Bug 14034

Summary: User logged out on refresh after Shibboleth authentication
Product: Koha Reporter: Martin Renvoize <martin.renvoize>
Component: AuthenticationAssignee: Martin Renvoize <martin.renvoize>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: brendan, chris, corinne.flacher-david, dpavlin, f.demians, fridolin.somers, jonathan.druart, julian.maurice, koha, luce.barbey, matthias.meusburger, tmisilo, tomascohen
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on: 12887    
Bug Blocks: 14035    
Attachments: Bug 14034: Fix logout on refresh for shibboleth
Bug 14034: Fix logout on refresh for shibboleth
Bug 14034: Fix logout on refresh for shibboleth

Description Martin Renvoize 2015-04-21 11:13:27 UTC
+++ This bug was initially created as a clone of Bug #12887 +++

The bug seems to also affect shibboleth.. I have no idea at what point it crept in or how.. but I've found the same on a recent update of one of our shibboleth customers.

If you enable the _session_log you'll spot that every page request in fact results in an entirely new login taking place via shibboleth.
Comment 1 Martin Renvoize 2015-09-18 08:11:36 UTC Comment hidden (obsolete)
Comment 2 Martin Renvoize 2015-09-18 11:01:49 UTC
This patch has been in live operation on at least four customers here since it was initially found..  I just hadn't had a chance to extract and submit it.

Would be nice to get an external to PTFS-Europe signoff though.
Comment 3 Chris Cormack 2015-12-23 19:22:39 UTC Comment hidden (obsolete)
Comment 4 Jonathan Druart 2015-12-26 11:35:59 UTC
Matts, could you please test this patch and confirm that it works as expected?
Comment 5 Jesse Weaver 2015-12-31 20:06:08 UTC
Created attachment 46162 [details] [review]
Bug 14034: Fix logout on refresh for shibboleth

This is similar to bug 12877

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

While this is missing a detailed test plan, what I did to test was

1/ Login to koha .. it works
2/ Apply patch
3/ Login to koha .. it still works, no regressions. I can't test the
shibboleth part but it doesnt break anything else so I'm happy to sign
off

Signed-off-by: Jesse Weaver <jweaver@bywatersolutions.com>

We had to implement this fix for one of our customers using Shibboleth.
Can verify that it fixes the issue (which, incidentally, breaks
stage-marc-import since that depends on a constant sessionID).

Passing QA (verified with QA tools). Thanks, Martin!
Comment 6 Brendan Gallagher 2015-12-31 20:42:50 UTC
Pushed to Master - Thanks!
Comment 7 Julian Maurice 2016-01-03 10:54:02 UTC
Patch pushed to 3.22.x, will be in 3.22.2
Comment 8 Frédéric Demians 2016-01-04 15:05:09 UTC
This patch has been pushed to 3.20.x, will be in 3.20.8.