The shibboleth config should be moved from the koha-conf.xml to the database This will allow the shibboleth config to be set from the UI or with the API.
Created attachment 189234 [details] [review] Bug 39224: add database schema for shibboleth configuration Add shibboleth_config and shibboleth_field_mappings tables to store Shibboleth authentication configuration in the database. Includes atomic update to migrate existing XML-based configurations. TEST PLAN: Prerequisites - A SAML setup - Enable ShibbolethAuthentication system preference - Access staff interface with manage_identity_providers permission Test Configuration Interface (Staff → Administration → Shibboleth) 1. Access UI - Navigate to Shibboleth configuration page 2. Basic Settings - Toggle force SSO for OPAC/staff, autocreate, sync, welcome email 3. Field Mappings - Add mappings with IdP field names 4. Set Matchpoint - Mark one field as matchpoint; verify only one can be active 5. Default Values - Test mappings with default_content when idp_field is empty Test Authentication Behavior 6. OPAC SSO - Enable force_opac_sso; verify OPAC auto-redirects to Shibboleth login URL 7. Staff SSO - Enable force_staff_sso; verify staff interface auto-redirects 8. Disable force SSO; verify local login form shows with Shibboleth link 9. Autocreate - Enable autocreate; authenticate new user; verify patron record created 10. Sync on Login - Enable sync; modify IdP attributes; login; verify patron data updated Test Error Cases 11. No Matchpoint - Remove matchpoint; reload login page; verify Shibboleth login option disappears entirely; check logs for "No matchpoint configured" warning 12. Invalid Mapping - Create mapping without koha_field or (idp_field + default_content); verify validation error 13. Duplicate Matchpoint - Set second matchpoint; verify first is auto-cleared Verify Legacy Compatibility 14. Syspref Removed - Confirm OPACShibOnly and staffShibOnly sysprefs no longer exist/used 15. Run tests and ensure they pass and that the migration will work as expected. prove -vv t/db_dependent/Auth_with_shibboleth.t t/db_dependent/Koha/ShibbolethConfigs.t t/db_dependent/Koha/ShibbolethFieldMappings.t t/db_dependent/Shibboleth/Migration.t t/db_dependent/api/v1/shibboleth_config.t t/db_dependent/api/v1/shibboleth_field_mappings.t
Created attachment 189235 [details] [review] Bug 39224: add Koha object models for shibboleth configuration Add Koha::ShibbolethConfig and Koha::ShibbolethFieldMapping classes to manage Shibboleth configuration stored in the database.
Created attachment 189236 [details] [review] Bug 39224: add REST API endpoints for shibboleth configuration Add API endpoints for managing Shibboleth configuration: - GET/PUT /api/v1/shibboleth/config - GET/POST /api/v1/shibboleth/mappings - GET/PUT/DELETE /api/v1/shibboleth/mappings/{mapping_id}
Created attachment 189237 [details] [review] Bug 39224: integrate database-backed shibboleth configuration Update authentication code to read Shibboleth configuration from database instead of koha-conf.xml. Add get_force_sso_setting function to retrieve SSO settings from database.
Created attachment 189238 [details] [review] Bug 39224: add Vue UI for shibboleth configuration Add staff interface pages for managing Shibboleth configuration including settings and field mappings. Includes API client, Vue components, store, and routes.
Created attachment 189239 [details] [review] Bug 39224: integrate shibboleth UI into staff interface Add menu entry, configure build system, and set up routing for Shibboleth configuration interface.
Created attachment 189240 [details] [review] Bug 39224: add comprehensive tests for shibboleth configuration Add tests for: - Koha object models (ShibbolethConfig, ShibbolethFieldMapping) - REST API endpoints - Database migration from XML config
Created attachment 189241 [details] [review] Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication - Remove OPACShibOnly and staffShibOnly sysprefs (now in shibboleth_config table) - Add ShibbolethAuthentication syspref to replace useshibboleth XML config - Update to check syspref instead of XML - Only show Shibboleth configuration link when ShibbolethAuthentication is enabled
Created attachment 189242 [details] [review] Bug 39224: DBIC - DO NOT PUSH
Created attachment 189243 [details] [review] Bug 39224: add is_boolean definitions for shibboleth tables to schema This applies to controllers: - ShibolethConfig - sync - welcome - autocreate - force{opac/staff}sso - ShibbolethFieldMapping - is_matchpoint
Created attachment 189244 [details] [review] Bug 39224: show warning for required fields when autocreate is enabled
To make the testing of this a bit easier (since SSO is a pain in the ass) I've written an improvement to the koha-testing docker (that requires this branch) that incidentally should also make testing this branch a bit easier. If you boot up a ktd instance with `ktd --localrun --sso up` while on this branch: https://github.com/Jacobomara901/koha-testing-docker/tree/sso-but-better it will boot up a keycloak instance with the realm already configured to koha. It will also enable Shibboleth in koha, turn on sync and autocreate and also configure all of the mappings in koha that are currently configured in keycloak. If you want to log in as an admin to keycloak to check, head to localhost:8082 as usual with the login details keycloak:keycloak for logging in to koha via this sso setup, use the credentials kohadev:kohadev (or set up your own in the keycloak admin panel) Obviously this has no ssl and Koha is hard coded in auth_with_shibboleth.pm to use https, so you'll need to change the code here to http instead for the _get_uri() sub. The above work will be upstreamed to the koha-testing-docker repo once this bug has been pushed to main Thanks in advance