Bug 31990 - Shibboleth may redirect to OPAC if staff interface and OPAC are served on same hostname.
Summary: Shibboleth may redirect to OPAC if staff interface and OPAC are served on sam...
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-26 13:53 UTC by Björn Nylén
Modified: 2023-06-11 12:52 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Björn Nylén 2022-10-26 13:53:26 UTC
The issue seems to be caused by the session interface being stuck to 'opac' if you serve both intranet and opac on the same hostname (different ports) and you visit the opac page before trying to log into intranet. 

Using the same hostname will result in opac and intranet using the same session cookie, ie same session which may confuse things.

Repoducable in koha testing docker:
1. Enable shibboleth in koha-conf.xml and add a stub configuration
   <shibboleth>
       <matchpoint>userid</matchpoint> <!-- koha borrower field to match upon -->
       <mapping>
           <userid is="eduPersonID"></userid> <!-- koha borrower field to shibboleth attribute mapping -->
       </mapping>
   </shibboleth>

2. Resatart everything
3. Visit opac
4. Visit staff. The shib-login link will be to the opac url.

Visiting staff before opac will not do the opposite though.
Issue arised when we upgraded to 22.05.

Possibly a side effect of Bug 29915 or Bug 29914? Not familiar enough to actually say.