Bug 18506 - SSO - Shibboleth Only Mode
Summary: SSO - Shibboleth Only Mode
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Martin Renvoize
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on: 12027
Blocks:
  Show dependency treegraph
 
Reported: 2017-04-28 08:05 UTC by Martin Renvoize
Modified: 2018-10-05 11:30 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
This enhancement adds a system preference to allow libraries to enable shibboleth to work as the only authentication method available for their library and as such practice fully devolved authentication. When combined with the OpacPublic preference, this can be used to enable seamless Single Sign On, where the user simply browses to the OPAC in their web browser and if already logged in on their domain they will automatically be logged in in koha too.


Attachments
BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2017-04-28 08:09 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2018-09-18 13:10 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG 18506 - Add xShibOnly preference for shibboleth (3.85 KB, patch)
2018-09-27 15:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 18506: (followup) Make this play nicely with opacPublic (2.61 KB, patch)
2018-09-27 15:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 18506: (followup) Make this play nicely with opacPublic (3.50 KB, patch)
2018-09-27 16:07 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize 2017-04-28 08:05:01 UTC
Shibboleth works at it's best when it is the ONLY form of authentication allowed on the system.

That way, if you disable opacPublic you can have a system that automatically redirects the user to the IdP for authentication immediately and skips any other forms of authentication leading to a more seamless SSO solution.
Comment 1 Martin Renvoize 2017-04-28 08:09:12 UTC
Created attachment 62810 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 2 Katrin Fischer 2017-10-15 12:19:37 UTC
Assigning bug to Martin as he has provided the patch.

Depends on a bug that is in 'Failed QA' - marking as BLOCKED for now.
Comment 3 Katrin Fischer 2017-10-15 12:21:58 UTC
Comment on attachment 62810 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

Review of attachment 62810 [details] [review]:
-----------------------------------------------------------------

From looking at the patch:

Author in patch file is not correct - PTFS Admin <hosting@ptfs-europe.com>

::: installer/data/mysql/atomicupdate/shibOnly.perl
@@ +1,5 @@
> +$DBversion = 'XXX';  # will be replaced by the RM
> +if( CheckVersion( $DBversion ) ) {
> +    $dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
> +    SetVersion( $DBversion );
> +    print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";

Missing the bug number and maybe a nicer explanation?

::: koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
@@ +828,5 @@
> +            - pref: opacShibOnly
> +              choices:
> +                  yes: "Don't allow"
> +                  no: Allow
> +            - patrons to login by means other than shibboleth.

Should shibboleth be Shibboleth?
Comment 4 Martin Renvoize 2018-09-18 13:10:58 UTC
Created attachment 79050 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 5 Martin Renvoize 2018-09-18 13:11:32 UTC
Rebased and made requested corrections.
Comment 6 Julian Maurice 2018-09-27 14:11:02 UTC
Hi Martin,

it looks like the patch is not complete. It works as expected for OPAC when opacPublic is disabled. But when it's enabled, users are still able to login using their local credentials.
Comment 7 Martin Renvoize 2018-09-27 15:02:22 UTC
Created attachment 79522 [details] [review]
BUG 18506 - Add xShibOnly preference for shibboleth

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.
Comment 8 Martin Renvoize 2018-09-27 15:02:25 UTC
Created attachment 79524 [details] [review]
Bug 18506: (followup) Make this play nicely with opacPublic
Comment 9 Martin Renvoize 2018-09-27 15:03:11 UTC
Not my most elegant of followups but I think it resolves the issue.

Thanks for testing Julian.
Comment 10 Martin Renvoize 2018-09-27 16:07:22 UTC
Created attachment 79540 [details] [review]
Bug 18506: (followup) Make this play nicely with opacPublic