Bug 24065

Summary:	Shibboleth should fail the login if matchpoint is not unique
Product:	Koha	Reporter:	Nick Clemens (kidclamp) <nick>
Component:	Authentication	Assignee:	Nick Clemens (kidclamp) <nick>
Status:	CLOSED FIXED	QA Contact:	Marcel de Rooy <m.de.rooy>
Severity:	normal
Priority:	P5 - low	CC:	dpavlin, liz, m.de.rooy, matthias.meusburger
Version:	Main
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	Small patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	19.11.00
Circulation function:
Attachments:	Bug 24065: Fail shib login if multiple users matched Bug 24065: Fail shib login if multiple users matched Bug 24065: Fail shib login if multiple users matched

Description Nick Clemens (kidclamp) 2019-11-19 12:19:30 UTC

The shib config allows you to use any patron field for matching. Email is sometimes used, but Koha does not enforce uniqueness here.

We call 'find' to get the patron, this will throw an error, but not fail

We should 'search' instead and fail explicitly if there is more than one patron

Comment 1 Nick Clemens (kidclamp) 2019-11-19 13:03:00 UTC

Created attachment 95546 [details] [review]
Bug 24065: Fail shib login if multiple users matched

Ideally you could test against active shib, but is a small code change and
covered by tests and should be readable

To test:
prove -v t/Auth_with_shibboleth.t

Comment 2 Liz Rea 2019-11-19 14:52:30 UTC

Created attachment 95562 [details] [review]
Bug 24065: Fail shib login if multiple users matched

Ideally you could test against active shib, but is a small code change and
covered by tests and should be readable

To test:
prove -v t/Auth_with_shibboleth.t

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Comment 3 Marcel de Rooy 2019-11-21 08:14:40 UTC

Created attachment 95648 [details] [review]
Bug 24065: Fail shib login if multiple users matched

Ideally you could test against active shib, but is a small code change and
covered by tests and should be readable

To test:
prove -v t/Auth_with_shibboleth.t

Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>

Comment 4 Marcel de Rooy 2019-11-21 08:24:00 UTC

I still do not understand why we stick to Test::DBIx::Class to test changes like this. Obviously we need a borrowers database here ;)
Even more, if we use C4::Context in a t script (like this one), it makes not much sense.
The theoretical benefit of Test::DBIx::Class is imo not in balance with its *horrible* installation..

Comment 5 Martin Renvoize (ashimema) 2019-11-21 11:36:58 UTC

Nice work!

Pushed to master for 19.11.00