Summary: | User logged out on refresh after CAS authentication | ||
---|---|---|---|
Product: | Koha | Reporter: | Matthias Meusburger <matthias.meusburger> |
Component: | Authentication | Assignee: | Matthias Meusburger <matthias.meusburger> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | chris, corinne.flacher-david, dpavlin, fridolin.somers, jonathan.druart, koha, luce.barbey, tmisilo, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Small patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: | Circulation function: | ||
Bug Depends on: | |||
Bug Blocks: | 14035, 14034 | ||
Attachments: |
Bug 12887: User logged out on refresh after CAS authentication
[PASSED QA] Bug 12887: User logged out on refresh after CAS authentication |
Description
Matthias Meusburger
2014-09-08 14:52:10 UTC
I add on a test case about user logged out on refresh after CAS authentication : 4) When you try to log in, again, you cannot log in to the Opac. It's impossible. I add on a test case about user logged out on refresh after CAS authentication : 4) When you try to log in, again, you cannot authenticate to the OPAC through CAS. It's impossible. I cannot reproduce 4) on master. Relogging works for me. Can you provide more informations about how 4) failed for you ? Anyway, the logout occurs because directly after login the ticket parameter is still in the url. When pressing refresh, the page is called again with the ticket parameter, which will trigger ticket validation, that will fail because the ticket has already been used, provoking the logout. A possible fix would be to check if the user is already logged-in and prevent CAS ticket validation if it is the case. Created attachment 36498 [details] [review] Bug 12887: User logged out on refresh after CAS authentication - If the user is already logged-in, do not trigger CAS authentication even if there is a ticket in the parameters. Tested on a sandbox : 1. I've Changed this syspref : casAuthentication (use), casServerUrl, OPACBaseURL 2. Go to the opac and connect this CAS authentication 3. refresh the page (I've tried F5 and the refresh button) : I'm still logged in. 4. I've tried to deconnect and reconnect : no problem. It works ! I've also tested and it works for me too Created attachment 36676 [details] [review] [PASSED QA] Bug 12887: User logged out on refresh after CAS authentication If the user is already logged-in, do not trigger CAS authentication even if there is a ticket in the parameters. 1) Authenticate to the OPAC through CAS. 2) Once redirected to your account, hit F5 or the refresh button of your browser. 3) You're logged out. Signed-off-by: Koha Team Lyon 3 <koha@univ-lyon3.fr> Signed-off-by: Luce Barbey <luce.barbey@cirad.fr> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Added sign of lines according to bug. Works as described, small change. Patch pushed to master. Thanks Matthias! Pushed to 3.18.x will be in 3.18.6 |