From dd5384580d00f54046e23726e9567329a8ff71f4 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Thu, 27 Sep 2018 16:00:42 +0100
Subject: [PATCH] Bug 18506: (followup) Make this play nicely with opacPublic

---
 C4/Auth.pm                                      | 17 +++++++++++++++++
 .../bootstrap/en/includes/masthead.inc          |  4 ++++
 2 files changed, 21 insertions(+)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index d22ca0e729..e3c797a431 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1064,6 +1064,23 @@ sub checkauth {
                 }
             }
 
+            # If shib configured and shibOnly enabled, we should ignore anything other than a shibboleth type login.
+            if (
+                   $shib
+                && !$shibSuccess
+                && (
+                    (
+                        ( $type eq 'opac' )
+                        && C4::Context->preference('opacShibOnly')
+                    )
+                    || ( ( $type ne 'opac' )
+                        && C4::Context->preference('staffShibOnly') )
+                )
+              )
+            {
+                $return = 0;
+            }
+
             # $return: 1 = valid user
             if ($return) {
 
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
index 6de2d19e5c..5a986083ef 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/masthead.inc
@@ -75,6 +75,8 @@
                                         [% IF Koha.Preference('casAuthentication') %]
                                             [%# CAS authentication is too complicated for modal window %]
                                             <li role="presentation"><a href="/cgi-bin/koha/opac-user.pl" tabindex="-1" class="menu-inactive" role="menuitem">Log in to create your own lists</a></li>
+                                        [% ELSIF shibbolethAuthentication && Koha.Preference('opacShibOnly') %]
+                                            <li role="presentation"><a href="/cgi-bin/koha/opac-user.pl" tabindex="-1" class="menu-inactive" role="menuitem">Log in to create your own lists</a></li>
                                         [% ELSE %]
                                             <li role="presentation"><a href="/cgi-bin/koha/opac-user.pl" tabindex="-1" class="menu-inactive loginModal-trigger" role="menuitem">Log in to create your own lists</a></li>
                                         [% END %]
@@ -99,6 +101,8 @@
                                             <li><a class="login-link" href="/cgi-bin/koha/opac-user.pl">Log in to your account</a></li>
                                         [% ELSIF ( Koha.Preference('GoogleOpenIDConnect') == 1 ) %]
                                             <li><a class="login-link" href="/cgi-bin/koha/svc/auth/googleopenidconnect" role="button" data-toggle="modal">Log in to your account</a></li>
+                                        [% ELSIF shibbolethAuthentication && Koha.Preference('opacShibOnly') %]
+                                            <li><a class="login-link" href="/cgi-bin/koha/opac-user.pl">Log in to your account</a></li>
                                         [% ELSE %]
                                             <li><a href="/cgi-bin/koha/opac-user.pl" class="login-link loginModal-trigger" role="button" data-toggle="modal">Log in to your account</a></li>
                                         [% END %]
-- 
2.18.0