Bug 12027

Summary: Shibboleth authentication for staff client
Product: Koha Reporter: Martin Renvoize <martin.renvoize>
Component: AuthenticationAssignee: Martin Renvoize <martin.renvoize>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: new feature    
Priority: P5 - low CC: dcook, dpavlin, francart, frederic, heupink, josef.moravec, julian.maurice, katrin.fischer, m.de.rooy, martin.renvoize, matthias.meusburger, mirko, mtompset, nick, pgsengstock, r.delahunty, theod, tomascohen, veron, ztajoli
Version: master   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=12680
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16401
Change sponsored?: --- Patch complexity: Medium patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Sponsored by PTFS Europe Shibboleth authentication has long been available for the OPAC, this patch adds support for the staff client.
Version(s) released in:
Bug Depends on: 8446, 12026, 13114, 13569, 16401    
Bug Blocks: 18506    
Attachments: BUG 12027: Added shibboleth authentication to the staff client
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027 [Followup]: Added missing documentation
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027 [Followup]: Added missing documentation
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027 [Followup]: Added missing documentation
BUG 12027: Added shibboleth authentication to the staff client
BUG 12027 [Followup]: Added missing documentation
BUG 12027 [QA Followup] - Update tests
BUG 12027 [QA Followup] - Update tests
BUG 12027 [QA Followup] - Update tests
Bug 12027: Added shibboleth authentication to the staff client
Bug 12027: (follow-up) Added missing documentation
Bug 12027: (QA follow-up) Update tests
Bug 12027: (QA follow-up) Fix spelling and tab characters

Description Martin Renvoize 2014-04-02 12:49:25 UTC
The current shibboleth implementation only support authentication into the opac. We should also enable shibboleth for the staff client.
Comment 1 Martin Renvoize 2014-07-31 06:23:47 UTC Comment hidden (obsolete)
Comment 2 Martin Renvoize 2014-07-31 06:31:15 UTC Comment hidden (obsolete)
Comment 3 Martin Renvoize 2014-07-31 06:34:13 UTC Comment hidden (obsolete)
Comment 4 Martin Renvoize 2014-07-31 06:46:15 UTC Comment hidden (obsolete)
Comment 5 Martin Renvoize 2015-01-27 13:37:43 UTC Comment hidden (obsolete)
Comment 6 Martin Renvoize 2015-01-27 13:37:47 UTC Comment hidden (obsolete)
Comment 7 Martin Renvoize 2015-01-27 13:38:11 UTC
Rebased
Comment 8 Martin Renvoize 2015-10-13 09:42:59 UTC
Created attachment 43371 [details] [review]
BUG 12027: Added shibboleth authentication to the staff client

- This patch adds shibboleth authentication to the staff client.
- Depending upon how your url structure works, you may or may not need a
  second native shibboleth service provider profile configured for this
  to work.

http://bugs.koha-community.org/show_bug.cgi?id=12026
Comment 9 Martin Renvoize 2015-10-13 09:43:02 UTC
Created attachment 43372 [details] [review]
BUG 12027 [Followup]: Added missing documentation
Comment 10 Martin Renvoize 2015-10-13 09:43:45 UTC
Rebased again
Comment 11 Mirko Tietgen 2016-01-28 13:04:57 UTC
Are there good instructions on how to set up a test environment for shibboleth patches?
Comment 12 Martin Renvoize 2016-04-21 07:08:11 UTC
Sorry I missed this a while back. There are some instructions on the wiki for configuring shibboleth on your server, and there are now a couple of public identity providers one can use to test against I believe..  Just Google shibboleth test IdP to find one for your locality.
Comment 14 Martin Renvoize 2017-04-21 13:21:52 UTC
Created attachment 62523 [details] [review]
BUG 12027: Added shibboleth authentication to the staff client

- This patch adds shibboleth authentication to the staff client.
- Depending upon how your url structure works, you may or may not need a
  second native shibboleth service provider profile configured for this
  to work.

http://bugs.koha-community.org/show_bug.cgi?id=12026
Comment 15 Martin Renvoize 2017-04-21 13:21:56 UTC
Created attachment 62524 [details] [review]
BUG 12027 [Followup]: Added missing documentation

https://bugs.koha-community.org/show_bug.cgi?id=12026
Comment 16 Martin Renvoize 2017-04-21 13:22:18 UTC
Simple Rebase
Comment 17 Martin Renvoize 2017-04-28 08:13:51 UTC
We have this running in production at three sites and have had since it's first submission.
Comment 18 Nick Clemens 2017-04-28 13:15:06 UTC
Created attachment 62823 [details] [review]
BUG 12027: Added shibboleth authentication to the staff client

- This patch adds shibboleth authentication to the staff client.
- Depending upon how your url structure works, you may or may not need a
  second native shibboleth service provider profile configured for this
  to work.

http://bugs.koha-community.org/show_bug.cgi?id=12026

Tested in production

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 19 Nick Clemens 2017-04-28 13:15:11 UTC
Created attachment 62824 [details] [review]
BUG 12027 [Followup]: Added missing documentation

https://bugs.koha-community.org/show_bug.cgi?id=12026

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 20 Martin Renvoize 2017-04-28 14:24:09 UTC
Created attachment 62825 [details] [review]
BUG 12027 [QA Followup] - Update tests
Comment 21 Martin Renvoize 2017-04-28 14:25:44 UTC
Added a follow up to update the tests to cover the addition of intranet handling to quell a suspected QA failure before it happens ;)
Comment 22 Martin Renvoize 2017-04-28 14:31:28 UTC
Forgot to mention that last follow-up also silenced a silly warning which was a result of rebases at some point.  Just a simple double declaration warning.
Comment 23 Mark Tompsett 2017-05-01 00:13:30 UTC
(In reply to Martin Renvoize from comment #13)
> https://wiki.koha-community.org/wiki/Shibboleth_Configuration

Sweet, tangentially, do we have attempts at other authentication methods?
Also, we should also have a bug for changing the StaffBaseURL to include the protocol. After all, shibboleth requires https, does it not?
Comment 24 Martin Renvoize 2017-05-01 15:54:43 UTC
(In reply to M. Tompsett from comment #23)
> (In reply to Martin Renvoize from comment #13)
> > https://wiki.koha-community.org/wiki/Shibboleth_Configuration
> 
> Sweet, tangentially, do we have attempts at other authentication methods?
> Also, we should also have a bug for changing the StaffBaseURL to include the
> protocol. After all, shibboleth requires https, does it not?

This patch does allow fallback logins as per OPAC shibboleth, although due to the nature of shibboleth the same caveats apply (i.e. once you've clicked the 'login via shibboleth' link and been redirected to the IdP, if you fail to login you won't get redirected back to the koha client, so you'll have to navigate back yourself to use a fallback method. This is protocol specific and at the IdP end, there's no way to fix this at the koha side)

Bug 18506 allows for a 'Shibboleth Only' mode should you wish to use shibboleth in that way.

Hmm, I must admit I'd lost track fo the StaffBaseURL preference and whether it allowed specifying a protocol or not now; I best check up on that one.

Cheers
Comment 25 Marcel de Rooy 2017-06-23 10:10:30 UTC
(In reply to Martin Renvoize from comment #24)
> (In reply to M. Tompsett from comment #23)

> Hmm, I must admit I'd lost track fo the StaffBaseURL preference and whether
> it allowed specifying a protocol or not now; I best check up on that one.

Unfortunately for you Mark only fixed OPACBaseURL iirc. Which means that your assumption that StaffBaseURL includes the protocol is not correct.
Comment 26 Matthias Meusburger 2017-10-17 13:47:38 UTC
Now that Bug 16401 has been pushed, assuming that staffClientBaseURL has a protocol should be ok now.
Comment 27 Marcel de Rooy 2017-11-03 09:50:36 UTC
Also please add feedback for comment 25.
Comment 28 Marcel de Rooy 2017-11-03 10:21:41 UTC
Zeno asked me:
===
I think that Matthias on commen7 #26 is quite clear
It is not enough a rebase for this patch ?
===
Yeah I focused on a reply from Martin. So probably true.
Comment 29 Matthias Meusburger 2018-03-22 10:30:20 UTC
Created attachment 73152 [details] [review]
BUG 12027 [QA Followup] - Update tests
Comment 30 Matthias Meusburger 2018-03-22 10:32:43 UTC
Patch rebased.

Marcel, do you still need feedback for comment 25 ?

Other than that, is there something else expected for this patch to move on ?
Comment 31 Marcel de Rooy 2018-03-22 10:36:32 UTC
(In reply to Matthias Meusburger from comment #30)
> Marcel, do you still need feedback for comment 25 ?
Not anymore.
Comment 32 Martin Renvoize 2018-03-23 08:08:49 UTC
Thanks for rebasing matthias.. Counting down the days until my return to the community now 😀
Comment 33 Martin Renvoize 2018-06-07 09:49:12 UTC
Created attachment 75868 [details] [review]
BUG 12027 [QA Followup] - Update tests
Comment 34 Martin Renvoize 2018-06-07 09:50:02 UTC
Another minor rebase of the last patch.
Comment 35 Julian Maurice 2018-09-26 14:22:16 UTC
Created attachment 79416 [details] [review]
Bug 12027: Added shibboleth authentication to the staff client

- This patch adds shibboleth authentication to the staff client.
- Depending upon how your url structure works, you may or may not need a
  second native shibboleth service provider profile configured for this
  to work.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 36 Julian Maurice 2018-09-26 14:22:24 UTC
Created attachment 79417 [details] [review]
Bug 12027: (follow-up) Added missing documentation

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 37 Julian Maurice 2018-09-26 14:22:30 UTC
Created attachment 79418 [details] [review]
Bug 12027: (QA follow-up) Update tests

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 38 Julian Maurice 2018-09-26 14:22:36 UTC
Created attachment 79419 [details] [review]
Bug 12027: (QA follow-up) Fix spelling and tab characters

Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 39 Katrin Fischer 2018-09-27 10:30:31 UTC
Thx, Julian!
Comment 40 Nick Clemens 2018-10-01 16:31:16 UTC
Awesome work all!

Pushed to master for 18.11
Comment 41 Martin Renvoize 2018-10-05 15:43:55 UTC
Enhancement, will not be backported to 18.05.x series