Bug 18506 - Shibboleth SSO Only Mode
Summary: Shibboleth SSO Only Mode
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
Depends on: 12027
  Show dependency treegraph
Reported: 2017-04-28 08:05 UTC by Martin Renvoize
Modified: 2017-10-15 12:21 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:

BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2017-04-28 08:09 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2017-04-28 08:05:01 UTC
Shibboleth works at it's best when it is the ONLY form of authentication allowed on the system.

That way, if you disable opacPublic you can have a system that automatically redirects the user to the IdP for authentication immediately and skips any other forms of authentication leading to a more seamless SSO solution.
Comment 1 Martin Renvoize 2017-04-28 08:09:12 UTC
Created attachment 62810 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 2 Katrin Fischer 2017-10-15 12:19:37 UTC
Assigning bug to Martin as he has provided the patch.

Depends on a bug that is in 'Failed QA' - marking as BLOCKED for now.
Comment 3 Katrin Fischer 2017-10-15 12:21:58 UTC
Comment on attachment 62810 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

Review of attachment 62810 [details] [review]:

From looking at the patch:

Author in patch file is not correct - PTFS Admin <hosting@ptfs-europe.com>

::: installer/data/mysql/atomicupdate/shibOnly.perl
@@ +1,5 @@
> +$DBversion = 'XXX';  # will be replaced by the RM
> +if( CheckVersion( $DBversion ) ) {
> +    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
> +    SetVersion( $DBversion );
> +    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";

Missing the bug number and maybe a nicer explanation?

::: koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
@@ +828,5 @@
> +            - pref: opacShibOnly
> +              choices:
> +                  yes: "Don't allow"
> +                  no: Allow
> +            - patrons to login by means other than shibboleth.

Should shibboleth be Shibboleth?