From 170b75e93e6999ed43025d11e8fa599e14e67e37 Mon Sep 17 00:00:00 2001
From: PTFS Admin <hosting@ptfs-europe.com>
Date: Wed, 26 Apr 2017 12:39:15 +0100
Subject: [PATCH] BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
---
 C4/Auth.pm                                                         | 7 +++++++
 installer/data/mysql/atomicupdate/shibOnly.perl                    | 6 ++++++
 .../intranet-tmpl/prog/en/modules/admin/preferences/opac.pref      | 7 +++++++
 .../prog/en/modules/admin/preferences/staff_client.pref            | 7 +++++++
 4 files changed, 27 insertions(+)
 create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 40b273a..cfc435b 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1297,6 +1297,13 @@ sub checkauth {
     }
 
     if ($shib) {
+        #If shibOnly is enabled just go ahead and redirect directly
+        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
+            my $redirect_url = login_shib_url( $query );
+            print $query->redirect($redirect_url);
+            safe_exit;
+        }
+        
         $template->param(
             shibbolethAuthentication => $shib,
             shibbolethLoginUrl       => login_shib_url($query),
diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl
new file mode 100644
index 0000000..9b67d0f
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/shibOnly.perl
@@ -0,0 +1,6 @@
+$DBversion = 'XXX';  # will be replaced by the RM
+if( CheckVersion( $DBversion ) ) {
+    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
+    SetVersion( $DBversion );
+    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
+}
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
index b6954ef..7194705 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
@@ -823,3 +823,10 @@ OPAC:
             - "The patron should see the charge description as "
             - pref: PayPalChargeDescription
               class: long
+    Authentication:
+        -
+            - pref: opacShibOnly
+              choices:
+                  yes: "Don't allow"
+                  no: Allow
+            - patrons to login by means other than shibboleth.
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
index e7da2e8..52654e2 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
@@ -155,3 +155,10 @@ Staff Client:
                   yes: Show
                   no: "Don't show"
             - a search field pulldown for 'Search the catalog' boxes.
+    Authentication:
+        -
+            - pref: staffShibOnly
+              choices:
+                  yes: "Don't allow"
+                  no: Allow
+            - staff to login by means other than shibboleth.
-- 
2.1.4