View | Details | Raw Unified | Return to bug 6012
Collapse All | Expand All

(-)a/C4/Auth.pm (-10 / +16 lines)
Lines 52-58 BEGIN { Link Here
52
    }
52
    }
53
    if ($cas) {
53
    if ($cas) {
54
        require C4::Auth_with_cas;             # no import
54
        require C4::Auth_with_cas;             # no import
55
        import  C4::Auth_with_cas qw(checkpw_cas login_cas logout_cas login_cas_url);
55
        import  C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
56
    }
56
    }
57
57
58
}
58
}
Lines 1046-1052 sub check_api_auth { Link Here
1046
    unless ($query->param('userid')) {
1046
    unless ($query->param('userid')) {
1047
        $sessionID = $query->cookie("CGISESSID");
1047
        $sessionID = $query->cookie("CGISESSID");
1048
    }
1048
    }
1049
    if ($sessionID) {
1049
    if ($sessionID && not $cas) {
1050
        my $session = get_session($sessionID);
1050
        my $session = get_session($sessionID);
1051
        C4::Context->_new_userenv($sessionID);
1051
        C4::Context->_new_userenv($sessionID);
1052
        if ($session) {
1052
        if ($session) {
Lines 1096-1113 sub check_api_auth { Link Here
1096
        # new login
1096
        # new login
1097
        my $userid = $query->param('userid');
1097
        my $userid = $query->param('userid');
1098
        my $password = $query->param('password');
1098
        my $password = $query->param('password');
1099
        unless ($userid and $password) {
1099
       	my ($return, $cardnumber);
1100
            # caller did something wrong, fail the authenticateion
1100
1101
            return ("failed", undef, undef);
1101
	# Proxy CAS auth
1102
        }
1102
	if ($cas && $query->param('PT')) {
1103
	my ($return, $cardnumber);
1104
	if ($cas && $query->param('ticket')) {
1105
	    my $retuserid;
1103
	    my $retuserid;
1106
	    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
1104
	    $debug and print STDERR "## check_api_auth - checking CAS\n";
1107
	    $userid = $retuserid;
1105
	    # In case of a CAS authentication, we use the ticket instead of the password
1106
	    my $PT = $query->param('PT');
1107
	    ($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query);    # EXTERNAL AUTH
1108
	} else {
1108
	} else {
1109
	    # User / password auth
1110
	    unless ($userid and $password) {
1111
		# caller did something wrong, fail the authenticateion
1112
		return ("failed", undef, undef);
1113
	    }
1109
	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
1114
	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
1110
	}
1115
	}
1116
1111
        if ($return and haspermission(  $userid, $flagsrequired)) {
1117
        if ($return and haspermission(  $userid, $flagsrequired)) {
1112
            my $session = get_session("");
1118
            my $session = get_session("");
1113
            return ("failed", undef, undef) unless $session;
1119
            return ("failed", undef, undef) unless $session;
(-)a/C4/Auth_with_cas.pm (-1 / +51 lines)
Lines 34-40 BEGIN { Link Here
34
	$VERSION = 3.03;	# set the version for version checking
34
	$VERSION = 3.03;	# set the version for version checking
35
	$debug = $ENV{DEBUG};
35
	$debug = $ENV{DEBUG};
36
	@ISA    = qw(Exporter);
36
	@ISA    = qw(Exporter);
37
	@EXPORT = qw(checkpw_cas login_cas logout_cas login_cas_url);
37
	@EXPORT = qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
38
}
38
}
39
39
40
40
Lines 107-112 sub checkpw_cas { Link Here
107
    return 0;
107
    return 0;
108
}
108
}
109
109
110
# Proxy CAS auth
111
sub check_api_auth_cas {
112
    $debug and warn "check_api_auth_cas";
113
    my ($dbh, $PT, $query) = @_;
114
    my $retnumber;
115
    my $url = $query->url();
116
    my $cas = Authen::CAS::Client->new($casserver);
117
    
118
    # If we have a Proxy Ticket
119
    if ($PT) {
120
	my $r = $cas->proxy_validate( $url, $PT );
121
122
	# If the PT is valid
123
	if( $r->is_success ) {
124
125
	    # We've got a username ! 
126
	    $debug and warn "User authenticated as: ", $r->user, "\n";
127
	    $debug and warn "Proxied through:\n";
128
	    $debug and warn "  $_\n"
129
	      for $r->proxies;
130
131
	    my $userid = $r->user;
132
	    
133
	    # Does it match one of our users ?
134
    	    my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
135
    	    $sth->execute($userid);
136
    	    if ( $sth->rows ) {
137
		$retnumber = $sth->fetchrow;
138
		return (1, $retnumber, $userid);
139
	    }
140
	    my $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
141
	    return $r->user;
142
	    $sth->execute($userid);
143
	    if ( $sth->rows ) {
144
	    	$retnumber = $sth->fetchrow;
145
		return (1, $retnumber, $userid);
146
	    }
147
	    
148
	    # If we reach this point, then the user is a valid CAS user, but not a Koha user
149
	    $debug and warn "User $userid is not a valid Koha user";
150
151
	} else {
152
	    $debug and warn "Proxy Ticket authentication failed";
153
	    return 0;
154
	}
155
    }
156
    return 0;
157
}
158
159
110
1;
160
1;
111
__END__
161
__END__
112
162
(-)a/docs/CAS/CASProxy/README (+9 lines)
Line 0 Link Here
1
As CAS Proxying is not an obvious authentication to set up, here are
2
some documented examples showing how a foreign application can query
3
koha webservices, being CAS authenticated.
4
5
The starting point is proxy_cas.pl
6
7
To find more about how CAS Proxy works :
8
http://afs.berkeley.edu/~lr/presentations/cas-auth/
9
http://www.ja-sig.org/wiki/display/CAS/Proxy+CAS+Walkthrough
(-)a/docs/CAS/CASProxy/examples/koha_webservice.pl (+58 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# Here is an exemple of a simple phony webservice, returning "Hello World" if the user is authenticated
23
# The purpose is to show how CAS Proxy can work with koha
24
# In this configuration, this page acts as a CAS Client, instead of the user's browser.
25
# This page is meant to be called from a foreign application
26
27
=head1 CGI PARAMETERS
28
29
=item PT
30
The Proxy Ticket, needed for check_api_auth, that will try to make the CAS Server validate it.
31
32
=cut 
33
34
use utf8;
35
use strict;
36
use warnings;
37
binmode(STDOUT, ":utf8");
38
39
use C4::Auth qw(check_api_auth);
40
use C4::Output;
41
use C4::Context;
42
use CGI;
43
44
my $cgi = new CGI;
45
46
print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8');
47
48
# The authentication : if $cgi contains a PT parameter, and CAS is enabled (casAuthentication syspref),
49
# a CAS Proxy authentication will take place
50
my ( $status, $cookie_, $sessionID ) = check_api_auth( $cgi, {circulate => 'override_renewals'});
51
52
if ($status ne 'ok') {
53
    print "Authentication failed : $status";
54
} else {
55
    print "Hello World!";
56
}
57
exit 0;
58
(-)a/docs/CAS/CASProxy/examples/proxy_cas.pl (+91 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# Here is an exemple of a CAS Proxy
23
# The proxy is a foreign application that will authenticate the user against CAS
24
# Once authenticated as a proxy, the foreign application will be able to call some
25
# Koha webservices, proving authentication only by giving a proxy ticket
26
27
# Note: please keep in mind that all url's must be https and their certificates must be trusted
28
29
=cut
30
31
use strict;
32
use warnings;
33
use CGI;
34
use Authen::CAS::Client;
35
36
# URL Of the CAS Server
37
my $casServerUrl = 'https://localhost:8443/cas/';
38
my $cas = Authen::CAS::Client->new($casServerUrl);
39
my $cgi = new CGI;
40
41
# URL of the service we're requesting a Service Ticket for (typically this very same page)
42
my $proxy_service = $cgi->url;
43
44
45
# Callback URL (this is an URL the CAS Server will query, providing the Proxy Ticket we'll need 
46
# to query the koha webservice). It can be this page or another. In this example, another page will be 
47
# called back
48
my $pgtUrl = "https://.../proxy_cas_callback.pl";
49
50
print $cgi->header({-type  =>  'text/html'});
51
print $cgi->start_html("proxy cas");
52
53
# If we already have a service ticket
54
if ($cgi->param('ticket')) {
55
56
    print "Got a ticket :" . $cgi->param('ticket') . "<br>\n";
57
  
58
    # We validate it against the CAS Server, providing the callback URL
59
    my $r = $cas->service_validate( $proxy_service, $cgi->param('ticket'), pgtUrl => $pgtUrl);
60
61
    # If it is sucessful, we are authenticated
62
    if( $r->is_success() ) {
63
	print "User authenticated as: ", $r->user(), "<br>\n";
64
    } else {
65
	print "User authentication failed<br />\n";
66
    }
67
68
    # If we have a PGTIou ticket, the proxy validation was sucessful 
69
    if (defined $r->iou) {
70
      print "Proxy granting ticket IOU: ", $r->iou, "<br />\n";
71
      my $pgtIou = $r->iou;
72
73
      print '<a href="proxy_cas_data.pl?PGTIOU=', $r->iou, '">Next</a>';
74
75
      
76
     	    
77
    } else {
78
      print "Service validation for proxying failed\n";
79
   }
80
81
# If we don't have a Service Ticket, we ask for one (ie : the user will be redirected to the CAS Server for authentication)
82
} else {
83
84
    my $url = $cas->login_url($proxy_service);
85
    print "<a href=\"$url\">Please log in</a>";
86
}
87
88
print $cgi->end_html;
89
90
91
(-)a/docs/CAS/CASProxy/examples/proxy_cas_callback.pl (+62 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# Here is an exemple of a callback page for a CAS Proxy
23
# This is the page the CAS server will call back with a Proxy Ticket, allowing us (the foreign application)
24
# to query koha webservices, being CAS authenticated 
25
26
=cut
27
28
use strict;
29
use warnings;
30
use CGI;
31
use Authen::CAS::Client;
32
use Storable qw(nstore_fd);
33
34
my $casServerUrl = 'https://localhost:8443/cas/';
35
my $cas = Authen::CAS::Client->new($casServerUrl);
36
37
my $cgi = new CGI;
38
39
my $proxy_service = $cgi->url;
40
41
print $cgi->header({-type  =>  'text/html'});
42
print $cgi->start_html("proxy cas callback");
43
44
# If we have a pgtId, it means the cas server called us back
45
if ($cgi->param('pgtId')) {
46
    warn "Got a pgtId :" . $cgi->param('pgtId');
47
    warn "Got a pgtIou :" . $cgi->param('pgtIou');
48
    my $pgtIou =  $cgi->param('pgtIou');
49
    my $pgtId =  $cgi->param('pgtId');
50
51
    # Now we store the pgtIou and the pgtId in the application vars (in our case a storable object in a file), 
52
    # so that the page requesting the webservice can retrieve the pgtId matching it's PgtIou 
53
    open FILE, ">", "casSession.tmp" or die "Unable to open file";
54
    nstore_fd({$pgtIou => $pgtId}, \*FILE);
55
    close FILE;
56
57
} else {
58
    warn "Failed to get a Proxy Ticket\n";
59
}
60
61
print $cgi->end_html;
62
(-)a/docs/CAS/CASProxy/examples/proxy_cas_data.pl (-1 / +80 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# This page will display the result of the call to the koha webservice
23
24
=head1 CGI PARAMETERS
25
26
=item PGTIOU
27
28
The Proxy Granting Ticket IOU the CAS Server returned to us when we gave him the Service Ticket
29
This PGTIOU will allow us to retrive the matching PGTID
30
31
=cut 
32
33
use strict;
34
use warnings;
35
use CGI;
36
use Authen::CAS::Client;
37
use Storable qw(fd_retrieve);
38
use LWP::Simple;
39
use URI::Escape;
40
41
my $casServerUrl = 'https://localhost:8443/cas/';
42
my $cas = Authen::CAS::Client->new($casServerUrl);
43
44
# URL of the service we'd like to be proxy for (typically the Koha webservice we want to query)
45
my $target_service = "https://.../koha_webservice.pl";
46
47
my $cgi = new CGI;
48
49
print $cgi->header({-type  =>  'text/html'});
50
print $cgi->start_html("proxy cas");
51
52
53
if ($cgi->param('PGTIOU')) {
54
55
      # At this point, we must retrieve the PgtId by matching the PgtIou we
56
      # just received and the PgtIou given by the CAS Server to the callback URL
57
      # The callback page stored it in the application vars (in our case a storable object in a file)
58
      open FILE, "casSession.tmp" or die "Unable to open file";
59
      my $hashref = fd_retrieve(\*FILE);
60
      my $pgtId = %$hashref->{$cgi->param('PGTIOU')};
61
      close FILE;
62
63
      # Now that we have a PgtId, we can ask the cas server for a proxy ticket...
64
      my $rp = $cas->proxy( $pgtId, $target_service );
65
      if( $rp->is_success ) {
66
        print "Proxy Ticket issued: ", $rp->proxy_ticket, "<br />\n";
67
68
	# ...which we will provide to the target service (the koha webservice) for authentication !
69
	my $data = get($target_service . "?PT=" . $rp->proxy_ticket);
70
	
71
	# And finally, we can display the data gathered from the koha webservice !
72
	print "This is the output of the koha webservice we just queried, CAS authenticated : <br/>";
73
	print "<code>$data</code>";
74
75
      } else {
76
	print "Cannot get Proxy Ticket";
77
      }
78
79
80
}

Return to bug 6012