View | Details | Raw Unified | Return to bug 8446
Collapse All | Expand All

(-)a/C4/Auth.pm (-13 / +13 lines)
Lines 305-314 sub get_template_and_user { Link Here
305
    }
305
    }
306
    else {    # if this is an anonymous session, setup to display public lists...
306
    else {    # if this is an anonymous session, setup to display public lists...
307
307
308
	# If shibboleth is enabled, and we're in an anonymous session, we should allow
308
    # If shibboleth is enabled, and we're in an anonymous session, we should allow
309
    # the user to attemp login via shibboleth.
309
    # the user to attemp login via shibboleth.
310
	if ( $shib ) {
310
    if ( $shib ) {
311
	    $template->param( shibbolethAuthentication => $shib,
311
        $template->param( shibbolethAuthentication => $shib,
312
                shibbolethLoginUrl    => login_shib_url($in->{'query'}),
312
                shibbolethLoginUrl    => login_shib_url($in->{'query'}),
313
            );
313
            );
314
            # If shibboleth is enabled and we have a shibboleth login attribute,
314
            # If shibboleth is enabled and we have a shibboleth login attribute,
Lines 761-767 sub checkauth { Link Here
761
        }
761
        }
762
        elsif ($logout) {
762
        elsif ($logout) {
763
            # voluntary logout the user
763
            # voluntary logout the user
764
	    # check wether the user was using their shibboleth session or a local one
764
        # check wether the user was using their shibboleth session or a local one
765
            my $shibSuccess = C4::Context->userenv->{'shibboleth'};
765
            my $shibSuccess = C4::Context->userenv->{'shibboleth'};
766
            $session->delete();
766
            $session->delete();
767
            $session->flush;
767
            $session->flush;
Lines 853-873 sub checkauth { Link Here
853
            || $persona )
853
            || $persona )
854
        {
854
        {
855
            my $password = $query->param('password');
855
            my $password = $query->param('password');
856
	    my $shibSuccess = 0;
856
        my $shibSuccess = 0;
857
857
858
            my ( $return, $cardnumber );
858
            my ( $return, $cardnumber );
859
	    # If shib is enabled and we have a shib login, does the login match a valid koha user
859
        # If shib is enabled and we have a shib login, does the login match a valid koha user
860
            if ( $shib && $shib_login && $type eq 'opac' ) {
860
            if ( $shib && $shib_login && $type eq 'opac' ) {
861
                my $retuserid;
861
                my $retuserid;
862
		# Do not pass password here, else shib will not be checked in checkpw.
862
        # Do not pass password here, else shib will not be checked in checkpw.
863
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
863
                ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, undef, $query );
864
                $userid = $retuserid;
864
                $userid = $retuserid;
865
		$shibSuccess = $return;
865
        $shibSuccess = $return;
866
                $info{'invalidShibLogin'} = 1 unless ($return);
866
                $info{'invalidShibLogin'} = 1 unless ($return);
867
            }
867
            }
868
	    # If shib login and match were successfull, skip further login methods
868
        # If shib login and match were successfull, skip further login methods
869
	    unless ( $shibSuccess ) {
869
        unless ( $shibSuccess ) {
870
	    if ( $cas && $query->param('ticket') ) {
870
        if ( $cas && $query->param('ticket') ) {
871
                my $retuserid;
871
                my $retuserid;
872
                ( $return, $cardnumber, $retuserid ) =
872
                ( $return, $cardnumber, $retuserid ) =
873
                  checkpw( $dbh, $userid, $password, $query );
873
                  checkpw( $dbh, $userid, $password, $query );
Lines 934-940 sub checkauth { Link Here
934
                ( $return, $cardnumber, $retuserid ) =
934
                ( $return, $cardnumber, $retuserid ) =
935
                  checkpw( $dbh, $userid, $password, $query );
935
                  checkpw( $dbh, $userid, $password, $query );
936
                $userid = $retuserid if ( $retuserid );
936
                $userid = $retuserid if ( $retuserid );
937
		$info{'invalid_username_or_password'} = 1 unless ($return);
937
        $info{'invalid_username_or_password'} = 1 unless ($return);
938
        } }
938
        } }
939
        if ($return) {
939
        if ($return) {
940
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
940
               #_session_log(sprintf "%20s from %16s logged in  at %30s.\n", $userid,$ENV{'REMOTE_ADDR'},(strftime '%c', localtime));
Lines 1023-1029 sub checkauth { Link Here
1023
                    $session->param('emailaddress',$emailaddress);
1023
                    $session->param('emailaddress',$emailaddress);
1024
                    $session->param('ip',$session->remote_addr());
1024
                    $session->param('ip',$session->remote_addr());
1025
                    $session->param('lasttime',time());
1025
                    $session->param('lasttime',time());
1026
		    $session->param('shibboleth',$shibSuccess);
1026
            $session->param('shibboleth',$shibSuccess);
1027
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
1027
                    $debug and printf STDERR "AUTH_4: (%s)\t%s %s - %s\n", map {$session->param($_)} qw(cardnumber firstname surname branch) ;
1028
                }
1028
                }
1029
                elsif ( $return == 2 ) {
1029
                elsif ( $return == 2 ) {
(-)a/C4/Auth_with_shibboleth.pm (-25 / +30 lines)
Lines 1-21 Link Here
1
package C4::Auth_with_shibboleth;
1
package C4::Auth_with_shibboleth;
2
2
3
# Copyright 2011 BibLibre
3
# Copyright 2014 PTFS Europe
4
#
4
#
5
# This file is part of Koha.
5
# This file is part of Koha.
6
#
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
7
# Koha is free software; you can redistribute it and/or modify it
8
# terms of the GNU General Public License as published by the Free Software
8
# under the terms of the GNU General Public License as published by
9
# Foundation; either version 2 of the License, or (at your option) any later
9
# the Free Software Foundation; either version 3 of the License, or
10
# version.
10
# (at your option) any later version.
11
#
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
12
# Koha is distributed in the hope that it will be useful, but
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
15
#
16
#
16
# You should have received a copy of the GNU General Public License along
17
# You should have received a copy of the GNU General Public License
17
# with Koha; if not, write to the Free Software Foundation, Inc.,
18
# along with Koha; if not, see <http://www.gnu.org/licenses>.
18
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19
19
20
use strict;
20
use strict;
21
use warnings;
21
use warnings;
Lines 29-45 use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug); Link Here
29
29
30
BEGIN {
30
BEGIN {
31
    require Exporter;
31
    require Exporter;
32
    $VERSION = 3.03;                                                                    # set the version for version checking
32
    $VERSION = 3.03;           # set the version for version checking
33
    $debug   = $ENV{DEBUG};
33
    $debug   = $ENV{DEBUG};
34
    @ISA     = qw(Exporter);
34
    @ISA     = qw(Exporter);
35
    @EXPORT  = qw(shib_ok logout_shib login_shib_url checkpw_shib get_login_shib);
35
    @EXPORT =
36
      qw(shib_ok logout_shib login_shib_url checkpw_shib get_login_shib);
36
}
37
}
37
38
38
# Check that shib config is not malformed
39
# Check that shib config is not malformed
39
sub shib_ok {
40
sub shib_ok {
40
    my $config = _get_shib_config();
41
    my $config = _get_shib_config();
41
42
42
    if ( $config ) {
43
    if ($config) {
43
        return 1;
44
        return 1;
44
    }
45
    }
45
46
Lines 68-87 sub login_shib_url { Link Here
68
# Returns shibboleth user login
69
# Returns shibboleth user login
69
sub get_login_shib {
70
sub get_login_shib {
70
71
71
    # In case of a Shibboleth authentication, we expect a shibboleth user attribute
72
# In case of a Shibboleth authentication, we expect a shibboleth user attribute
72
    # to contain the login match point of the shibboleth-authenticated user. This match
73
# to contain the login match point of the shibboleth-authenticated user. This match
73
    # point is configured in koha-conf.xml
74
# point is configured in koha-conf.xml
74
75
75
    # Shibboleth attributes are mapped into http environmement variables, so we're getting
76
# Shibboleth attributes are mapped into http environmement variables, so we're getting
76
    # the match point of the user this way
77
# the match point of the user this way
77
78
78
    # Get shibboleth config
79
    # Get shibboleth config
79
    my $config = _get_shib_config();
80
    my $config = _get_shib_config();
80
81
81
    my $matchAttribute = $config->{mapping}->{ $config->{matchpoint} }->{is};
82
    my $matchAttribute = $config->{mapping}->{ $config->{matchpoint} }->{is};
82
    $debug and warn $matchAttribute . " value: " . $ENV{ $matchAttribute };
83
    $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute};
83
84
84
    return $ENV{ $matchAttribute } || '';
85
    return $ENV{$matchAttribute} || '';
85
}
86
}
86
87
87
# Checks for password correctness
88
# Checks for password correctness
Lines 94-111 sub checkpw_shib { Link Here
94
    my $config = _get_shib_config();
95
    my $config = _get_shib_config();
95
    $debug and warn "User Shibboleth-authenticated as: $match";
96
    $debug and warn "User Shibboleth-authenticated as: $match";
96
97
97
    # Does the given shibboleth attribute value ($match) match a valid koha user ?
98
  # Does the given shibboleth attribute value ($match) match a valid koha user ?
98
    my $sth = $dbh->prepare("select cardnumber, userid from borrowers where $config->{matchpoint}=?");
99
    my $sth = $dbh->prepare(
100
        "select cardnumber, userid from borrowers where $config->{matchpoint}=?"
101
    );
99
    $sth->execute($match);
102
    $sth->execute($match);
100
    if ( $sth->rows ) {
103
    if ( $sth->rows ) {
101
        my @retvals = $sth->fetchrow;
104
        my @retvals = $sth->fetchrow;
102
        $retnumber = $retvals[0];
105
        $retnumber = $retvals[0];
103
        $userid = $retvals[1];
106
        $userid    = $retvals[1];
104
        return ( 1, $retnumber, $userid );
107
        return ( 1, $retnumber, $userid );
105
    }
108
    }
106
109
107
    # If we reach this point, the user is not a valid koha user
110
    # If we reach this point, the user is not a valid koha user
108
    $debug and warn "User with $config->{matchpoint} of $match is not a valid Koha user";
111
    $debug
112
      and warn
113
      "User with $config->{matchpoint} of $match is not a valid Koha user";
109
    return 0;
114
    return 0;
110
}
115
}
111
116
(-)a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc (-2 / +1 lines)
Lines 292-298 Link Here
292
                    <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
292
                    <p>If you have a Shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here to login</a>.</p>
293
                    <h4>Local Login</h4>
293
                    <h4>Local Login</h4>
294
                    [% END %]
294
                    [% END %]
295
		    [% END %]
295
            [% END %]
296
                    <input type="hidden" name="koha_login_context" value="opac" />
296
                    <input type="hidden" name="koha_login_context" value="opac" />
297
                    <fieldset class="brief">
297
                    <fieldset class="brief">
298
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
298
                        <label for="muserid">Login:</label><input type="text" id="muserid" name="userid" />
299
- 

Return to bug 8446