From 9eba6142771de089d5d64eae5930e59f5206eaf0 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Thu, 2 Mar 2017 16:40:11 +0000 Subject: [PATCH] Enable Shibboleth for Plack https://bugs.koha-community.org/show_bug.cgi?id=17776 --- C4/Auth.pm | 17 +++++++---------- C4/Auth_with_shibboleth.pm | 21 ++++++++++++++++++--- 2 files changed, 25 insertions(+), 13 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 5dcf1cd..c68bd73 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -74,16 +74,7 @@ BEGIN { qw(shib_ok checkpw_shib logout_shib login_shib_url get_login_shib); # Check for good config - if ( shib_ok() ) { - - # Get shibboleth login attribute - $shib_login = get_login_shib(); - } - - # Bad config, disable shibboleth - else { - $shib = 0; - } + $shib = 0 unless shib_ok(); } if ($cas) { import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url); @@ -159,6 +150,9 @@ sub get_template_and_user { my $in = shift; my ( $user, $cookie, $sessionID, $flags ); + # Get shibboleth login attribute + $shib_login = get_login_shib() if $shib; + C4::Context->interface( $in->{type} ); my $safe_chars = 'a-zA-Z0-9_\-\/'; @@ -742,6 +736,9 @@ sub checkauth { my $query = shift; $debug and warn "Checking Auth"; + # Get shibboleth login attribute + $shib_login = get_login_shib() if $shib; + # $authnotrequired will be set for scripts which will run without authentication my $authnotrequired = shift; my $flagsrequired = shift; diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm index cde0ede..3063941 100644 --- a/C4/Auth_with_shibboleth.pm +++ b/C4/Auth_with_shibboleth.pm @@ -25,6 +25,7 @@ use Koha::AuthUtils qw(get_script_name); use Koha::Database; use Carp; use CGI; +use List::Util qw(any); use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug); @@ -80,9 +81,14 @@ sub get_login_shib { my $config = _get_shib_config(); my $matchAttribute = $config->{mapping}->{ $config->{matchpoint} }->{is}; - $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute}; - return $ENV{$matchAttribute} || ''; + if ( any { /(^psgi|^plack)/i } keys %ENV ) { + $debug and warn $matchAttribute . " value: " . $ENV{"HTTP_".uc($matchAttribute)}; + return $ENV{"HTTP_".uc($matchAttribute)} || ''; + } else { + $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute}; + return $ENV{$matchAttribute} || ''; + } } # Checks for password correctness @@ -217,11 +223,20 @@ Map their attributes to what you want to see in koha Tell apache that we wish to allow koha to authenticate via shibboleth. -This is as simple as adding the below to your virtualhost config: +This is as simple as adding the below to your virtualhost config (for CGI running): + + + AuthType shibboleth + Require shibboleth + + +Or (for Plack running): AuthType shibboleth Require shibboleth + ShibUseEnvironment Off + ShibUseHeaders On =item 5. -- 2.1.4