Bug 14034

Summary:	User logged out on refresh after Shibboleth authentication
Product:	Koha	Reporter:	Martin Renvoize (ashimema) <martin.renvoize>
Component:	Authentication	Assignee:	Martin Renvoize (ashimema) <martin.renvoize>
Status:	CLOSED FIXED	QA Contact:	Testopia <testopia>
Severity:	normal
Priority:	P5 - low	CC:	brendan, chris, corinne.flacher-david, dpavlin, f.demians, fridolin.somers, jonathan.druart, julian.maurice, koha, luce.barbey, matthias.meusburger, tmisilo, tomascohen
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	Trivial patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Bug Depends on:	12887
Bug Blocks:	14035
Attachments:	Bug 14034: Fix logout on refresh for shibboleth Bug 14034: Fix logout on refresh for shibboleth Bug 14034: Fix logout on refresh for shibboleth

Description Martin Renvoize (ashimema) 2015-04-21 11:13:27 UTC

+++ This bug was initially created as a clone of Bug #12887 +++

The bug seems to also affect shibboleth.. I have no idea at what point it crept in or how.. but I've found the same on a recent update of one of our shibboleth customers.

If you enable the _session_log you'll spot that every page request in fact results in an entirely new login taking place via shibboleth.

Comment 1 Martin Renvoize (ashimema) 2015-09-18 08:11:36 UTC Comment hidden (obsolete)

Created attachment 42692 [details] [review]
Bug 14034: Fix logout on refresh for shibboleth

This is similar to bug 12877

Comment 2 Martin Renvoize (ashimema) 2015-09-18 11:01:49 UTC

This patch has been in live operation on at least four customers here since it was initially found..  I just hadn't had a chance to extract and submit it.

Would be nice to get an external to PTFS-Europe signoff though.

Comment 3 Chris Cormack 2015-12-23 19:22:39 UTC Comment hidden (obsolete)

Created attachment 45961 [details] [review]
Bug 14034: Fix logout on refresh for shibboleth

This is similar to bug 12877

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

While this is missing a detailed test plan, what I did to test was

1/ Login to koha .. it works
2/ Apply patch
3/ Login to koha .. it still works, no regressions. I can't test the
shibboleth part but it doesnt break anything else so I'm happy to sign
off

Comment 4 Jonathan Druart 2015-12-26 11:35:59 UTC

Matts, could you please test this patch and confirm that it works as expected?

Comment 5 Jesse Weaver 2015-12-31 20:06:08 UTC

Created attachment 46162 [details] [review]
Bug 14034: Fix logout on refresh for shibboleth

This is similar to bug 12877

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

While this is missing a detailed test plan, what I did to test was

1/ Login to koha .. it works
2/ Apply patch
3/ Login to koha .. it still works, no regressions. I can't test the
shibboleth part but it doesnt break anything else so I'm happy to sign
off

Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>

We had to implement this fix for one of our customers using Shibboleth.
Can verify that it fixes the issue (which, incidentally, breaks
stage-marc-import since that depends on a constant sessionID).

Passing QA (verified with QA tools). Thanks, Martin!

Comment 6 Brendan Gallagher 2015-12-31 20:42:50 UTC

Pushed to Master - Thanks!

Comment 7 Julian Maurice 2016-01-03 10:54:02 UTC

Patch pushed to 3.22.x, will be in 3.22.2

Comment 8 Frédéric Demians 2016-01-04 15:05:09 UTC

This patch has been pushed to 3.20.x, will be in 3.20.8.