From d0b71a6685240f440ef462ce060dc761cbac6520 Mon Sep 17 00:00:00 2001
From: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Date: Wed, 26 Apr 2017 12:39:15 +0100
Subject: [PATCH] Bug 18506: Add xShibOnly preference for Shibboleth
 authentication

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
---
 C4/Auth.pm                                                 | 7 +++++++
 installer/data/mysql/atomicupdate/shibOnly.perl            | 6 ++++++
 .../prog/en/modules/admin/preferences/opac.pref            | 7 +++++++
 .../prog/en/modules/admin/preferences/staff_client.pref    | 7 +++++++
 4 files changed, 27 insertions(+)
 create mode 100644 installer/data/mysql/atomicupdate/shibOnly.perl

diff --git a/C4/Auth.pm b/C4/Auth.pm
index d79ce466e0..a5da356ada 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1325,6 +1325,13 @@ sub checkauth {
     }
 
     if ($shib) {
+        #If shibOnly is enabled just go ahead and redirect directly
+        if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
+            my $redirect_url = login_shib_url( $query );
+            print $query->redirect($redirect_url);
+            safe_exit;
+        }
+
         $template->param(
             shibbolethAuthentication => $shib,
             shibbolethLoginUrl       => login_shib_url($query),
diff --git a/installer/data/mysql/atomicupdate/shibOnly.perl b/installer/data/mysql/atomicupdate/shibOnly.perl
new file mode 100644
index 0000000000..9b67d0fb42
--- /dev/null
+++ b/installer/data/mysql/atomicupdate/shibOnly.perl
@@ -0,0 +1,6 @@
+$DBversion = 'XXX';  # will be replaced by the RM
+if( CheckVersion( $DBversion ) ) {
+    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
+    SetVersion( $DBversion );
+    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
+}
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
index 567e62276d..aa48ccb13f 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
@@ -880,3 +880,10 @@ OPAC:
             - "The patron should see the charge description as "
             - pref: PayPalChargeDescription
               class: long
+    Authentication:
+        -
+            - pref: opacShibOnly
+              choices:
+                  yes: "Don't allow"
+                  no: Allow
+            - patrons to login by means other than Shibboleth.
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
index 570c570982..cf734254d7 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_client.pref
@@ -177,3 +177,10 @@ Staff Client:
                   yes: Show
                   no: "Don't show"
             - a search field pulldown for 'Search the catalog' boxes.
+    Authentication:
+        -
+            - pref: staffShibOnly
+              choices:
+                  yes: "Don't allow"
+                  no: Allow
+            - staff to login by means other than shibboleth.
-- 
2.20.1