@@ -, +, @@ 0) Back up your database 1) Apply this patch 2) In your mysql client use your Koha database and execute: > DELETE FROM systempreferences; > SOURCE ~/kohaclone/installer/data/mysql/sysprefs.sql; -- Should be no errors. > SELECT * FROM systempreferences LIKE 'GoogleOAuth%'; -- Should see 4 entries. > QUIT; 3) Restore your database 4) Run ./installer/data/mysql/updatedatabase.pl; 5) In your mysql client use your Koha database and execute: > SELECT * FROM systempreferences LIKE 'GoogleOAuth%'; -- Should see the same 4 entries. 6) Log into the staff client 7) Home -> Koha administration -> Global system preferences 8) -> Administration -- There should be a 'Google OAuth2' section with the ability to set those 4 system preferences. 9) In a new tab, go to https://console.developers.google.com/project library name (e.g. South Pole Library). (e.g. South Pole Library Authentication) (http://library.yourDNS.org) googleoauth2 script (http://library.yourDNS.org/cgi-bin/koha/svc/googleoauth2) system preference. system preference. -- You should get a confirmation request, if you are already logged in, OR a login screen if you are not. -- You need to have the primary email address set to one authenticated by Google in order to log in. --- C4/Auth.pm | 11 +- installer/data/mysql/sysprefs.sql | 4 + installer/data/mysql/updatedatabase.pl | 16 ++ .../prog/en/modules/admin/preferences/admin.pref | 18 +++ .../opac-tmpl/bootstrap/en/includes/masthead.inc | 4 + .../opac-tmpl/bootstrap/en/modules/opac-auth.tt | 9 ++ opac/svc/googleoauth2 | 161 +++++++++++++++++++++ 7 files changed, 222 insertions(+), 1 deletion(-) create mode 100755 opac/svc/googleoauth2 --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -37,7 +37,7 @@ use List::MoreUtils qw/ any /; use Encode qw( encode is_utf8); # use utf8; -use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $ldap $cas $caslogout $shib $shib_login); +use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug $googleoauth2 $ldap $cas $caslogout $shib $shib_login); BEGIN { sub psgi_env { any { /^psgi\./ } keys %ENV } @@ -55,6 +55,7 @@ BEGIN { &get_all_subpermissions &get_user_subpermissions ); %EXPORT_TAGS = ( EditPermissions => [qw(get_all_subpermissions get_user_subpermissions)] ); + $googleoauth2 = C4::Context->preference('GoogleOAuth2'); $ldap = C4::Context->config('useldapserver') || 0; $cas = C4::Context->preference('casAuthentication'); $shib = C4::Context->config('useshibboleth') || 0; @@ -465,6 +466,7 @@ sub get_template_and_user { BranchesLoop => GetBranchesLoop($opac_name), BranchCategoriesLoop => GetBranchCategories( 'searchdomain', 1, $opac_name ), CalendarFirstDayOfWeek => ( C4::Context->preference("CalendarFirstDayOfWeek") eq "Sunday" ) ? 0 : 1, + GoogleOAuth2 => (C4::Context->preference("GoogleOAuth2")), LibraryName => "" . C4::Context->preference("LibraryName"), LibraryNameTitle => "" . $LibraryNameTitle, LoginBranchname => C4::Context->userenv ? C4::Context->userenv->{"branchname"} : "", @@ -1240,6 +1242,13 @@ sub checkauth { ); } + if ($googleoauth2) { + if ($query->param("OAuth2Failed")) { + my $reason = $query->param('OAuth2Failed'); + $template->param(invalidOAuth2Login => $reason); + } + } + my $self_url = $query->url( -absolute => 1 ); $template->param( url => $self_url, --- a/installer/data/mysql/sysprefs.sql +++ a/installer/data/mysql/sysprefs.sql @@ -134,6 +134,10 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('gist','0','','Default Goods and Services tax rate NOT in %, but in numeric form (0.12 for 12%), set to 0 to disable GST','Integer'), ('GoogleIndicTransliteration','0','','GoogleIndicTransliteration on the OPAC.','YesNo'), ('GoogleJackets','0',NULL,'if ON, displays jacket covers from Google Books API','YesNo'), +('GoogleOAuth2', '0', NULL, 'if ON, allows the use of Google OAuth2 for login', 'YesNo'), +('GoogleOAuth2ClientID', '', NULL, 'Client ID for the web app registered with google', 'Free'), +('GoogleOAuth2ClientSecret', '', NULL, 'Client Secret for the web app registered with google', 'Free'), +('GoogleOAuth2Domain', '', NULL, 'Restrict OAuth2 to this domain (or subdomains of this domain). Leave blank for all google domains', 'Free'), ('hidelostitems','0','','If ON, disables display of\"lost\" items in OPAC.','YesNo'), ('HidePatronName','0','','If this is switched on, patron\'s cardnumber will be shown instead of their name on the holds and catalog screens','YesNo'), ('hide_marc','0',NULL,'If ON, disables display of MARC fields, subfield codes & indicators (still shows data)','YesNo'), --- a/installer/data/mysql/updatedatabase.pl +++ a/installer/data/mysql/updatedatabase.pl @@ -9793,6 +9793,22 @@ if(CheckVersion($DBversion)) { SetVersion($DBversion); } +$DBversion = "XXX"; +if(CheckVersion($DBversion)) { + $dbh->do(q{ + INSERT INTO systempreferences + (variable,value,explanation,options,type) + VALUES + ('GoogleOAuth2', '0', NULL, 'if ON, allows the use of Google OAuth2 for login', 'YesNo'), + ('GoogleOAuth2ClientID', '', NULL, 'Client ID for the web app registered with google', 'Free'), + ('GoogleOAuth2ClientSecret', '', NULL, 'Client Secret for the web app registered with google', 'Free'), + ('GoogleOAuth2Domain', '', NULL, 'Restrict OAuth2 to this domain (or subdomains of this domain). Leave blank for all google domains', 'Free') + }); + + print "Upgrade to $DBversion done (Bug 10988: Allow login via Google OAuth2)\n"; + SetVersion($DBversion); +} + =head1 FUNCTIONS =head2 TableExists($table) --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -114,6 +114,24 @@ Administration: Common Name: the Common Name emailAddress: the emailAddress - field for SSL client certificate authentication + Google OAuth2: + - + - pref: GoogleOAuth2 + choices: + yes: Use + no: "Don't Use" + - Google OAuth2 login. + - You will need to select OAuth2 when creating an app in the google cloud console, and set the web origin to your_opac_url and the redirect url to your_opac_url/cgi-bin/koha/svc/oauthlogin . + - + - Google OAuth2 Client ID + - pref: GoogleOAuth2ClientID + - + - Google OAuth2 Client Secret + - pref: GoogleOAuth2ClientSecret + - + - Google OAuth2 Restrict to domain (or subdomain of this domain) + - pref: GoogleOAuth2Domain + - . Leave blank for all google domains Mozilla Persona: - - pref: Persona --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -58,6 +58,8 @@
Sorry, your automatic login failed. [% invalidOAuth2Login %]
+Please note that automatic login will only work if you are using the emal address registered with this library.
+If you want to, you can try to login using a different account +
If you can't login automatically, you can still login manually:
+ [% END %] +