Bug 24065

Summary: Shibboleth should fail the login if matchpoint is not unique
Product: Koha Reporter: Nick Clemens (kidclamp) <nick>
Component: AuthenticationAssignee: Nick Clemens (kidclamp) <nick>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: normal    
Priority: P5 - low CC: dpavlin, liz, m.de.rooy, matthias.meusburger
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00
Attachments: Bug 24065: Fail shib login if multiple users matched
Bug 24065: Fail shib login if multiple users matched
Bug 24065: Fail shib login if multiple users matched

Description Nick Clemens (kidclamp) 2019-11-19 12:19:30 UTC
The shib config allows you to use any patron field for matching. Email is sometimes used, but Koha does not enforce uniqueness here.

We call 'find' to get the patron, this will throw an error, but not fail

We should 'search' instead and fail explicitly if there is more than one patron
Comment 1 Nick Clemens (kidclamp) 2019-11-19 13:03:00 UTC
Created attachment 95546 [details] [review]
Bug 24065: Fail shib login if multiple users matched

Ideally you could test against active shib, but is a small code change and
covered by tests and should be readable

To test:
prove -v t/Auth_with_shibboleth.t
Comment 2 Liz Rea 2019-11-19 14:52:30 UTC
Created attachment 95562 [details] [review]
Bug 24065: Fail shib login if multiple users matched

Ideally you could test against active shib, but is a small code change and
covered by tests and should be readable

To test:
prove -v t/Auth_with_shibboleth.t

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 3 Marcel de Rooy 2019-11-21 08:14:40 UTC
Created attachment 95648 [details] [review]
Bug 24065: Fail shib login if multiple users matched

Ideally you could test against active shib, but is a small code change and
covered by tests and should be readable

To test:
prove -v t/Auth_with_shibboleth.t

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Marcel de Rooy 2019-11-21 08:24:00 UTC
I still do not understand why we stick to Test::DBIx::Class to test changes like this. Obviously we need a borrowers database here ;)
Even more, if we use C4::Context in a t script (like this one), it makes not much sense.
The theoretical benefit of Test::DBIx::Class is imo not in balance with its *horrible* installation..
Comment 5 Martin Renvoize 2019-11-21 11:36:58 UTC
Nice work!

Pushed to master for 19.11.00