Bug 39224 - Move Shibboleth config from koha-conf to the DB
Summary: Move Shibboleth config from koha-conf to the DB
Status: Needs Signoff
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Jacob O'Mara
QA Contact: Testopia
URL:
Keywords:
Depends on: 38201
Blocks:
  Show dependency treegraph
 
Reported: 2025-03-03 10:59 UTC by Jacob O'Mara
Modified: 2025-11-12 13:59 UTC (History)
4 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 39224: add database schema for shibboleth configuration (9.93 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: add Koha object models for shibboleth configuration (7.93 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: add REST API endpoints for shibboleth configuration (16.69 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: integrate database-backed shibboleth configuration (4.35 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: add Vue UI for shibboleth configuration (26.05 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: integrate shibboleth UI into staff interface (5.72 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: add comprehensive tests for shibboleth configuration (40.09 KB, patch)
2025-11-06 22:11 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication (16.91 KB, patch)
2025-11-06 22:12 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: DBIC - DO NOT PUSH (5.01 KB, patch)
2025-11-06 22:12 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: add is_boolean definitions for shibboleth tables to schema (1.99 KB, patch)
2025-11-06 22:12 UTC, Jacob O'Mara
Details | Diff | Splinter Review
Bug 39224: show warning for required fields when autocreate is enabled (2.59 KB, patch)
2025-11-06 22:12 UTC, Jacob O'Mara
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jacob O'Mara 2025-03-03 10:59:11 UTC

    
Comment 1 Jacob O'Mara 2025-03-03 11:59:14 UTC
The shibboleth config should be moved from the koha-conf.xml to the database This will allow the shibboleth config to be set from the UI or with the API.
Comment 2 Jacob O'Mara 2025-11-06 22:11:45 UTC
Created attachment 189234 [details] [review]
Bug 39224: add database schema for shibboleth configuration

Add shibboleth_config and shibboleth_field_mappings tables to store
Shibboleth authentication configuration in the database. Includes
atomic update to migrate existing XML-based configurations.

TEST PLAN:
  Prerequisites

  - A SAML setup
  - Enable ShibbolethAuthentication system preference
  - Access staff interface with manage_identity_providers permission

  Test Configuration Interface (Staff → Administration → Shibboleth)

  1. Access UI - Navigate to Shibboleth configuration page
  2. Basic Settings - Toggle force SSO for OPAC/staff, autocreate, sync, welcome email
  3. Field Mappings - Add mappings with IdP field names
  4. Set Matchpoint - Mark one field as matchpoint; verify only one can be active
  5. Default Values - Test mappings with default_content when idp_field is empty

  Test Authentication Behavior

  6. OPAC SSO - Enable force_opac_sso; verify OPAC auto-redirects to Shibboleth login URL
  7. Staff SSO - Enable force_staff_sso; verify staff interface auto-redirects
  8. Disable force SSO; verify local login form shows with Shibboleth link
  9. Autocreate - Enable autocreate; authenticate new user; verify patron record created
  10. Sync on Login - Enable sync; modify IdP attributes; login; verify patron data updated

  Test Error Cases

  11. No Matchpoint - Remove matchpoint; reload login page; verify Shibboleth login option disappears entirely; check logs for "No matchpoint configured" warning
  12. Invalid Mapping - Create mapping without koha_field or (idp_field + default_content); verify validation error
  13. Duplicate Matchpoint - Set second matchpoint; verify first is auto-cleared

  Verify Legacy Compatibility

  14. Syspref Removed - Confirm OPACShibOnly and staffShibOnly sysprefs no longer exist/used
  15. Run tests and ensure they pass and that the migration will work as expected.
 prove -vv t/db_dependent/Auth_with_shibboleth.t t/db_dependent/Koha/ShibbolethConfigs.t t/db_dependent/Koha/ShibbolethFieldMappings.t t/db_dependent/Shibboleth/Migration.t t/db_dependent/api/v1/shibboleth_config.t t/db_dependent/api/v1/shibboleth_field_mappings.t
Comment 3 Jacob O'Mara 2025-11-06 22:11:47 UTC
Created attachment 189235 [details] [review]
Bug 39224: add Koha object models for shibboleth configuration

Add Koha::ShibbolethConfig and Koha::ShibbolethFieldMapping classes
to manage Shibboleth configuration stored in the database.
Comment 4 Jacob O'Mara 2025-11-06 22:11:50 UTC
Created attachment 189236 [details] [review]
Bug 39224: add REST API endpoints for shibboleth configuration

Add API endpoints for managing Shibboleth configuration:
- GET/PUT /api/v1/shibboleth/config
- GET/POST /api/v1/shibboleth/mappings
- GET/PUT/DELETE /api/v1/shibboleth/mappings/{mapping_id}
Comment 5 Jacob O'Mara 2025-11-06 22:11:52 UTC
Created attachment 189237 [details] [review]
Bug 39224: integrate database-backed shibboleth configuration

Update authentication code to read Shibboleth configuration from
database instead of koha-conf.xml. Add get_force_sso_setting function
to retrieve SSO settings from database.
Comment 6 Jacob O'Mara 2025-11-06 22:11:54 UTC
Created attachment 189238 [details] [review]
Bug 39224: add Vue UI for shibboleth configuration

Add staff interface pages for managing Shibboleth configuration
including settings and field mappings. Includes API client, Vue
components, store, and routes.
Comment 7 Jacob O'Mara 2025-11-06 22:11:56 UTC
Created attachment 189239 [details] [review]
Bug 39224: integrate shibboleth UI into staff interface

Add menu entry, configure build system, and set up routing for
Shibboleth configuration interface.
Comment 8 Jacob O'Mara 2025-11-06 22:11:58 UTC
Created attachment 189240 [details] [review]
Bug 39224: add comprehensive tests for shibboleth configuration

Add tests for:
- Koha object models (ShibbolethConfig, ShibbolethFieldMapping)
- REST API endpoints
- Database migration from XML config
Comment 9 Jacob O'Mara 2025-11-06 22:12:00 UTC
Created attachment 189241 [details] [review]
Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication

- Remove OPACShibOnly and staffShibOnly sysprefs (now in
shibboleth_config table)
- Add ShibbolethAuthentication syspref to replace useshibboleth XML
config
- Update to check syspref instead of XML
- Only show Shibboleth configuration link when ShibbolethAuthentication
is enabled
Comment 10 Jacob O'Mara 2025-11-06 22:12:03 UTC
Created attachment 189242 [details] [review]
Bug 39224: DBIC - DO NOT PUSH
Comment 11 Jacob O'Mara 2025-11-06 22:12:05 UTC
Created attachment 189243 [details] [review]
Bug 39224: add is_boolean definitions for shibboleth tables to schema

This applies to controllers:
- ShibolethConfig
  - sync
  - welcome
  - autocreate
  - force{opac/staff}sso
- ShibbolethFieldMapping
  - is_matchpoint
Comment 12 Jacob O'Mara 2025-11-06 22:12:07 UTC
Created attachment 189244 [details] [review]
Bug 39224: show warning for required fields when autocreate is enabled
Comment 13 Jacob O'Mara 2025-11-06 23:57:58 UTC
To make the testing of this a bit easier (since SSO is a pain in the ass) I've written an improvement to the koha-testing docker (that requires this branch) that incidentally should also make testing this branch a bit easier. If you boot up a ktd instance with `ktd --localrun --sso up` while on this branch: https://github.com/Jacobomara901/koha-testing-docker/tree/sso-but-better it will boot up a keycloak instance with the realm already configured to koha. It will also enable Shibboleth in koha, turn on sync and autocreate and also configure all of the mappings in koha that are currently configured in keycloak. 

If you want to log in as an admin to keycloak to check, head to localhost:8082 as usual with the login details keycloak:keycloak

for logging in to koha via this sso setup, use the credentials kohadev:kohadev (or set up your own in the keycloak admin panel)

Obviously this has no ssl and Koha is hard coded in auth_with_shibboleth.pm to use https, so you'll need to change the code here to http instead for the _get_uri() sub.

The above work will be upstreamed to the koha-testing-docker repo once this bug has been pushed to main

Thanks in advance