Bug 12887 - User logged out on refresh after CAS authentication
Summary: User logged out on refresh after CAS authentication
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Matthias Meusburger
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 14035 14034
  Show dependency treegraph
 
Reported: 2014-09-08 14:52 UTC by Matthias Meusburger
Modified: 2015-12-03 22:03 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 12887: User logged out on refresh after CAS authentication (1.11 KB, patch)
2015-03-04 15:22 UTC, Matthias Meusburger
Details | Diff | Splinter Review
[PASSED QA] Bug 12887: User logged out on refresh after CAS authentication (1.49 KB, patch)
2015-03-06 10:56 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Meusburger 2014-09-08 14:52:10 UTC
The user is logged out when refreshing the page directly after a CAS login.

Steps to reproduce:

1) Authenticate to the OPAC through CAS.
2) Once redirected to your account, hit F5 or the refresh button of your browser.
3) You're logged out.
Comment 1 Corinne Flacher-David 2015-03-02 15:27:38 UTC
I add on a test case about user logged out on refresh after CAS authentication :

4) When you try to log in, again, you cannot log in to the Opac.
It's impossible.
Comment 2 Corinne Flacher-David 2015-03-02 15:31:31 UTC
I add on a test case about user logged out on refresh after CAS
authentication :

4) When you try to log in, again, you cannot authenticate to the OPAC through CAS. It's impossible.
Comment 3 Matthias Meusburger 2015-03-03 10:34:34 UTC
I cannot reproduce 4) on master. Relogging works for me. Can you provide more informations about how 4) failed for you ?
Comment 4 Matthias Meusburger 2015-03-04 14:08:45 UTC
Anyway, the logout occurs because directly after login the ticket parameter is still in the url. 

When pressing refresh, the page is called again with the ticket parameter, which will trigger ticket validation, that will fail because the ticket has already been used, provoking the logout.

A possible fix would be to check if the user is already logged-in and prevent CAS ticket validation if it is the case.
Comment 5 Matthias Meusburger 2015-03-04 15:22:56 UTC Comment hidden (obsolete)
Comment 6 Koha Team Lyon 3 2015-03-05 10:24:24 UTC
Tested on a sandbox :
1. I've Changed this syspref : casAuthentication (use), casServerUrl, OPACBaseURL
2. Go to the opac and connect this CAS authentication
3. refresh the page (I've tried F5 and the refresh button) : I'm still logged in.
4. I've tried to deconnect and reconnect : no problem.

It works !
Comment 7 LuceBarbey 2015-03-05 10:57:14 UTC
I've also tested and it works for me too
Comment 8 Katrin Fischer 2015-03-06 10:56:01 UTC
Created attachment 36676 [details] [review]
[PASSED QA] Bug 12887: User logged out on refresh after CAS authentication

If the user is already logged-in, do not trigger CAS authentication
even if there is a ticket in the parameters.

1) Authenticate to the OPAC through CAS.
2) Once redirected to your account, hit F5 or the refresh button of your browser.
3) You're logged out.

Signed-off-by: Koha Team Lyon 3 <koha@univ-lyon3.fr>
Signed-off-by: Luce Barbey <luce.barbey@cirad.fr>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Added sign of lines according to bug.
Works as described, small change.
Comment 9 Tomás Cohen Arazi 2015-03-30 16:47:56 UTC
Patch pushed to master.

Thanks Matthias!
Comment 10 Chris Cormack 2015-03-31 05:23:44 UTC
Pushed to 3.18.x will be in 3.18.6