Bug 12887

Summary: User logged out on refresh after CAS authentication
Product: Koha Reporter: Matthias Meusburger <matthias.meusburger>
Component: AuthenticationAssignee: Matthias Meusburger <matthias.meusburger>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: chris, corinne.flacher-david, dpavlin, fridolin.somers, jonathan.druart, koha, luce.barbey, tmisilo, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14035, 14034    
Attachments: Bug 12887: User logged out on refresh after CAS authentication
[PASSED QA] Bug 12887: User logged out on refresh after CAS authentication

Description Matthias Meusburger 2014-09-08 14:52:10 UTC
The user is logged out when refreshing the page directly after a CAS login.

Steps to reproduce:

1) Authenticate to the OPAC through CAS.
2) Once redirected to your account, hit F5 or the refresh button of your browser.
3) You're logged out.
Comment 1 Corinne Flacher-David 2015-03-02 15:27:38 UTC
I add on a test case about user logged out on refresh after CAS authentication :

4) When you try to log in, again, you cannot log in to the Opac.
It's impossible.
Comment 2 Corinne Flacher-David 2015-03-02 15:31:31 UTC
I add on a test case about user logged out on refresh after CAS
authentication :

4) When you try to log in, again, you cannot authenticate to the OPAC through CAS. It's impossible.
Comment 3 Matthias Meusburger 2015-03-03 10:34:34 UTC
I cannot reproduce 4) on master. Relogging works for me. Can you provide more informations about how 4) failed for you ?
Comment 4 Matthias Meusburger 2015-03-04 14:08:45 UTC
Anyway, the logout occurs because directly after login the ticket parameter is still in the url. 

When pressing refresh, the page is called again with the ticket parameter, which will trigger ticket validation, that will fail because the ticket has already been used, provoking the logout.

A possible fix would be to check if the user is already logged-in and prevent CAS ticket validation if it is the case.
Comment 5 Matthias Meusburger 2015-03-04 15:22:56 UTC Comment hidden (obsolete)
Comment 6 Koha Team University Lyon 3 2015-03-05 10:24:24 UTC
Tested on a sandbox :
1. I've Changed this syspref : casAuthentication (use), casServerUrl, OPACBaseURL
2. Go to the opac and connect this CAS authentication
3. refresh the page (I've tried F5 and the refresh button) : I'm still logged in.
4. I've tried to deconnect and reconnect : no problem.

It works !
Comment 7 LuceBarbey 2015-03-05 10:57:14 UTC
I've also tested and it works for me too
Comment 8 Katrin Fischer 2015-03-06 10:56:01 UTC
Created attachment 36676 [details] [review]
[PASSED QA] Bug 12887: User logged out on refresh after CAS authentication

If the user is already logged-in, do not trigger CAS authentication
even if there is a ticket in the parameters.

1) Authenticate to the OPAC through CAS.
2) Once redirected to your account, hit F5 or the refresh button of your browser.
3) You're logged out.

Signed-off-by: Koha Team Lyon 3 <koha@univ-lyon3.fr>
Signed-off-by: Luce Barbey <luce.barbey@cirad.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Added sign of lines according to bug.
Works as described, small change.
Comment 9 Tomás Cohen Arazi 2015-03-30 16:47:56 UTC
Patch pushed to master.

Thanks Matthias!
Comment 10 Chris Cormack 2015-03-31 05:23:44 UTC
Pushed to 3.18.x will be in 3.18.6