shib_login and $shibSuccess) {
773
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
774
                logout_shib($query);
773
                logout_shib($query);
775
            }
774
            }
776
        }
775
        }
Lines 851-857 sub checkauth { Link Here
851
850
852
            my ( $return, $cardnumber );
851
            my ( $return, $cardnumber );
853
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
852
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
854
            if ( $shib && $shib_login && $type eq 'opac' ) {
853
            if ( $shib && $shib_login ) {
855
                my $retuserid;
854
                my $retuserid;
856
		# Do not pass password here, else shib will not be checked in checkpw.
855
		# Do not pass password here, else shib will not be checked in checkpw.
857
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
856
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
(-)a/C4/Auth_with_shibboleth.pm (-9 / +26 lines)
Lines 36-63 BEGIN { Link Here
36
    @ISA     = qw(Exporter);
36
    @ISA     = qw(Exporter);
37
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
37
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
38
}
38
}
39
my $context = C4::Context->new() or die 'C4::Context->new failed';
39
40
my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
40
my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
41
my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
41
my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
42
my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml';
42
my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml';
43
my $protocol = "https://";
44
43
45
# Logout from Shibboleth
44
# Logout from Shibboleth
46
sub logout_shib {
45
sub logout_shib {
47
    my ($query) = @_;
46
    my ($query) = @_;
48
    my $uri = $protocol . C4::Context->preference('OPACBaseURL');
47
    my $uri = _get_uri();
49
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
48
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
50
}
49
}
51
50
52
# Returns Shibboleth login URL with callback to the requesting URL
51
# Returns Shibboleth login URL with callback to the requesting URL
53
sub login_shib_url {
52
sub login_shib_url {
54
55
    my ($query) = @_;
53
    my ($query) = @_;
56
    my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name();
54
    my $interface = C4::Context->interface;
55
    $debug and warn "shibboleth interface: " . $interface;
56
    my $param = _get_uri() . $query->script_name();
57
    if ( $query->query_string() ) {
57
    if ( $query->query_string() ) {
58
        $param = $param . '%3F' . $query->query_string();
58
        $param = $param . '%3F' . $query->query_string();
59
    }
59
    }
60
    my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param";
60
    my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param";
61
    return $uri;
61
    return $uri;
62
}
62
}
63
63
Lines 75-81 sub get_login_shib { Link Here
75
    $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
75
    $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
76
    $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
76
    $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
77
77
78
    return $ENV{$shibbolethMatchAttribute} || '';
78
    my @attribute = split(';',$ENV{$shibbolethMatchAttribute});
79
    return $attribute[0] || '';
79
}
80
}
80
81
81
# Checks for password correctness
82
# Checks for password correctness
Lines 84-90 sub checkpw_shib { Link Here
84
    $debug and warn "checkpw_shib";
85
    $debug and warn "checkpw_shib";
85
86
86
    my ( $dbh, $match ) = @_;
87
    my ( $dbh, $match ) = @_;
87
    my $retnumber;
88
    my ( $retnumber, $userid );
88
    $debug and warn "User Shibboleth-authenticated as: $match";
89
    $debug and warn "User Shibboleth-authenticated as: $match";
89
90
90
    # Does the given shibboleth attribute value ($match) match a valid koha user ?
91
    # Does the given shibboleth attribute value ($match) match a valid koha user ?
Lines 101-111 sub checkpw_shib { Link Here
101
    if ( $shib->{'autocreate'} ) {
102
    if ( $shib->{'autocreate'} ) {
102
        return _autocreate( $dbh, $shib, $match );
103
        return _autocreate( $dbh, $shib, $match );
103
    } else {
104
    } else {
104
        $debug and warn "User $userid is not a valid Koha user";
105
        $debug and warn "User $match is not a valid Koha user";
105
        return 0;
106
        return 0;
106
    }
107
    }
107
}
108
}
108
109
110
sub _get_uri {
111
112
    my $protocol = "https://";
113
    my $interface = C4::Context->interface;
114
    $debug and warn "shibboleth interface: " . $interface;
115
116
    my $return;
117
    if ( $interface eq 'intranet' ) {
118
        $return = $protocol . C4::Context->preference('staffClientBaseURL');
119
        return $return;
120
    } else {
121
        $return = $protocol . C4::Context->preference('OPACBaseURL');
122
        return $return;
123
    }
124
}
125
109
sub _autocreate {
126
sub _autocreate {
110
    my ( $dbh, $shib, $match ) = @_;
127
    my ( $dbh, $shib, $match ) = @_;
111
128
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-1 / +8 lines)
Lines 42-47 Link Here
42
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
42
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
43
[% END %]
43
[% END %]
44
44
45
[% IF (shibbolethAuthentication) %]
46
<!-- This is what is displayed if shib login has failed -->
47
[% IF (invalidShibLogin ) %]
48
<div id="login_error"><Strong>Error: </strong>Shibboleth login failed</div>
49
[% END %]
50
<p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here</a> to login.</p>
51
[% END %]
52
45
<!-- login prompt time-->
53
<!-- login prompt time-->
46
<form action="[% url %]" method="post" name="loginform" id="loginform">
54
<form action="[% url %]" method="post" name="loginform" id="loginform">
47
    <input type="hidden" name="koha_login_context" value="intranet" />
55
    <input type="hidden" name="koha_login_context" value="intranet" />
48
- 

Return to bug 12027