View | Details | Raw Unified | Return to bug 12027
Collapse All | Expand All

(-)a/C4/Auth.pm (-3 / +2 lines)
Lines 769-776 sub checkauth { Link Here
769
            }
769
            }
770
770
771
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
771
            # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
772
            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac') {
772
            if ( $shib and $shib_login and $shibSuccess) {
773
            # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
774
                logout_shib($query);
773
                logout_shib($query);
775
            }
774
            }
776
        }
775
        }
Lines 851-857 sub checkauth { Link Here
851
850
852
            my ( $return, $cardnumber );
851
            my ( $return, $cardnumber );
853
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
852
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
854
            if ( $shib && $shib_login && $type eq 'opac' ) {
853
            if ( $shib && $shib_login ) {
855
                my $retuserid;
854
                my $retuserid;
856
		# Do not pass password here, else shib will not be checked in checkpw.
855
		# Do not pass password here, else shib will not be checked in checkpw.
857
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
856
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
(-)a/C4/Auth_with_shibboleth.pm (-9 / +24 lines)
Lines 36-63 BEGIN { Link Here
36
    @ISA     = qw(Exporter);
36
    @ISA     = qw(Exporter);
37
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
37
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
38
}
38
}
39
my $context = C4::Context->new() or die 'C4::Context->new failed';
39
40
my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
40
my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
41
my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
41
my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
42
my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml';
42
my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml';
43
my $protocol = "https://";
44
43
45
# Logout from Shibboleth
44
# Logout from Shibboleth
46
sub logout_shib {
45
sub logout_shib {
47
    my ($query) = @_;
46
    my ($query) = @_;
48
    my $uri = $protocol . C4::Context->preference('OPACBaseURL');
47
    my $uri = _get_uri();
49
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
48
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
50
}
49
}
51
50
52
# Returns Shibboleth login URL with callback to the requesting URL
51
# Returns Shibboleth login URL with callback to the requesting URL
53
sub login_shib_url {
52
sub login_shib_url {
54
55
    my ($query) = @_;
53
    my ($query) = @_;
56
    my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name();
54
    my $param = _get_uri() . $query->script_name();
57
    if ( $query->query_string() ) {
55
    if ( $query->query_string() ) {
58
        $param = $param . '%3F' . $query->query_string();
56
        $param = $param . '%3F' . $query->query_string();
59
    }
57
    }
60
    my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param";
58
    my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param";
61
    return $uri;
59
    return $uri;
62
}
60
}
63
61
Lines 75-81 sub get_login_shib { Link Here
75
    $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
73
    $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
76
    $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
74
    $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
77
75
78
    return $ENV{$shibbolethMatchAttribute} || '';
76
    my @attribute = split(';',$ENV{$shibbolethMatchAttribute});
77
    return $attribute[0] || '';
79
}
78
}
80
79
81
# Checks for password correctness
80
# Checks for password correctness
Lines 84-90 sub checkpw_shib { Link Here
84
    $debug and warn "checkpw_shib";
83
    $debug and warn "checkpw_shib";
85
84
86
    my ( $dbh, $match ) = @_;
85
    my ( $dbh, $match ) = @_;
87
    my $retnumber;
86
    my ( $retnumber, $userid );
88
    $debug and warn "User Shibboleth-authenticated as: $match";
87
    $debug and warn "User Shibboleth-authenticated as: $match";
89
88
90
    # Does the given shibboleth attribute value ($match) match a valid koha user ?
89
    # Does the given shibboleth attribute value ($match) match a valid koha user ?
Lines 101-111 sub checkpw_shib { Link Here
101
    if ( $shib->{'autocreate'} ) {
100
    if ( $shib->{'autocreate'} ) {
102
        return _autocreate( $dbh, $shib, $match );
101
        return _autocreate( $dbh, $shib, $match );
103
    } else {
102
    } else {
104
        $debug and warn "User $userid is not a valid Koha user";
103
        $debug and warn "User $match is not a valid Koha user";
105
        return 0;
104
        return 0;
106
    }
105
    }
107
}
106
}
108
107
108
sub _get_uri {
109
110
    my $protocol = "https://";
111
    my $interface = C4::Context->interface;
112
    $debug and warn "shibboleth interface: " . $interface;
113
114
    my $return;
115
    if ( $interface eq 'intranet' ) {
116
        $return = $protocol . C4::Context->preference('staffClientBaseURL');
117
        return $return;
118
    } else {
119
        $return = $protocol . C4::Context->preference('OPACBaseURL');
120
        return $return;
121
    }
122
}
123
109
sub _autocreate {
124
sub _autocreate {
110
    my ( $dbh, $shib, $match ) = @_;
125
    my ( $dbh, $shib, $match ) = @_;
111
126
(-)a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt (-1 / +8 lines)
Lines 42-47 Link Here
42
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
42
<div id="login_error"><strong>Error: </strong>Invalid username or password</div>
43
[% END %]
43
[% END %]
44
44
45
[% IF (shibbolethAuthentication) %]
46
<!-- This is what is displayed if shib login has failed -->
47
[% IF (invalidShibLogin ) %]
48
<div id="login_error"><Strong>Error: </strong>Shibboleth login failed</div>
49
[% END %]
50
<p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here</a> to login.</p>
51
[% END %]
52
45
<!-- login prompt time-->
53
<!-- login prompt time-->
46
<form action="[% url %]" method="post" name="loginform" id="loginform">
54
<form action="[% url %]" method="post" name="loginform" id="loginform">
47
    <input type="hidden" name="koha_login_context" value="intranet" />
55
    <input type="hidden" name="koha_login_context" value="intranet" />
48
- 

Return to bug 12027