From 898c571c14d3f5900c557887ae0add07ab244602 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 31 Jul 2014 06:21:55 +0000
Subject: [PATCH] BUG 12027: Added shibboleth authentication to the staff
 client

- This patch adds shibboleth authentication to the staff client.
- Depending upon how your url structure works, you may or may not need a
  second native shibboleth service provider profile configured for this
  to work.

http://bugs.koha-community.org/show_bug.cgi?id=12026
---
 C4/Auth.pm                                      |  8 +++-----
 C4/Auth_with_shibboleth.pm                      | 23 ++++++++++++++++++-----
 koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt |  8 ++++++++
 3 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index ef0c585..b9ee019 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -804,9 +804,7 @@ sub checkauth {
             }
 
             # If we are in a shibboleth session (shibboleth is enabled, a shibboleth match attribute is set and matches koha matchpoint)
-            if ( $shib and $shib_login and $shibSuccess and $type eq 'opac' ) {
-
-                # (Note: $type eq 'opac' condition should be removed when shibboleth authentication for intranet will be implemented)
+            if ( $shib and $shib_login and $shibSuccess) {
                 logout_shib($query);
             }
         }
@@ -891,8 +889,8 @@ sub checkauth {
 
             my ( $return, $cardnumber );
 
-            # If shib is enabled and we have a shib login, does the login match a valid koha user
-            if ( $shib && $shib_login && $type eq 'opac' ) {
+	    # If shib is enabled and we have a shib login, does the login match a valid koha user
+            if ( $shib && $shib_login ) {
                 my $retuserid;
 
                 # Do not pass password here, else shib will not be checked in checkpw.
diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm
index 6c53c79..7dfe50b 100644
--- a/C4/Auth_with_shibboleth.pm
+++ b/C4/Auth_with_shibboleth.pm
@@ -47,6 +47,7 @@ sub shib_ok {
     return 0;
 }
 
+
 # Logout from Shibboleth
 sub logout_shib {
     my ($query) = @_;
@@ -112,21 +113,33 @@ sub checkpw_shib {
 sub _get_uri {
 
     my $protocol = "https://";
+    my $interface = C4::Context->interface;
+    $debug and warn "shibboleth interface: " . $interface;
+
+    my $return;
+    my $uri;
+    if ( $interface eq 'intranet' ) {
 
-    my $uri = C4::Context->preference('OPACBaseURL') // '';
-    if ($uri eq '') {
-        $debug and warn 'OPACBaseURL not set!';
+        $uri = C4::Context->preference('staffClientBaseURL') // '';
+        if ($uri eq '') {
+            $debug and warn 'staffClientBaseURL not set!';
+        }
+    } else {
+        $uri = C4::Context->preference('OPACBaseURL') // '';
+        if ($uri eq '') {
+            $debug and warn 'OPACBaseURL not set!';
+        }
     }
+
     if ($uri =~ /(.*):\/\/(.*)/) {
         my $oldprotocol = $1;
         if ($oldprotocol ne 'https') {
             $debug
                 and warn
-                  'Shibboleth requires OPACBaseURL to use the https protocol!';
+                  'Shibboleth requires OPACBaseURL/staffClientBaseURL to use the https protocol!';
         }
         $uri = $2;
     }
-
     my $return = $protocol . $uri;
     return $return;
 }
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
index b43143f..88c3c23 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt
@@ -39,6 +39,14 @@
 <div id="login_error"><strong>Error: </strong>Invalid username or password</div>
 [% END %]
 
+[% IF (shibbolethAuthentication) %]
+<!-- This is what is displayed if shib login has failed -->
+[% IF (invalidShibLogin ) %]
+<div id="login_error"><Strong>Error: </strong>Shibboleth login failed</div>
+[% END %]
+<p>If you have a shibboleth account, please <a href="[% shibbolethLoginUrl %]">click here</a> to login.</p>
+[% END %]
+
 <!-- login prompt time-->
 <form action="[% url %]" method="post" name="loginform" id="loginform">
     <input type="hidden" name="koha_login_context" value="intranet" />
-- 
2.1.4