From 42995a6fe997ff014114543e47da06f7eb3ec9d6 Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Wed, 26 Apr 2017 12:39:15 +0100 Subject: [PATCH] Bug 18506: Add xShibOnly preference for Shibboleth authentication This patch adds two system preferences to Koha, opacShibOnly and staffShibOnly, allowing users to restrict authentication to just one method, Shibboleth. A system preference was chosen over a configuration file update to allow for local override at the virtualhost level. In this way a hosting provider can setup a 'backdoor opac' for example to allow fallback to local logins for support operations. --- C4/Auth.pm | 7 +++++++ installer/data/mysql/atomicupdate/shibOnly.perl | 6 ++++++ .../prog/en/modules/admin/preferences/opac.pref | 7 +++++++ .../prog/en/modules/admin/preferences/staff_client.pref | 7 +++++++ 4 files changed, 27 insertions(+) create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl diff --git a/C4/Auth.pm b/C4/Auth.pm index 5b2434a585..9388383694 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1324,6 +1324,13 @@ sub checkauth { } if ($shib) { + #If shibOnly is enabled just go ahead and redirect directly + if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) { + my $redirect_url = login_shib_url( $query ); + print $query->redirect($redirect_url); + safe_exit; + } + $template->param( shibbolethAuthentication => $shib, shibbolethLoginUrl => login_shib_url($query), diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl new file mode 100644 index 0000000000..9b67d0fb42 --- /dev/null +++ b/installer/data/mysql/atomicupdate/shibOnly.perl @@ -0,0 +1,6 @@ +$DBversion = 'XXX'; # will be replaced by the RM +if( CheckVersion( $DBversion ) ) { + $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" ); + SetVersion( $DBversion ); + print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n"; +} diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref index 8300553aee..8a6ff9bcf0 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref @@ -880,3 +880,10 @@ OPAC: - "The patron should see the charge description as " - pref: PayPalChargeDescription class: long + Authentication: + - + - pref: opacShibOnly + choices: + yes: "Don't allow" + no: Allow + - patrons to login by means other than Shibboleth. diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref index 570c570982..cf734254d7 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref @@ -177,3 +177,10 @@ Staff Client: yes: Show no: "Don't show" - a search field pulldown for 'Search the catalog' boxes. + Authentication: + - + - pref: staffShibOnly + choices: + yes: "Don't allow" + no: Allow + - staff to login by means other than shibboleth. -- 2.20.1