From 9eba6142771de089d5d64eae5930e59f5206eaf0 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 2 Mar 2017 16:40:11 +0000
Subject: [PATCH] Enable Shibboleth for Plack

https://bugs.koha-community.org/show_bug.cgi?id=17776
---
 C4/Auth.pm                 | 17 +++++++----------
 C4/Auth_with_shibboleth.pm | 21 ++++++++++++++++++---
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 5dcf1cd..c68bd73 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -74,16 +74,7 @@ BEGIN {
           qw(shib_ok checkpw_shib logout_shib login_shib_url get_login_shib);
 
         # Check for good config
-        if ( shib_ok() ) {
-
-            # Get shibboleth login attribute
-            $shib_login = get_login_shib();
-        }
-
-        # Bad config, disable shibboleth
-        else {
-            $shib = 0;
-        }
+        $shib = 0 unless shib_ok();
     }
     if ($cas) {
         import C4::Auth_with_cas qw(check_api_auth_cas checkpw_cas login_cas logout_cas login_cas_url);
@@ -159,6 +150,9 @@ sub get_template_and_user {
     my $in = shift;
     my ( $user, $cookie, $sessionID, $flags );
 
+    # Get shibboleth login attribute
+    $shib_login = get_login_shib() if $shib;
+
     C4::Context->interface( $in->{type} );
 
     my $safe_chars = 'a-zA-Z0-9_\-\/';
@@ -742,6 +736,9 @@ sub checkauth {
     my $query = shift;
     $debug and warn "Checking Auth";
 
+    # Get shibboleth login attribute
+    $shib_login = get_login_shib() if $shib;
+
     # $authnotrequired will be set for scripts which will run without authentication
     my $authnotrequired = shift;
     my $flagsrequired   = shift;
diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm
index cde0ede..3063941 100644
--- a/C4/Auth_with_shibboleth.pm
+++ b/C4/Auth_with_shibboleth.pm
@@ -25,6 +25,7 @@ use Koha::AuthUtils qw(get_script_name);
 use Koha::Database;
 use Carp;
 use CGI;
+use List::Util qw(any);
 
 use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug);
 
@@ -80,9 +81,14 @@ sub get_login_shib {
     my $config = _get_shib_config();
 
     my $matchAttribute = $config->{mapping}->{ $config->{matchpoint} }->{is};
-    $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute};
 
-    return $ENV{$matchAttribute} || '';
+    if ( any { /(^psgi|^plack)/i } keys %ENV ) {
+      $debug and warn $matchAttribute . " value: " . $ENV{"HTTP_".uc($matchAttribute)};
+      return $ENV{"HTTP_".uc($matchAttribute)} || '';
+    } else {
+      $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute};
+      return $ENV{$matchAttribute} || '';
+    }
 }
 
 # Checks for password correctness
@@ -217,11 +223,20 @@ Map their attributes to what you want to see in koha
 
 Tell apache that we wish to allow koha to authenticate via shibboleth.
 
-This is as simple as adding the below to your virtualhost config:
+This is as simple as adding the below to your virtualhost config (for CGI running):
+
+ <Location />
+   AuthType shibboleth
+   Require shibboleth
+ </Location>
+
+Or (for Plack running):
 
  <Location />
    AuthType shibboleth
    Require shibboleth
+   ShibUseEnvironment Off
+   ShibUseHeaders On
  </Location>
 
 =item 5.
-- 
2.1.4