View | Details | Raw Unified | Return to bug 5630
Collapse All | Expand All

(-)a/C4/Auth.pm (-32 / +28 lines)
Lines 52-58 BEGIN { Link Here
52
    }
52
    }
53
    if ($cas) {
53
    if ($cas) {
54
        require C4::Auth_with_cas;             # no import
54
        require C4::Auth_with_cas;             # no import
55
        import  C4::Auth_with_cas qw(checkpw_cas login_cas logout_cas login_cas_url);
55
        import  C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
56
    }
56
    }
57
57
58
}
58
}
Lines 121-128 Output.pm module. Link Here
121
=cut
121
=cut
122
122
123
my $SEARCH_HISTORY_INSERT_SQL =<<EOQ;
123
my $SEARCH_HISTORY_INSERT_SQL =<<EOQ;
124
INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, total, time            )
124
INSERT INTO search_history(userid, sessionid, query_desc, query_cgi, limit_desc, limit_cgi, total, time            )
125
VALUES                    (     ?,         ?,          ?,         ?,     ?, FROM_UNIXTIME(?))
125
VALUES                    (     ?,         ?,          ?,         ?,          ?,         ?,     ?, FROM_UNIXTIME(?))
126
EOQ
126
EOQ
127
sub get_template_and_user {
127
sub get_template_and_user {
128
    my $in       = shift;
128
    my $in       = shift;
Lines 252-264 sub get_template_and_user { Link Here
252
			        my @recentSearches = @{thaw($searchcookie) || []};
252
			        my @recentSearches = @{thaw($searchcookie) || []};
253
				if (@recentSearches) {
253
				if (@recentSearches) {
254
					my $sth = $dbh->prepare($SEARCH_HISTORY_INSERT_SQL);
254
					my $sth = $dbh->prepare($SEARCH_HISTORY_INSERT_SQL);
255
					$sth->execute( $borrowernumber,
255
                    
256
						       $in->{'query'}->cookie("CGISESSID"),
256
                    $sth->execute( $borrowernumber, $in->{'query'}->cookie("CGISESSID"), $_->{'query_desc'}, $_->{'query_cgi'}, $_->{'limit_desc'}, $_->{'limit_cgi'}, $_->{'total'}, $_->{'time'}, )
257
						       $_->{'query_desc'},
257
                                foreach @recentSearches;
258
						       $_->{'query_cgi'},
259
						       $_->{'total'},
260
						       $_->{'time'},
261
                                        ) foreach @recentSearches;
262
258
263
					# And then, delete the cookie's content
259
					# And then, delete the cookie's content
264
					my $newsearchcookie = $in->{'query'}->cookie(
260
					my $newsearchcookie = $in->{'query'}->cookie(
Lines 549-563 sub _version_check ($$) { Link Here
549
    # and so we must redirect to OPAC maintenance page or to the WebInstaller
545
    # and so we must redirect to OPAC maintenance page or to the WebInstaller
550
	# also, if OpacMaintenance is ON, OPAC should redirect to maintenance
546
	# also, if OpacMaintenance is ON, OPAC should redirect to maintenance
551
	if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') {
547
	if (C4::Context->preference('OpacMaintenance') && $type eq 'opac') {
552
		warn "OPAC Install required, redirecting to maintenance";
553
		print $query->redirect("/cgi-bin/koha/maintenance.pl");
554
	}
555
    unless ($version = C4::Context->preference('Version')) {    # assignment, not comparison
556
      if ($type ne 'opac') {
557
        warn "Install required, redirecting to Installer";
558
        print $query->redirect("/cgi-bin/koha/installer/install.pl");
559
      }
560
      else {
561
        warn "OPAC Install required, redirecting to maintenance";
548
        warn "OPAC Install required, redirecting to maintenance";
562
        print $query->redirect("/cgi-bin/koha/maintenance.pl");
549
        print $query->redirect("/cgi-bin/koha/maintenance.pl");
563
      }
550
      }
Lines 616-621 sub checkauth { Link Here
616
    my ( $userid, $cookie, $sessionID, $flags, $barshelves, $pubshelves );
603
    my ( $userid, $cookie, $sessionID, $flags, $barshelves, $pubshelves );
617
    my $logout = $query->param('logout.x');
604
    my $logout = $query->param('logout.x');
618
605
606
    # This parameter is the name of the CAS server we want to authenticate against,
607
    # when using authentication against multiple CAS servers, as configured in Auth_cas_servers.yaml
608
    my $casparam = $query->param('cas');
609
619
    if ( $userid = $ENV{'REMOTE_USER'} ) {
610
    if ( $userid = $ENV{'REMOTE_USER'} ) {
620
        # Using Basic Authentication, no cookies required
611
        # Using Basic Authentication, no cookies required
621
        $cookie = $query->cookie(
612
        $cookie = $query->cookie(
Lines 954-964 sub checkauth { Link Here
954
945
955
    if ($cas) { 
946
    if ($cas) { 
956
	$template->param(
947
	$template->param(
957
	    casServerUrl    => login_cas_url(),
948
        casServerUrl    => login_cas_url($query),
958
	    invalidCasLogin => $info{'invalidCasLogin'}
949
	    invalidCasLogin => $info{'invalidCasLogin'}
959
	);
950
	);
960
    }
951
   }
961
962
    my $self_url = $query->url( -absolute => 1 );
952
    my $self_url = $query->url( -absolute => 1 );
963
    $template->param(
953
    $template->param(
964
        url         => $self_url,
954
        url         => $self_url,
Lines 1046-1052 sub check_api_auth { Link Here
1046
    unless ($query->param('userid')) {
1036
    unless ($query->param('userid')) {
1047
        $sessionID = $query->cookie("CGISESSID");
1037
        $sessionID = $query->cookie("CGISESSID");
1048
    }
1038
    }
1049
    if ($sessionID) {
1039
    if ($sessionID && not $cas) {
1050
        my $session = get_session($sessionID);
1040
        my $session = get_session($sessionID);
1051
        C4::Context->_new_userenv($sessionID);
1041
        C4::Context->_new_userenv($sessionID);
1052
        if ($session) {
1042
        if ($session) {
Lines 1096-1113 sub check_api_auth { Link Here
1096
        # new login
1086
        # new login
1097
        my $userid = $query->param('userid');
1087
        my $userid = $query->param('userid');
1098
        my $password = $query->param('password');
1088
        my $password = $query->param('password');
1099
        unless ($userid and $password) {
1089
       	my ($return, $cardnumber);
1100
            # caller did something wrong, fail the authenticateion
1090
1101
            return ("failed", undef, undef);
1091
	# Proxy CAS auth
1102
        }
1092
	if ($cas && $query->param('PT')) {
1103
	my ($return, $cardnumber);
1104
	if ($cas && $query->param('ticket')) {
1105
	    my $retuserid;
1093
	    my $retuserid;
1106
	    ( $return, $cardnumber, $retuserid ) = checkpw( $dbh, $userid, $password, $query );
1094
	    $debug and print STDERR "## check_api_auth - checking CAS\n";
1107
	    $userid = $retuserid;
1095
	    # In case of a CAS authentication, we use the ticket instead of the password
1096
	    my $PT = $query->param('PT');
1097
	    ($return,$cardnumber,$userid) = check_api_auth_cas($dbh, $PT, $query);    # EXTERNAL AUTH
1108
	} else {
1098
	} else {
1099
	    # User / password auth
1100
	    unless ($userid and $password) {
1101
		# caller did something wrong, fail the authenticateion
1102
		return ("failed", undef, undef);
1103
	    }
1109
	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
1104
	    ( $return, $cardnumber ) = checkpw( $dbh, $userid, $password, $query );
1110
	}
1105
	}
1106
1111
        if ($return and haspermission(  $userid, $flagsrequired)) {
1107
        if ($return and haspermission(  $userid, $flagsrequired)) {
1112
            my $session = get_session("");
1108
            my $session = get_session("");
1113
            return ("failed", undef, undef) unless $session;
1109
            return ("failed", undef, undef) unless $session;
Lines 1361-1367 sub checkpw { Link Here
1361
        ($retval) and return ($retval,$retcard);
1357
        ($retval) and return ($retval,$retcard);
1362
    }
1358
    }
1363
1359
1364
    if ($cas && $query->param('ticket')) {
1360
    if ($cas && $query && $query->param('ticket')) {
1365
        $debug and print STDERR "## checkpw - checking CAS\n";
1361
        $debug and print STDERR "## checkpw - checking CAS\n";
1366
	# In case of a CAS authentication, we use the ticket instead of the password
1362
	# In case of a CAS authentication, we use the ticket instead of the password
1367
	my $ticket = $query->param('ticket');
1363
	my $ticket = $query->param('ticket');
(-)a/C4/Auth_cas_servers.yaml.orig (+12 lines)
Line 0 Link Here
1
# This file is used for authenticating against multiple CAS servers
2
# If the file Auth_cas_servers.yaml exists, then the casServerUrl syspref will be ignored
3
4
# If you have to authenticate against only one CAS server, which is usually the case,
5
# don't use this file, but the casServerUrl syspref instead
6
7
default: ServerName
8
---
9
  ServerName: "https://example.com/cas"
10
  OtherServerName: "https://example.org/cas"
11
  ThirdServerName: "https://example.edu/cas"
12
(-)a/C4/Auth_with_cas.pm (-44 / +130 lines)
Lines 25-30 use C4::Context; Link Here
25
use C4::Utils qw( :all );
25
use C4::Utils qw( :all );
26
use Authen::CAS::Client;
26
use Authen::CAS::Client;
27
use CGI;
27
use CGI;
28
use FindBin;
28
29
29
30
30
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
31
use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
Lines 34-64 BEGIN { Link Here
34
	$VERSION = 3.03;	# set the version for version checking
35
	$VERSION = 3.03;	# set the version for version checking
35
	$debug = $ENV{DEBUG};
36
	$debug = $ENV{DEBUG};
36
	@ISA    = qw(Exporter);
37
	@ISA    = qw(Exporter);
37
	@EXPORT = qw(checkpw_cas login_cas logout_cas login_cas_url);
38
	@EXPORT = qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
39
}
40
my $context = C4::Context->new() or die 'C4::Context->new failed';
41
my $defaultcasserver;
42
my $casservers;
43
44
45
# If there's a configuration for multiple cas servers, then we get it
46
if (-e qq($FindBin::Bin/../C4/Auth_cas_servers.yaml)) {
47
    ($defaultcasserver, $casservers) = YAML::LoadFile(qq($FindBin::Bin/../C4/Auth_cas_servers.yaml));
48
    $defaultcasserver = $defaultcasserver->{'default'};
49
} else {
50
# Else, we fall back to casServerUrl syspref
51
    $defaultcasserver = 'default';
52
    $casservers = { 'default' => C4::Context->preference('casServerUrl') };
38
}
53
}
39
40
41
my $context = C4::Context->new() 	or die 'C4::Context->new failed';
42
my $casserver = C4::Context->preference('casServerUrl');
43
54
44
# Logout from CAS
55
# Logout from CAS
45
sub logout_cas {
56
sub logout_cas {
46
    my ($query) = @_;
57
    my ($query) = @_;
47
    my $cas = Authen::CAS::Client->new($casserver);
58
    my $uri = $ENV{'SCRIPT_URI'};
48
    print $query->redirect($cas->logout_url(url => $ENV{'SCRIPT_URI'}));
59
    my $casparam = $query->param('cas');
60
    # FIXME: This should be more generic and handle whatever parameters there might be
61
    $uri .= "?cas=" . $casparam if (defined $casparam);
62
    $casparam = $defaultcasserver if (not defined $casparam);
63
    my $cas = Authen::CAS::Client->new($casservers->{$casparam});
64
    print $query->redirect( $cas->logout_url($uri));
49
}
65
}
50
66
51
# Login to CAS
67
# Login to CAS
52
sub login_cas {
68
sub login_cas {
53
    my ($query) = @_;
69
    my ($query) = @_;
54
    my $cas = Authen::CAS::Client->new($casserver);
70
    my $uri = $ENV{'SCRIPT_URI'};
55
    print $query->redirect($cas->login_url($ENV{'SCRIPT_URI'})); 
71
    my $casparam = $query->param('cas');
72
    # FIXME: This should be more generic and handle whatever parameters there might be
73
    $uri .= "?cas=" . $casparam if (defined $casparam);
74
    warn $defaultcasserver;
75
    $casparam = $defaultcasserver if (not defined $casparam);
76
    my $cas = Authen::CAS::Client->new($casservers->{$casparam});
77
    print $query->redirect( $cas->login_url($uri));
56
}
78
}
57
79
58
# Returns CAS login URL with callback to the requesting URL
80
# Returns CAS login URL with callback to the requesting URL
59
sub login_cas_url {
81
sub login_cas_url {
60
    my $cas = Authen::CAS::Client->new($casserver);
82
    my ($query) = @_;
61
    return $cas->login_url($ENV{'SCRIPT_URI'});
83
    my $uri = $ENV{'SCRIPT_URI'};
84
    my $casparam = $query->param('cas');
85
    # FIXME: This should be more generic and handle whatever parameters there might be
86
    $uri .= "?cas=" . $casparam if (defined $casparam);
87
    $casparam = $defaultcasserver if (not defined $casparam);
88
    warn $defaultcasserver;
89
    my $cas = Authen::CAS::Client->new($casservers->{$casparam});
90
    return $cas->login_url($uri);
62
}
91
}
63
92
64
# Checks for password correctness
93
# Checks for password correctness
Lines 67-112 sub checkpw_cas { Link Here
67
    $debug and warn "checkpw_cas";
96
    $debug and warn "checkpw_cas";
68
    my ($dbh, $ticket, $query) = @_;
97
    my ($dbh, $ticket, $query) = @_;
69
    my $retnumber;
98
    my $retnumber;
70
    my $cas = Authen::CAS::Client->new($casserver);
99
    my $uri = $ENV{'SCRIPT_URI'};
100
    my $casparam = $query->param('cas');
101
    # FIXME: This should be more generic and handle whatever parameters there might be
102
    $uri .= "?cas=" . $casparam if (defined $casparam);
103
    $casparam = $defaultcasserver if (not defined $casparam);
104
    my $cas = Authen::CAS::Client->new($casservers->{$casparam});
71
105
72
    # If we got a ticket
106
    # If we got a ticket
73
    if ($ticket) {
107
    if ($ticket) {
74
	$debug and warn "Got ticket : $ticket";
108
        $debug and warn "Got ticket : $ticket";
75
	
109
76
	# We try to validate it
110
        # We try to validate it
77
	my $val = $cas->service_validate($ENV{'SCRIPT_URI'}, $ticket);
111
        my $val = $cas->service_validate($uri, $ticket );
78
	
112
79
	# If it's valid
113
        # If it's valid
80
	if( $val->is_success() ) {
114
        if ( $val->is_success() ) {
81
115
82
	    my $userid = $val->user();
116
            my $userid = $val->user();
83
	    $debug and warn "User CAS authenticated as: $userid";
117
            $debug and warn "User CAS authenticated as: $userid";
84
118
85
	    # Does it match one of our users ?
119
            # Does it match one of our users ?
86
    	    my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
120
            my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
87
    	    $sth->execute($userid);
121
            $sth->execute($userid);
88
    	    if ( $sth->rows ) {
122
            if ( $sth->rows ) {
89
		$retnumber = $sth->fetchrow;
123
                $retnumber = $sth->fetchrow;
90
		return (1, $retnumber, $userid);
124
                return ( 1, $retnumber, $userid );
91
	    }
125
            }
92
	    $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
126
            $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
93
	    $sth->execute($userid);
127
            $sth->execute($userid);
94
	    if ( $sth->rows ) {
128
            if ( $sth->rows ) {
95
	    	$retnumber = $sth->fetchrow;
129
                $retnumber = $sth->fetchrow;
96
		return (1, $retnumber, $userid);
130
                return ( 1, $retnumber, $userid );
97
	    }
131
            }
98
	    
132
99
	    # If we reach this point, then the user is a valid CAS user, but not a Koha user
133
            # If we reach this point, then the user is a valid CAS user, but not a Koha user
100
	    $debug and warn "User $userid is not a valid Koha user";
134
            $debug and warn "User $userid is not a valid Koha user";
101
135
102
    	} else {
136
        } else {
103
    	    $debug and warn "Invalid session ticket : $ticket";
137
            $debug and warn "Invalid session ticket : $ticket";
104
    	    return 0;
138
            return 0;
105
	}
139
        }
140
    }
141
    return 0;
142
}
143
144
# Proxy CAS auth
145
sub check_api_auth_cas {
146
    $debug and warn "check_api_auth_cas";
147
    my ($dbh, $PT, $query) = @_;
148
    my $retnumber;
149
    my $url = $query->url();
150
151
    my $casparam = $query->param('cas');
152
    $casparam = $defaultcasserver if (not defined $casparam);
153
    my $cas = Authen::CAS::Client->new($casservers->{$casparam});
154
155
    # If we have a Proxy Ticket
156
    if ($PT) {
157
        my $r = $cas->proxy_validate( $url, $PT );
158
159
        # If the PT is valid
160
        if ( $r->is_success ) {
161
162
            # We've got a username !
163
            $debug and warn "User authenticated as: ", $r->user, "\n";
164
            $debug and warn "Proxied through:\n";
165
            $debug and warn "  $_\n" for $r->proxies;
166
167
            my $userid = $r->user;
168
169
            # Does it match one of our users ?
170
            my $sth = $dbh->prepare("select cardnumber from borrowers where userid=?");
171
            $sth->execute($userid);
172
            if ( $sth->rows ) {
173
                $retnumber = $sth->fetchrow;
174
                return ( 1, $retnumber, $userid );
175
            }
176
            $sth = $dbh->prepare("select userid from borrowers where cardnumber=?");
177
            return $r->user;
178
            $sth->execute($userid);
179
            if ( $sth->rows ) {
180
                $retnumber = $sth->fetchrow;
181
                return ( 1, $retnumber, $userid );
182
            }
183
184
            # If we reach this point, then the user is a valid CAS user, but not a Koha user
185
            $debug and warn "User $userid is not a valid Koha user";
186
187
        } else {
188
            $debug and warn "Proxy Ticket authentication failed";
189
            return 0;
190
        }
106
    }
191
    }
107
    return 0;
192
    return 0;
108
}
193
}
109
194
195
110
1;
196
1;
111
__END__
197
__END__
112
198
(-)a/docs/CAS/CAS/README (+8 lines)
Line 0 Link Here
1
CAS authentication is available through CasAuthentication and casServerUrl sysprefs.
2
3
However, if you plan to use multi-CAS (ie: authentication against multiple CAS server,
4
you'll have to use C4/Auth_cas_servers.yaml.
5
6
Anyway, please keep in mind that if you want to authenticate through https against the
7
CAS serveur, you have to install Crypt::SSLeay package, or the authentication will 
8
silently fail.
(-)a/docs/CAS/CASProxy/README (+9 lines)
Line 0 Link Here
1
As CAS Proxying is not an obvious authentication to set up, here are
2
some documented examples showing how a foreign application can query
3
koha webservices, being CAS authenticated.
4
5
The starting point is proxy_cas.pl
6
7
To find more about how CAS Proxy works :
8
http://afs.berkeley.edu/~lr/presentations/cas-auth/
9
http://www.ja-sig.org/wiki/display/CAS/Proxy+CAS+Walkthrough
(-)a/docs/CAS/CASProxy/examples/koha_webservice.pl (+58 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# Here is an exemple of a simple phony webservice, returning "Hello World" if the user is authenticated
23
# The purpose is to show how CAS Proxy can work with koha
24
# In this configuration, this page acts as a CAS Client, instead of the user's browser.
25
# This page is meant to be called from a foreign application
26
27
=head1 CGI PARAMETERS
28
29
=item PT
30
The Proxy Ticket, needed for check_api_auth, that will try to make the CAS Server validate it.
31
32
=cut 
33
34
use utf8;
35
use strict;
36
use warnings;
37
binmode(STDOUT, ":utf8");
38
39
use C4::Auth qw(check_api_auth);
40
use C4::Output;
41
use C4::Context;
42
use CGI;
43
44
my $cgi = new CGI;
45
46
print CGI::header('-type'=>'text/plain', '-charset'=>'utf-8');
47
48
# The authentication : if $cgi contains a PT parameter, and CAS is enabled (casAuthentication syspref),
49
# a CAS Proxy authentication will take place
50
my ( $status, $cookie_, $sessionID ) = check_api_auth( $cgi, {circulate => 'override_renewals'});
51
52
if ($status ne 'ok') {
53
    print "Authentication failed : $status";
54
} else {
55
    print "Hello World!";
56
}
57
exit 0;
58
(-)a/docs/CAS/CASProxy/examples/proxy_cas.pl (+91 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# Here is an exemple of a CAS Proxy
23
# The proxy is a foreign application that will authenticate the user against CAS
24
# Once authenticated as a proxy, the foreign application will be able to call some
25
# Koha webservices, proving authentication only by giving a proxy ticket
26
27
# Note: please keep in mind that all url's must be https and their certificates must be trusted
28
29
=cut
30
31
use strict;
32
use warnings;
33
use CGI;
34
use Authen::CAS::Client;
35
36
# URL Of the CAS Server
37
my $casServerUrl = 'https://localhost:8443/cas/';
38
my $cas = Authen::CAS::Client->new($casServerUrl);
39
my $cgi = new CGI;
40
41
# URL of the service we're requesting a Service Ticket for (typically this very same page)
42
my $proxy_service = $cgi->url;
43
44
45
# Callback URL (this is an URL the CAS Server will query, providing the Proxy Ticket we'll need 
46
# to query the koha webservice). It can be this page or another. In this example, another page will be 
47
# called back
48
my $pgtUrl = "https://.../proxy_cas_callback.pl";
49
50
print $cgi->header({-type  =>  'text/html'});
51
print $cgi->start_html("proxy cas");
52
53
# If we already have a service ticket
54
if ($cgi->param('ticket')) {
55
56
    print "Got a ticket :" . $cgi->param('ticket') . "<br>\n";
57
  
58
    # We validate it against the CAS Server, providing the callback URL
59
    my $r = $cas->service_validate( $proxy_service, $cgi->param('ticket'), pgtUrl => $pgtUrl);
60
61
    # If it is sucessful, we are authenticated
62
    if( $r->is_success() ) {
63
	print "User authenticated as: ", $r->user(), "<br>\n";
64
    } else {
65
	print "User authentication failed<br />\n";
66
    }
67
68
    # If we have a PGTIou ticket, the proxy validation was sucessful 
69
    if (defined $r->iou) {
70
      print "Proxy granting ticket IOU: ", $r->iou, "<br />\n";
71
      my $pgtIou = $r->iou;
72
73
      print '<a href="proxy_cas_data.pl?PGTIOU=', $r->iou, '">Next</a>';
74
75
      
76
     	    
77
    } else {
78
      print "Service validation for proxying failed\n";
79
   }
80
81
# If we don't have a Service Ticket, we ask for one (ie : the user will be redirected to the CAS Server for authentication)
82
} else {
83
84
    my $url = $cas->login_url($proxy_service);
85
    print "<a href=\"$url\">Please log in</a>";
86
}
87
88
print $cgi->end_html;
89
90
91
(-)a/docs/CAS/CASProxy/examples/proxy_cas_callback.pl (+62 lines)
Line 0 Link Here
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# Here is an exemple of a callback page for a CAS Proxy
23
# This is the page the CAS server will call back with a Proxy Ticket, allowing us (the foreign application)
24
# to query koha webservices, being CAS authenticated 
25
26
=cut
27
28
use strict;
29
use warnings;
30
use CGI;
31
use Authen::CAS::Client;
32
use Storable qw(nstore_fd);
33
34
my $casServerUrl = 'https://localhost:8443/cas/';
35
my $cas = Authen::CAS::Client->new($casServerUrl);
36
37
my $cgi = new CGI;
38
39
my $proxy_service = $cgi->url;
40
41
print $cgi->header({-type  =>  'text/html'});
42
print $cgi->start_html("proxy cas callback");
43
44
# If we have a pgtId, it means the cas server called us back
45
if ($cgi->param('pgtId')) {
46
    warn "Got a pgtId :" . $cgi->param('pgtId');
47
    warn "Got a pgtIou :" . $cgi->param('pgtIou');
48
    my $pgtIou =  $cgi->param('pgtIou');
49
    my $pgtId =  $cgi->param('pgtId');
50
51
    # Now we store the pgtIou and the pgtId in the application vars (in our case a storable object in a file), 
52
    # so that the page requesting the webservice can retrieve the pgtId matching it's PgtIou 
53
    open FILE, ">", "casSession.tmp" or die "Unable to open file";
54
    nstore_fd({$pgtIou => $pgtId}, \*FILE);
55
    close FILE;
56
57
} else {
58
    warn "Failed to get a Proxy Ticket\n";
59
}
60
61
print $cgi->end_html;
62
(-)a/docs/CAS/CASProxy/examples/proxy_cas_data.pl (-1 / +80 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# Copyright 2009 SARL BibLibre
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it under the
8
# terms of the GNU General Public License as published by the Free Software
9
# Foundation; either version 2 of the License, or (at your option) any later
10
# version.
11
#
12
# Koha is distributed in the hope that it will be useful, but WITHOUT ANY
13
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
14
# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
15
#
16
# You should have received a copy of the GNU General Public License along with
17
# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place,
18
# Suite 330, Boston, MA  02111-1307 USA
19
20
=head1 DESCRIPTION
21
22
# This page will display the result of the call to the koha webservice
23
24
=head1 CGI PARAMETERS
25
26
=item PGTIOU
27
28
The Proxy Granting Ticket IOU the CAS Server returned to us when we gave him the Service Ticket
29
This PGTIOU will allow us to retrive the matching PGTID
30
31
=cut 
32
33
use strict;
34
use warnings;
35
use CGI;
36
use Authen::CAS::Client;
37
use Storable qw(fd_retrieve);
38
use LWP::Simple;
39
use URI::Escape;
40
41
my $casServerUrl = 'https://localhost:8443/cas/';
42
my $cas = Authen::CAS::Client->new($casServerUrl);
43
44
# URL of the service we'd like to be proxy for (typically the Koha webservice we want to query)
45
my $target_service = "https://.../koha_webservice.pl";
46
47
my $cgi = new CGI;
48
49
print $cgi->header({-type  =>  'text/html'});
50
print $cgi->start_html("proxy cas");
51
52
53
if ($cgi->param('PGTIOU')) {
54
55
      # At this point, we must retrieve the PgtId by matching the PgtIou we
56
      # just received and the PgtIou given by the CAS Server to the callback URL
57
      # The callback page stored it in the application vars (in our case a storable object in a file)
58
      open FILE, "casSession.tmp" or die "Unable to open file";
59
      my $hashref = fd_retrieve(\*FILE);
60
      my $pgtId = %$hashref->{$cgi->param('PGTIOU')};
61
      close FILE;
62
63
      # Now that we have a PgtId, we can ask the cas server for a proxy ticket...
64
      my $rp = $cas->proxy( $pgtId, $target_service );
65
      if( $rp->is_success ) {
66
        print "Proxy Ticket issued: ", $rp->proxy_ticket, "<br />\n";
67
68
	# ...which we will provide to the target service (the koha webservice) for authentication !
69
	my $data = get($target_service . "?PT=" . $rp->proxy_ticket);
70
	
71
	# And finally, we can display the data gathered from the koha webservice !
72
	print "This is the output of the koha webservice we just queried, CAS authenticated : <br/>";
73
	print "<code>$data</code>";
74
75
      } else {
76
	print "Cannot get Proxy Ticket";
77
      }
78
79
80
}

Return to bug 5630