View | Details | Raw Unified | Return to bug 8446
Collapse All | Expand All

(-)a/C4/Auth.pm (-3 / +10 lines)
Lines 65-74 BEGIN { Link Here
65
    }
65
    }
66
    if ($shib) {
66
    if ($shib) {
67
        import C4::Auth_with_shibboleth
67
        import C4::Auth_with_shibboleth
68
          qw(checkpw_shib logout_shib login_shib_url get_login_shib);
68
          qw(shib_ok checkpw_shib logout_shib login_shib_url get_login_shib);
69
69
70
        # Get shibboleth login attribute
70
        # Check for good config
71
        $shib_login = get_login_shib();
71
        if ( shib_ok() ) {
72
            # Get shibboleth login attribute
73
            $shib_login = get_login_shib();
74
        }
75
        # Bad config, disable shibboleth
76
        else {
77
            $shib = 0;
78
        }
72
    }
79
    }
73
    if ($cas) {
80
    if ($cas) {
74
        import  C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
81
        import  C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
(-)a/C4/Auth_with_shibboleth.pm (-24 / +69 lines)
Lines 32-61 BEGIN { Link Here
32
    $VERSION = 3.03;                                                                    # set the version for version checking
32
    $VERSION = 3.03;                                                                    # set the version for version checking
33
    $debug   = $ENV{DEBUG};
33
    $debug   = $ENV{DEBUG};
34
    @ISA     = qw(Exporter);
34
    @ISA     = qw(Exporter);
35
    @EXPORT  = qw(logout_shib login_shib_url checkpw_shib get_login_shib);
35
    @EXPORT  = qw(shib_ok logout_shib login_shib_url checkpw_shib get_login_shib);
36
}
37
38
# Check that shib config is not malformed
39
sub shib_ok {
40
    my $config = _get_shib_config();
41
42
    if ( $config ) {
43
        return 1;
44
    }
45
46
    return 0;
36
}
47
}
37
my $context = C4::Context->new() or die 'C4::Context->new failed';
38
my $shib = C4::Context->config('shibboleth') or croak 'No <shibboleth> in koha-conf.xml';
39
my $shibbolethMatchField     = $shib->{matchpoint} or croak 'No <matchpoint> defined in koha-conf.xml';
40
my $shibbolethMatchAttribute = $shib->{mapping}->{$shibbolethMatchField}->{is} or croak 'Matchpoint not mapped in koha-conf.xml';
41
my $protocol = "https://";
42
48
43
# Logout from Shibboleth
49
# Logout from Shibboleth
44
sub logout_shib {
50
sub logout_shib {
45
    my ($query) = @_;
51
    my ($query) = @_;
46
    my $uri = $protocol . C4::Context->preference('OPACBaseURL');
52
    my $uri = _get_uri();
47
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
53
    print $query->redirect( $uri . "/Shibboleth.sso/Logout?return=$uri" );
48
}
54
}
49
55
50
# Returns Shibboleth login URL with callback to the requesting URL
56
# Returns Shibboleth login URL with callback to the requesting URL
51
sub login_shib_url {
57
sub login_shib_url {
52
53
    my ($query) = @_;
58
    my ($query) = @_;
54
    my $param = $protocol . C4::Context->preference('OPACBaseURL') . $query->script_name();
59
60
    my $param = _get_uri() . $query->script_name();
55
    if ( $query->query_string() ) {
61
    if ( $query->query_string() ) {
56
        $param = $param . '%3F' . $query->query_string();
62
        $param = $param . '%3F' . $query->query_string();
57
    }
63
    }
58
    my $uri = $protocol . C4::Context->preference('OPACBaseURL') . "/Shibboleth.sso/Login?target=$param";
64
    my $uri = _get_uri() . "/Shibboleth.sso/Login?target=$param";
59
    return $uri;
65
    return $uri;
60
}
66
}
61
67
Lines 69-79 sub get_login_shib { Link Here
69
    # Shibboleth attributes are mapped into http environmement variables, so we're getting
75
    # Shibboleth attributes are mapped into http environmement variables, so we're getting
70
    # the match point of the user this way
76
    # the match point of the user this way
71
77
72
    $debug and warn "koha borrower field to match: $shibbolethMatchField";
78
    # Get shibboleth config
73
    $debug and warn "shibboleth attribute to match: $shibbolethMatchAttribute";
79
    my $config = _get_shib_config();
74
    $debug and warn "$shibbolethMatchAttribute value: $ENV{$shibbolethMatchAttribute}";
75
80
76
    return $ENV{$shibbolethMatchAttribute} || '';
81
    my $matchAttribute = $config->{mapping}->{ $config->{matchpoint} }->{is};
82
    $debug and warn $matchAttribute . " value: " . $ENV{ $matchAttribute };
83
84
    return $ENV{ $matchAttribute } || '';
77
}
85
}
78
86
79
# Checks for password correctness
87
# Checks for password correctness
Lines 81-105 sub get_login_shib { Link Here
81
sub checkpw_shib {
89
sub checkpw_shib {
82
    $debug and warn "checkpw_shib";
90
    $debug and warn "checkpw_shib";
83
91
84
    my ( $dbh, $userid ) = @_;
92
    my ( $dbh, $match ) = @_;
85
    my $retnumber;
93
    my ( $retnumber, $userid );
86
    $debug and warn "User Shibboleth-authenticated as: $userid";
94
    my $config = _get_shib_config();
95
    $debug and warn "User Shibboleth-authenticated as: $match";
87
96
88
    # Does the given shibboleth attribute value ($userid) match a valid koha user ?
97
    # Does the given shibboleth attribute value ($match) match a valid koha user ?
89
    my $sth = $dbh->prepare("select cardnumber, userid from borrowers where $shibbolethMatchField=?");
98
    my $sth = $dbh->prepare("select cardnumber, userid from borrowers where $config->{matchpoint}=?");
90
    $sth->execute($userid);
99
    $sth->execute($match);
91
    if ( $sth->rows ) {
100
    if ( $sth->rows ) {
92
        my @retvals = $sth->fetchrow;
101
        my @retvals = $sth->fetchrow;
93
        $retnumber = $retvals[1];
102
        $retnumber = $retvals[0];
94
        $userid = $retvals[0];
103
        $userid = $retvals[1];
95
        return ( 1, $retnumber, $userid );
104
        return ( 1, $retnumber, $userid );
96
    }
105
    }
97
106
98
    # If we reach this point, the user is not a valid koha user
107
    # If we reach this point, the user is not a valid koha user
99
    $debug and warn "User $userid is not a valid Koha user";
108
    $debug and warn "User with $config->{matchpoint} of $match is not a valid Koha user";
100
    return 0;
109
    return 0;
101
}
110
}
102
111
112
sub _get_uri {
113
114
    my $protocol = "https://";
115
116
    my $return = $protocol . C4::Context->preference('OPACBaseURL');
117
    return $return;
118
}
119
120
sub _get_shib_config {
121
    my $config = C4::Context->config('shibboleth');
122
123
    if ( !$config ) {
124
        carp 'shibboleth config not defined';
125
        return 0;
126
    }
127
128
    if ( $config->{matchpoint}
129
        && defined( $config->{mapping}->{ $config->{matchpoint} }->{is} ) )
130
    {
131
        if ($debug) {
132
            warn "koha borrower field to match: " . $config->{matchpoint};
133
            warn "shibboleth attribute to match: "
134
              . $config->{mapping}->{ $config->{matchpoint} }->{is};
135
        }
136
        return $config;
137
    }
138
    else {
139
        if ( !$config->{matchpoint} ) {
140
            carp 'shibboleth matchpoint not defined';
141
        }
142
        else {
143
            carp 'shibboleth matchpoint not mapped';
144
        }
145
        return 0;
146
    }
147
}
148
103
1;
149
1;
104
__END__
150
__END__
105
151
106
- 

Return to bug 8446