@@ -, +, @@ Test Plan (remains the same): 0) Back up your database 1) Apply all these patches 2) In your mysql client use your Koha database and execute: > DELETE FROM systempreferences; > SOURCE ~/kohaclone/installer/data/mysql/sysprefs.sql; -- Should be no errors. > SELECT * FROM systempreferences LIKE 'GoogleO%'; -- Should see 4 entries. > QUIT; 3) Restore your database 4) Run ./installer/data/mysql/updatedatabase.pl; 5) In your mysql client use your Koha database and execute: > SELECT * FROM systempreferences LIKE 'GoogleO%'; -- Should see the same 4 entries. 6) Log into the staff client 7) Home -> Koha administration -> Global system preferences 8) -> OPAC -- make sure your OPACBaseURL is set (e.g. https://opac.koha.ca) 9) -> Administration -- There should be a 'Google OAuth2' section with the ability to set those 4 system preferences. 10) In a new tab, go to https://console.developers.google.com/project 11) Click 'Create Project' 12) Type in a project name that won't freak users out, like your library name (e.g. South Pole Library). 13) Click the 'Create' button. 14) Click the 'APIs & auth' in the left frame. 15) Click 'Credentials' 16) Click 'Create new Client ID' 17) Select 'Web application' and click 'Configure consent screen'. 18) Select the Email Address. 19) Put it a meaningful string into the Product Name (e.g. South Pole Library Authentication) 20) Fill in the other fields as desired (or not) 21) Click 'Save' 22) Change the 'AUTHORIZED JAVASCRIPT ORIGINS' to your OPACBaseURL. (http://library.yourDNS.org) 23) Change the 'AUTHORIZED REDIRECT URIS' to point to the new googleoauth2 script (http://library.yourDNS.org/cgi-bin/koha/svc/auth/googleopenidconnect) 24) Click 'Create Client ID' 25) Copy and paste the 'CLIENT ID' into the GoogleOAuth2ClientID system preference. 26) Copy and paste the 'CLIENT SECRET' into the GoogleOAuth2ClientSecret system preference. 27) Change the GoogleOpenIDConnect preference to 'Use'. 28) Click 'Save all Administration preferences' 29) In the OPAC, click 'Log in to your account'. -- You should get a confirmation request, if you are already logged in, OR a login screen if you are not. -- You need to have the primary email address set to one authenticated by Google in order to log in. 30) Run koha qa test tools --- C4/Auth.pm | 7 + .../mysql/atomicupdate/googleopenidconnect.sql | 5 + installer/data/mysql/sysprefs.sql | 4 + .../prog/en/modules/admin/preferences/admin.pref | 18 ++ .../opac-tmpl/bootstrap/en/includes/masthead.inc | 2 + .../opac-tmpl/bootstrap/en/modules/opac-auth.tt | 11 + opac/svc/auth/googleopenidconnect | 240 +++++++++++++++++++++ 7 files changed, 287 insertions(+) create mode 100644 installer/data/mysql/atomicupdate/googleopenidconnect.sql create mode 100755 opac/svc/auth/googleopenidconnect --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -1292,6 +1292,13 @@ sub checkauth { ); } + if (C4::Context->preference('GoogleOpenIDConnect')) { + if ($query->param("OpenIDConnectFailed")) { + my $reason = $query->param('OpenIDConnectFailed'); + $template->param(invalidGoogleOpenIDConnectLogin => $reason); + } + } + $template->param( LibraryName => C4::Context->preference("LibraryName"), ); --- a/installer/data/mysql/atomicupdate/googleopenidconnect.sql +++ a/installer/data/mysql/atomicupdate/googleopenidconnect.sql @@ -0,0 +1,5 @@ +INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES + ('GoogleOpenIDConnect', '0', NULL, 'if ON, allows the use of Google OpenID Connect for login', 'YesNo'), + ('GoogleOAuth2ClientID', '', NULL, 'Client ID for the web app registered with Google', 'Free'), + ('GoogleOAuth2ClientSecret', '', NULL, 'Client Secret for the web app registered with Google', 'Free'), + ('GoogleOpenIDConnectDomain', '', NULL, 'Restrict OpenID Connect to this domain (or subdomains of this domain). Leave blank for all Google domains', 'Free'); --- a/installer/data/mysql/sysprefs.sql +++ a/installer/data/mysql/sysprefs.sql @@ -155,6 +155,10 @@ INSERT INTO systempreferences ( `variable`, `value`, `options`, `explanation`, ` ('gist','0','','Default Goods and Services tax rate NOT in %, but in numeric form (0.12 for 12%), set to 0 to disable GST','Integer'), ('GoogleIndicTransliteration','0','','GoogleIndicTransliteration on the OPAC.','YesNo'), ('GoogleJackets','0',NULL,'if ON, displays jacket covers from Google Books API','YesNo'), +('GoogleOpenIDConnect', '0', NULL, 'if ON, allows the use of Google OpenID Connect for login', 'YesNo'), +('GoogleOAuth2ClientID', '', NULL, 'Client ID for the web app registered with Google', 'Free'), +('GoogleOAuth2ClientSecret', '', NULL, 'Client Secret for the web app registered with Google', 'Free'), +('GoogleOpenIDConnectDomain', '', NULL, 'Restrict Google OpenID Connect to this domain (or subdomains of this domain). Leave blank for all Google domains', 'Free'), ('hidelostitems','0','','If ON, disables display of\"lost\" items in OPAC.','YesNo'), ('HidePatronName','0','','If this is switched on, patron\'s cardnumber will be shown instead of their name on the holds and catalog screens','YesNo'), ('hide_marc','0',NULL,'If ON, disables display of MARC fields, subfield codes & indicators (still shows data)','YesNo'), --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref +++ a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/admin.pref @@ -143,6 +143,24 @@ Administration: Common Name: the Common Name emailAddress: the emailAddress - field for SSL client certificate authentication + Google OpenID Connect: + - + - pref: GoogleOpenIDConnect + choices: + yes: Use + no: "Don't Use" + - Google OpenID Connect login. + - You will need to select OAuth2 when creating an app in the google cloud console, and set the web origin to your_opac_url and the redirect url to your_opac_url/cgi-bin/koha/svc/auth/googleopenidconnect . + - + - Google OAuth2 Client ID + - pref: GoogleOAuth2ClientID + - + - Google OAuth2 Client Secret + - pref: GoogleOAuth2ClientSecret + - + - Google OpenID Connect Restrict to domain (or subdomain of this domain) + - pref: GoogleOpenIDConnectDomain + - . Leave blank for all google domains Mozilla Persona: - - pref: Persona --- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc +++ a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc @@ -90,6 +90,8 @@ [% IF Koha.Preference('casAuthentication') %] [%# CAS authentication is too complicated for modal window %]
Sorry, your Google login failed. [% invalidGoogleOpenIDConnectLogin %]
+Please note that the Google login will only work if you are using the e-mail address registered with this library.
+If you want to, you can try to log in using a different account + [% END %] + Log in with Google +
If you don not have a Google account, but do have a local account, you can still l +og in:
+ [% END %]