Bug 8446 - Shibboleth authentication
Summary: Shibboleth authentication
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low new feature (vote)
Assignee: Martin Renvoize
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 12680 12681 12682 20266 12026 12027 13114 13569 17776 18507
  Show dependency treegraph
 
Reported: 2012-07-14 10:28 UTC by Tom Francart
Modified: 2018-09-28 09:17 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Shibboleth patch for Auth.pm on Koha 3.8 (3.43 KB, patch)
2012-07-14 10:28 UTC, Tom Francart
Details | Diff | Splinter Review
Matthias's work, rebased on master (16.36 KB, patch)
2013-10-20 18:55 UTC, Martin Renvoize
Details | Diff | Splinter Review
Matthias's work, rebased upon master (16.43 KB, patch)
2013-10-20 20:38 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (16.53 KB, patch)
2013-11-11 14:40 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 8446: Ensure user is returned to requested page after auth (1.09 KB, patch)
2013-11-29 14:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (16.47 KB, patch)
2013-11-29 14:38 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.00 KB, patch)
2013-11-29 14:38 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (16.21 KB, patch)
2014-03-03 14:00 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.34 KB, patch)
2014-03-03 14:00 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (15.80 KB, patch)
2014-03-12 13:42 UTC, Jesse Weaver
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.38 KB, patch)
2014-03-12 13:42 UTC, Jesse Weaver
Details | Diff | Splinter Review
Bug 8446 - Followup: Remove unnecessary sysprefs, move to config (11.16 KB, patch)
2014-03-12 13:42 UTC, Jesse Weaver
Details | Diff | Splinter Review
[SIGNED OFF] Bug 8446 - Followup: Remove unnecessary sysprefs, move to config (11.24 KB, patch)
2014-03-12 14:55 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.82 KB, patch)
2014-04-02 08:01 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.40 KB, patch)
2014-04-02 08:01 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.20 KB, patch)
2014-04-02 08:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (13.34 KB, patch)
2014-04-02 08:03 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (13.36 KB, patch)
2014-04-02 12:38 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch)
2014-04-02 12:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch)
2014-04-02 12:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (15.81 KB, patch)
2014-06-17 13:28 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch)
2014-06-17 13:28 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.19 KB, patch)
2014-06-17 13:28 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (13.10 KB, patch)
2014-06-17 13:28 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch)
2014-06-17 13:28 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch)
2014-06-17 13:28 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.82 KB, patch)
2014-06-17 13:32 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.40 KB, patch)
2014-06-17 13:32 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.20 KB, patch)
2014-06-17 13:32 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (13.10 KB, patch)
2014-06-17 13:32 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch)
2014-06-17 13:32 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch)
2014-06-17 13:32 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (15.81 KB, patch)
2014-07-24 10:57 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch)
2014-07-24 10:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.19 KB, patch)
2014-07-24 10:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (13.10 KB, patch)
2014-07-24 10:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch)
2014-07-24 10:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch)
2014-07-24 10:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Implimented single sign out (3.33 KB, patch)
2014-07-24 10:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Fixed bootstrap login via modal (2.86 KB, patch)
2014-07-24 14:33 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Add template rules for Shibboleth and CAS (5.53 KB, patch)
2014-07-24 14:33 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Added default config to config file (1.04 KB, patch)
2014-07-24 14:57 UTC, Martin Renvoize
Details | Diff | Splinter Review
MT8122: Adds Shibboleth authentication (15.81 KB, patch)
2014-07-29 14:06 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch)
2014-07-29 14:06 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.23 KB, patch)
2014-07-29 14:06 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (23.79 KB, patch)
2014-07-29 14:07 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (31.84 KB, patch)
2014-07-30 13:48 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.81 KB, patch)
2014-07-30 20:21 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch)
2014-07-30 20:21 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.23 KB, patch)
2014-07-30 20:22 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (31.95 KB, patch)
2014-07-30 20:22 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Improve local login fallback (32.01 KB, patch)
2014-07-31 09:20 UTC, Matthias Meusburger
Details | Diff | Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (5.59 KB, patch)
2014-08-07 18:57 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (6.33 KB, patch)
2014-08-07 23:00 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, followup: Add Unit Tests (5.71 KB, patch)
2014-08-07 23:00 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.80 KB, patch)
2014-08-08 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.47 KB, patch)
2014-08-08 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.31 KB, patch)
2014-08-08 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED OFF] BUG8446, Follow up: Improve local login fallback (32.03 KB, patch)
2014-08-08 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (6.33 KB, patch)
2014-08-08 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, followup: Add Unit Tests (5.70 KB, patch)
2014-08-08 11:12 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, followup: Add Unit Tests (6.22 KB, patch)
2014-08-11 08:53 UTC, Martin Renvoize
Details | Diff | Splinter Review
[SIGNED-OFF] BUG8446, Follow up: Refactor to clean up bad practice (6.40 KB, patch)
2014-09-05 15:08 UTC, Matthias Meusburger
Details | Diff | Splinter Review
[SIGNED-OFF] BUG8446, followup: Add Unit Tests (6.29 KB, patch)
2014-09-05 15:08 UTC, Matthias Meusburger
Details | Diff | Splinter Review
BUG8446, qa-followup: Cleanup tabs and license (9.39 KB, patch)
2014-09-23 13:58 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Cleanup tabs and license (9.39 KB, patch)
2014-09-29 08:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Minor Code Tidies (1.71 KB, patch)
2014-09-29 08:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Use DBIx::Class (1.61 KB, patch)
2014-09-29 08:02 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Use DBIx::Class (7.13 KB, patch)
2014-10-10 08:29 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies (923 bytes, patch)
2014-10-10 14:42 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] BUG8446, Follow up: Adds Shibboleth authentication (2.77 KB, patch)
2014-10-10 15:05 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.36 KB, patch)
2014-10-10 15:06 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, Follow up: Improve local login fallback (32.07 KB, patch)
2014-10-10 15:06 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, Follow up: Refactor to clean up bad practice (6.47 KB, patch)
2014-10-10 15:07 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, followup: Add Unit Tests (6.35 KB, patch)
2014-10-10 15:08 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, QA Followup: Cleanup tabs and license (9.45 KB, patch)
2014-10-10 15:08 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, QA Followup: Minor Code Tidies (1.76 KB, patch)
2014-10-10 15:09 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, QA Followup: Use DBIx::Class (7.20 KB, patch)
2014-10-10 15:09 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] BUG8446, QA Followup: Add Test::DBIx::Class to dependancies (1.05 KB, patch)
2014-10-10 15:09 UTC, Katrin Fischer
Details | Diff | Splinter Review
BUG8446: Adds Shibboleth authentication (16.17 KB, patch)
2014-10-15 16:22 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.51 KB, patch)
2014-10-15 16:22 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.35 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Improve local login fallback (32.07 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (6.46 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, Follow up: Add Unit Tests (6.34 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Cleanup tabs and license (9.44 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Minor Code Tidies (1.76 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Use DBIx::Class (7.19 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies (1.05 KB, patch)
2014-10-15 16:23 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 8446: (qa followup) Tests should be conditional on Test::DBIx::Class (1.94 KB, patch)
2014-10-16 15:34 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 8446: (qa followup) Patch reintroduces SolR stuff (1.08 KB, patch)
2014-10-16 15:36 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Tom Francart 2012-07-14 10:28:59 UTC Comment hidden (obsolete)
Comment 1 Tomás Cohen Arazi 2012-07-17 13:39:20 UTC
What do u think the workflow for Shibboleth integration should be?
It looks you are assuming the user has logued in in another tab in the browser.
Maybe it should be better integrated. Also, how does a shibboleth user relates to a koha user? (has your Shibboleth implementation direct access to the Koha DB?)

I'd like to have this integration too, ence the questions.
Comment 2 Tom Francart 2012-07-17 13:45:02 UTC
(In reply to comment #1)
> What do u think the workflow for Shibboleth integration should be?
> It looks you are assuming the user has logued in in another tab in the
> browser.

I'm using .htaccess files, e.g.:

AuthType shibboleth
ShibRequireSession On
require KULouNumber 50000672


> Maybe it should be better integrated. Also, how does a shibboleth user
> relates to a koha user? (has your Shibboleth implementation direct access to
> the Koha DB?)

A new Koha user is added when the shibboleth user is not found in the Koha database (see patch)
Comment 3 Matthias Meusburger 2013-03-19 13:37:15 UTC
Hi, we also made a Shibboleth implementation for koha, you can have a look at it here:

http://git.biblibre.com/?p=koha;a=commit;h=b5257f7235a7cbad396d1a4036101ba6a0903ecb

Our implementation may be more generic in that:

  - you can enable/disable Shibboleth authentication.
  - you can choose which shibboleth attribute will match the koha login, with a syspref.
  - Shibboleth authentication is shown at OPAC when enabled, so users can connect through Shibboleth directly from Koha.


On the other hand, your implementation creates users when they don't exist in koha, and our does not. Our implementation also do not use other Shibboleth attributes than the one used for authentication.
Comment 4 Martin Renvoize 2013-07-11 14:10:03 UTC
I'm interested in testing either/both of these patches, and have grabbed a copy of Matthias's code for a start and rebased it onto 3.12 (I don't think it would be too difficult to rebase onto master, but 3.12 was what I had to hand).

Could one of your put up a test plan please, including any apache steps you've undertaken?

Cheers
Comment 5 Pete 2013-10-01 03:52:16 UTC
Martin, have you made any headway on shib in 3.12?  We're also hoping to get this running.  Thanks!

-Pete

(In reply to Martin Renvoize from comment #4)
> I'm interested in testing either/both of these patches, and have grabbed a
> copy of Matthias's code for a start and rebased it onto 3.12 (I don't think
> it would be too difficult to rebase onto master, but 3.12 was what I had to
> hand).
> 
> Could one of your put up a test plan please, including any apache steps
> you've undertaken?
> 
> Cheers
Comment 6 Martin Renvoize 2013-10-02 07:58:47 UTC
Hi Pete,

You have good timing, I've made lots of headway and am hoping to submit the patches soon.

I've based my work mostly upon the work done by Matthias linked to above, with a few additions inspired by Tom's work.

The biggest barrier to entry on this is understanding how shibboleth all fits together and how to test it so I'm currently writing a test plan with such instructions.
Comment 7 Martin Renvoize 2013-10-20 17:10:27 UTC
OK.. as an update from kohacon13 hackfest.

My aim is to rebase Matthias's git branch to apply to master and post his work up as a squashed patch that I'll have signed off.

I'll then add a full testplan (including a guide to the difficult bit of setting up the shibboleth apache modules and shibd deamon and metadata exchange)

Hopefully, I'll then be able to poke a few people into testing against our test shibboleth IdP to add additional signoffs...

Watch this space.
Comment 8 Martin Renvoize 2013-10-20 18:55:53 UTC Comment hidden (obsolete)
Comment 9 Martin Renvoize 2013-10-20 19:14:12 UTC
The promised test plan...

First up, you'll need to install some additional debian packages:

1. Install shibboleth deamon and apache shibboleth module (Testing upon Debian 7.1 is best, as packages are updated and simpler to configure)

    sudo apt-get install libapache2-mod-shib2 libshibsp5:amd64 shibboleth-sp2-schemas


2. Configure shibboleth 'party of trust' arrangement (i.e. trade metadata keys with your IdP.. see next comment for details)

3. Configure shibboleth attribute mapping (see next comment for further details)

4. Configure OPAC Virtualhost to enable shibboleth authentication (add the foloowing to your virtualhost)

   <Location />
      AuthType shibboleth
      Require shibboleth
   </Location>

Note: The above will enable shibboleth authentication with a fallback to local (or CAS, or LDAP, or Persona).. you can adapt this to enable Shibboleth only if you like

5. You should have some now options in the staff client under 'Administration > System Preferences >  Shibboleth Authentication'. Enable 'Shibboleth Authentication' and set the 'login attribute' to match what you setup in step 3.

6. Test login in the OPAC.  You should either be logged in directly (if you are already logged into your IdP by some other means) or when clicking 'Login' you should see the option to login via Shibboleth which will redirect you to your IdP for authentication.
Comment 10 Martin Renvoize 2013-10-20 20:03:23 UTC
So.... the most complicated bit of all this (as you may have guessed) is actually in steps 2. and 3. above!

Step 2 - Configuring Shibboleth party of trust.

Shibboleth config files should be located at: /etc/shibboleth

The important files are:
   shibboleth2.xml - The main config file
   attribute-map.xml - The attribute mapping file

You will also want to create a directory to keep IdP metadata backups within:
   mkdir /var/cache/shibboleth/metadata/
   chown -r _shibd:_shibd /var/shibboleth/metadata

Let's configure some things:

1. First up, we need to setup the SP (Service Provider) identity.

In the shibboleth2.xml file you should find a line similar to:

  <ApplicationDefaults entityID="https://kohaopac.mytestserver.com"

Modify this so that the 'entityID' matches your OPAC URL.

2. Next, we need to tell the shibboleth daemon where the IdP (identity provider) is.

In the shibboleth2.xml file you should find a block similar to:

    <SSO entityID="http://sso.testidentityprovider.com/auth/metadata">
        SAML2 SAML1
    </SSO>

Modify this so that the entityID matches the IdP's sign in URL.

3. Finally, you'll need to tell the daemon where to fetch the IdP's metadata from and set a backup path:

In the shibboleth2.xml file you should find a block similar to:

     <MetadataProvider type="XML" uri="https://sso.testidentityprovider.com/auth/metadata"
               backingFilePath="/var/cache/shibboleth/metadata/testidp-metadata.xml"
               reloadInterval="7200" >
     </MetadataProvider>

Modify this so that the uri matches the IdP's public metadata page, and point the backingFilePath to the directory we created.

4. The config is now done... but you should create some keys to work with your shibboleth SP:

    sudo openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -out server.crt

Your key and certicate names will obviously need to match those in the shibboleth2.xml config file.

5. Restart the shibd daemon:

   sudo /etc/init.d/shibd restart

6. We're about ready to swap Matadata:  Tell you're IdP provider that your Metadata is available at:

    https://youropacurl.com/Shibboleth.sso/Metadata
Comment 11 Martin Renvoize 2013-10-20 20:38:47 UTC Comment hidden (obsolete)
Comment 12 Matthias Meusburger 2013-11-07 14:22:21 UTC
Hello,

Thanks Matin, for rebasing my patch, and providing a test plan :)

One thing though, using $ENV{'SERVER_NAME'} is not such a good idea imho, because it won't work if koha is behind a reverse proxy.
Comment 13 Martin Renvoize 2013-11-08 09:08:59 UTC
Hmm, I hadn't thought of the reverse proxy case.. have you run up against this problem?

I assume using the OPACBaseURL syspref instead is a better approach?
Comment 14 Martin Renvoize 2013-11-11 14:40:49 UTC Comment hidden (obsolete)
Comment 15 Martin Renvoize 2013-11-11 14:43:28 UTC
As suggested by Matthias I have updated the patch to use C4::Context->preference('OPACBaseURL') in place of $ENV{SERVER_NAME} within the Auth_with_Shibboleth script.

This seems to work in my testing, though I didn't know how to reproduce the issue Matthias highlights so couldn't test that it actually fixes the issue.

Setting back to 'Needs Signoff'
Comment 16 Martin Renvoize 2013-11-29 14:02:57 UTC Comment hidden (obsolete)
Comment 17 Martin Renvoize 2013-11-29 14:38:35 UTC Comment hidden (obsolete)
Comment 18 Martin Renvoize 2013-11-29 14:38:48 UTC Comment hidden (obsolete)
Comment 19 Martin Renvoize 2013-11-29 14:40:58 UTC
Re-based upon master and re-squashed the commits to better reflect their authors.

First patch is all Matthias's work, and second patch are my two follow up fixes to that work.

Hope we can find someone to test this, I'd love to see it in community.
Comment 20 Martin Renvoize 2014-03-03 14:00:21 UTC Comment hidden (obsolete)
Comment 21 Martin Renvoize 2014-03-03 14:00:28 UTC Comment hidden (obsolete)
Comment 22 Martin Renvoize 2014-03-03 14:03:14 UTC
Rebased upon master and added a follow-up to remove unused imports from Auth_with_shibboleth.pm
Comment 23 Jesse Weaver 2014-03-12 13:42:09 UTC Comment hidden (obsolete)
Comment 24 Jesse Weaver 2014-03-12 13:42:18 UTC Comment hidden (obsolete)
Comment 25 Jesse Weaver 2014-03-12 13:42:30 UTC Comment hidden (obsolete)
Comment 26 Martin Renvoize 2014-03-12 14:55:49 UTC Comment hidden (obsolete)
Comment 27 Martin Renvoize 2014-03-12 14:57:16 UTC
Cheers Jesse, 

All sensible changes and some neatening of the code.  This is deffinitely somthing that should be based in config as apposed to sysprefs so very happy you've implimented that.

Lets hope we can get QA on this now ;)
Comment 28 Martin Renvoize 2014-04-02 08:01:41 UTC Comment hidden (obsolete)
Comment 29 Martin Renvoize 2014-04-02 08:01:56 UTC Comment hidden (obsolete)
Comment 30 Martin Renvoize 2014-04-02 08:02:15 UTC Comment hidden (obsolete)
Comment 31 Martin Renvoize 2014-04-02 08:03:35 UTC Comment hidden (obsolete)
Comment 32 Martin Renvoize 2014-04-02 08:06:58 UTC
Some follow-up work to allow better error handling when a shibboleth session exists but does not match a koha user, and allow for shibboleth login from the front page in bootstrap should you not already be logged in.

I've also added the beginnings of a perldoc to the Auth_with_shibboleth.pm module to guide configuration.
Comment 33 Martin Renvoize 2014-04-02 12:38:45 UTC Comment hidden (obsolete)
Comment 34 Martin Renvoize 2014-04-02 12:41:15 UTC
I have a work in progress branch for all things shib related available at: https://github.com/PTFS-Europe/koha/tree/bug_8466-shibboleth

I intend so add some new bugs in the coming days to enhance upon this base.
Comment 35 Martin Renvoize 2014-04-02 12:44:02 UTC Comment hidden (obsolete)
Comment 36 Martin Renvoize 2014-04-02 12:44:10 UTC Comment hidden (obsolete)
Comment 37 David Cook 2014-05-14 00:44:57 UTC
Really interested by this one, but don't think I have any way of testing it...
Comment 38 Martin Renvoize 2014-05-14 07:37:10 UTC
I can walk you through testing if your willing... 

There an open IdP, https://openidp.feide.no/, in germany that allows registering of accounts for testing service providers.  It'll give you a login to koha via your google identity through feide's idp service.

Shout on IRC if you want some guidance on how to work through it, but we're now at a point where most of it is documented and feide provide the ability to test, and I'd love to get someone's opinion on what doc I've written so far.
Comment 39 Martin Renvoize 2014-06-17 13:28:33 UTC Comment hidden (obsolete)
Comment 40 Martin Renvoize 2014-06-17 13:28:37 UTC Comment hidden (obsolete)
Comment 41 Martin Renvoize 2014-06-17 13:28:40 UTC Comment hidden (obsolete)
Comment 42 Martin Renvoize 2014-06-17 13:28:44 UTC Comment hidden (obsolete)
Comment 43 Martin Renvoize 2014-06-17 13:28:47 UTC Comment hidden (obsolete)
Comment 44 Martin Renvoize 2014-06-17 13:28:50 UTC Comment hidden (obsolete)
Comment 45 Martin Renvoize 2014-06-17 13:32:24 UTC Comment hidden (obsolete)
Comment 46 Martin Renvoize 2014-06-17 13:32:29 UTC Comment hidden (obsolete)
Comment 47 Martin Renvoize 2014-06-17 13:32:34 UTC Comment hidden (obsolete)
Comment 48 Martin Renvoize 2014-06-17 13:32:38 UTC Comment hidden (obsolete)
Comment 49 Martin Renvoize 2014-06-17 13:32:42 UTC Comment hidden (obsolete)
Comment 50 Martin Renvoize 2014-06-17 13:32:45 UTC Comment hidden (obsolete)
Comment 51 Martin Renvoize 2014-07-24 10:57:52 UTC Comment hidden (obsolete)
Comment 52 Martin Renvoize 2014-07-24 10:58:05 UTC Comment hidden (obsolete)
Comment 53 Martin Renvoize 2014-07-24 10:58:13 UTC Comment hidden (obsolete)
Comment 54 Martin Renvoize 2014-07-24 10:58:23 UTC Comment hidden (obsolete)
Comment 55 Martin Renvoize 2014-07-24 10:58:29 UTC Comment hidden (obsolete)
Comment 56 Martin Renvoize 2014-07-24 10:58:35 UTC Comment hidden (obsolete)
Comment 57 Martin Renvoize 2014-07-24 10:58:43 UTC Comment hidden (obsolete)
Comment 58 Martin Renvoize 2014-07-24 11:04:19 UTC
As discussed with Thomas and Katrin I've now tracking this patch set in my public github repository and keeping it rebased appropriately.

The latest version of the patch will laways be available at: https://github.com/mrenvoize/Koha/tree/bug_8446

This is basically to make it easier to apply, as not wanting to loose attribution means that squashing the patches to prevent merge conflicts with updatedatabase would be 'bad'.
Comment 59 Katrin Fischer 2014-07-24 12:36:06 UTC
Finally got this working with Martin's help! Woohooo!

Some first remarks:
- The link to log in with Shibboleth seems to only appear on the start page, but not for example on the result list.
- It would be nice if Shib login also directed you to the patron account, like the normal login does. But maybe it's safer to always redirect to the place the user started from - in case someone logged in to place a hold or similar.

Tested ok:

From start page:
- OK Shib login with correct username/password
- OK Shib logout with correct username/password
- OK Koha login
- OK Koha logout
Comment 60 Martin Renvoize 2014-07-24 14:33:30 UTC Comment hidden (obsolete)
Comment 61 Martin Renvoize 2014-07-24 14:33:37 UTC Comment hidden (obsolete)
Comment 62 Martin Renvoize 2014-07-24 14:34:09 UTC
Two QA followups
Comment 63 Martin Renvoize 2014-07-24 14:57:52 UTC Comment hidden (obsolete)
Comment 64 Martin Renvoize 2014-07-29 14:06:16 UTC Comment hidden (obsolete)
Comment 65 Martin Renvoize 2014-07-29 14:06:35 UTC Comment hidden (obsolete)
Comment 66 Martin Renvoize 2014-07-29 14:06:48 UTC Comment hidden (obsolete)
Comment 67 Martin Renvoize 2014-07-29 14:07:07 UTC Comment hidden (obsolete)
Comment 68 Matthias Meusburger 2014-07-30 10:38:07 UTC
Tested ok : 

 - CAS and Shibboleth template coexistence (even though login won't work because of the OPACBaseURL protocol issue, but that is another problem, see bug 12398 and bug 7770).
 - Shib login / logout (with single sign out)
 - koha login / logout
Comment 69 Martin Renvoize 2014-07-30 13:48:50 UTC Comment hidden (obsolete)
Comment 70 Martin Renvoize 2014-07-30 20:21:51 UTC Comment hidden (obsolete)
Comment 71 Martin Renvoize 2014-07-30 20:21:59 UTC Comment hidden (obsolete)
Comment 72 Martin Renvoize 2014-07-30 20:22:05 UTC Comment hidden (obsolete)
Comment 73 Martin Renvoize 2014-07-30 20:22:12 UTC Comment hidden (obsolete)
Comment 74 Martin Renvoize 2014-07-30 20:32:59 UTC
Right.. I think we're finally there guys!

This last update to the final patch takes care of a configuration issue Matthias spotted whereby the config would be parsed incorrectly.

To enable forward compatibility with bug 12026 (preventing us having to handle a nasty breaking config change when pushing that patch) and to bring the config in line with that of the way the ldap config currently works the minimum xml required has changed from:

<usesshibboleth>1</usesshibboleth>
<shibboleth>
  <matchpoint>userid</matchpoint>
  <mapping>
    <userid>uid</userid>
  </mapping>
</shibboleth>

to:

<usesshibboleth>1</usesshibboleth>
<shibboleth>
  <matchpoint>userid</matchpoint>
  <mapping>
    <userid is="uid"></userid>
  </mapping>
</shibboleth>

I'm told this is more 'standard' amongst this kind of xml based mapping file and am happy going with it.

It also allows for a future form to look like the below without breaking compatibility:

<usesshibboleth>1</usesshibboleth>
<shibboleth>
  <matchpoint>userid</matchpoint>
  <mapping>
    <userid is="uid" regex="s/@school.ac.uk//g"></userid>
    <firstname is="fn">default</firstname>
  </mapping>
</shibboleth>

The above will hopefully give you a brief glimpse into what I'm thinking for enhancing bug 12026 once this is pushed.

Cheers for everyone efforts so far!
Comment 75 Matthias Meusburger 2014-07-31 09:15:00 UTC
Tested ok.
Comment 76 Matthias Meusburger 2014-07-31 09:20:38 UTC Comment hidden (obsolete)
Comment 77 Katrin Fischer 2014-07-31 09:24:57 UTC
Hi Matthias, can you add your sign off line to the other patches too please? And thx for signing off!
Comment 78 Martin Renvoize 2014-08-07 18:57:17 UTC Comment hidden (obsolete)
Comment 79 Martin Renvoize 2014-08-07 23:00:39 UTC Comment hidden (obsolete)
Comment 80 Martin Renvoize 2014-08-07 23:00:45 UTC Comment hidden (obsolete)
Comment 81 Martin Renvoize 2014-08-07 23:03:55 UTC
So, those last two patches are in need of signoff.

The first one does some much needed re-factoring of the original code to meet better (but still not best) practice ;)

The latter are some basic unit tests covering a fair range of the routines so far which will be needed at QA.
Comment 82 Paola Rossi 2014-08-08 09:07:46 UTC
I've tried to apply the patches today against 3.17.00.013

Applying: MT8122: Adds Shibboleth authentication
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Auto-merging opac/opac-user.pl
Auto-merging installer/data/mysql/updatedatabase.pl
CONFLICT (content): Merge conflict in installer/data/mysql/updatedatabase.pl
Auto-merging C4/Auth.pm
Failed to merge in the changes.
Patch failed at 0001 MT8122: Adds Shibboleth authentication

So I pass the patch to "Patch doesn't apply" status.
Comment 83 Martin Renvoize 2014-08-08 11:12:02 UTC Comment hidden (obsolete)
Comment 84 Martin Renvoize 2014-08-08 11:12:09 UTC Comment hidden (obsolete)
Comment 85 Martin Renvoize 2014-08-08 11:12:17 UTC Comment hidden (obsolete)
Comment 86 Martin Renvoize 2014-08-08 11:12:26 UTC Comment hidden (obsolete)
Comment 87 Martin Renvoize 2014-08-08 11:12:32 UTC Comment hidden (obsolete)
Comment 88 Martin Renvoize 2014-08-08 11:12:39 UTC Comment hidden (obsolete)
Comment 89 Martin Renvoize 2014-08-08 11:15:22 UTC
Rebased again..

It's only a db change that is causing this conflict every time.. and said db change is backed out in a later patch in the series anyway. (It's only for attribution for Matthias that it's still there at all).

I have however got a tracking github branch which I've suggested people use for testing.. this branch is re-based nightly against master.

As for testing.. give me a shout if you need any help with the config.. it's the config outside of koha which is hardest to setup.
Comment 90 Martin Renvoize 2014-08-11 08:53:42 UTC Comment hidden (obsolete)
Comment 91 Zeno Tajoli 2014-08-22 18:54:15 UTC
There is a site that seems useful to test the patch:
http://testshib.org/index.html

But is not clear to me if it is possible to use it as IdP and my Koha install as Service Provider.

For example, do you undestand how to create a user/pwd in the IdP of http://testshib.org/ ?

Probably it is possible to use also this test service:
https://openidp.feide.no/.
But probably is better to be Norse.
Comment 92 Martin Renvoize 2014-08-26 15:17:27 UTC
Hi Zeno, 

I'm pretty sure you can use testshib, and can verify you can definitely use fiede as that's what I used for allot of my own testing.

The instructions on both sites seem pretty clear, but do let me know if you have any issues.

Martin
Comment 93 Matthias Meusburger 2014-09-05 15:08:02 UTC Comment hidden (obsolete)
Comment 94 Matthias Meusburger 2014-09-05 15:08:48 UTC Comment hidden (obsolete)
Comment 95 Martin Renvoize 2014-09-23 13:58:06 UTC Comment hidden (obsolete)
Comment 96 Martin Renvoize 2014-09-29 08:02:23 UTC Comment hidden (obsolete)
Comment 97 Martin Renvoize 2014-09-29 08:02:26 UTC Comment hidden (obsolete)
Comment 98 Martin Renvoize 2014-09-29 08:02:30 UTC Comment hidden (obsolete)
Comment 99 Katrin Fischer 2014-10-09 18:59:15 UTC
Setting this to failed for now - Martin is working on a follow-up for the tests as I ran into some problems running them.
Comment 100 Martin Renvoize 2014-10-10 07:16:08 UTC
:(

It seems that mocking the database with DBD::Mock when using DBIx::Class is simply incompatible (DBIx::Class just complains about an unrecognised DBI driver, then proceeds to drop back to some default SQL and fails badly)

I've been looking into alternatives, like Test::DBIx::Class (which is a module to create an in memory sql database to test against, but this route requires lots of work manually creating dummy data to test against). I then tried DBIx::Class::Sims (which is a module to automatically fill tables with randomly generated dummy data, but this approach also fails because our database schema has a large number of cyclic relationships and the Sims module doesn't cope with this well)

Interesting enough, the problem I'm facing (Not wanting to have to populate the whole structure of a Borrowers Row and satisfy all constraints manually) is basically solved by the TestBuilder module we recently decided not to adopt!

I'll keep battling with it, but I have a feeling the Test size will have to jump substantially as I add all the releated data in a transaction.  It shouldn't be this Hard!

Martin
Comment 101 Martin Renvoize 2014-10-10 08:29:29 UTC Comment hidden (obsolete)
Comment 102 Martin Renvoize 2014-10-10 08:38:39 UTC
Fixed!
Comment 103 Martin Renvoize 2014-10-10 14:42:56 UTC Comment hidden (obsolete)
Comment 104 Katrin Fischer 2014-10-10 15:05:49 UTC Comment hidden (obsolete)
Comment 105 Katrin Fischer 2014-10-10 15:06:32 UTC Comment hidden (obsolete)
Comment 106 Katrin Fischer 2014-10-10 15:06:40 UTC Comment hidden (obsolete)
Comment 107 Katrin Fischer 2014-10-10 15:07:22 UTC Comment hidden (obsolete)
Comment 108 Katrin Fischer 2014-10-10 15:08:00 UTC Comment hidden (obsolete)
Comment 109 Katrin Fischer 2014-10-10 15:08:48 UTC Comment hidden (obsolete)
Comment 110 Katrin Fischer 2014-10-10 15:09:39 UTC Comment hidden (obsolete)
Comment 111 Katrin Fischer 2014-10-10 15:09:47 UTC Comment hidden (obsolete)
Comment 112 Katrin Fischer 2014-10-10 15:09:55 UTC Comment hidden (obsolete)
Comment 113 Martin Renvoize 2014-10-15 16:22:46 UTC
Created attachment 32365 [details] [review]
BUG8446: Adds Shibboleth authentication

 - Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

BUG8446, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

BUG8446, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

BUG8446, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

BUG8446, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

BUG8446, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested with the feide idp.
- LDAP login and logout are working
- local login/logout are still working
- CAS login/logout are still working

Instructions for setup can be found on the wiki:
http://wiki.koha-community.org/wiki/Shibboleth_Configuration
Comment 114 Martin Renvoize 2014-10-15 16:22:53 UTC
Created attachment 32366 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 115 Martin Renvoize 2014-10-15 16:23:00 UTC
Created attachment 32367 [details] [review]
BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 116 Martin Renvoize 2014-10-15 16:23:08 UTC
Created attachment 32368 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implemented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implemented single sign out

- This follow up rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implemented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implementation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template rules so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embellished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

BUG8446, Follow up: Enable configuration of match field

- Added clearer, more flexible, configuration of shibboleth attribute to
  koha borrower field matching for authentication
- Correcting of documentation to make it more clear to the current
  implementation
- Minor refactoring of code to reduce some code duplication

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 117 Martin Renvoize 2014-10-15 16:23:15 UTC
Created attachment 32369 [details] [review]
BUG8446, Follow up: Refactor to clean up bad practice

- A number of issues were highlighted whilst writing sensible unit tests
  for this module.
  - Removed unnessesary call to context->new();
  - Global variables are BAD!
  - Croaking is a wimps way out, we should handle errors early and
    properly.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 118 Martin Renvoize 2014-10-15 16:23:19 UTC
Created attachment 32370 [details] [review]
BUG8446, Follow up: Add Unit Tests

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 119 Martin Renvoize 2014-10-15 16:23:25 UTC
Created attachment 32371 [details] [review]
BUG8446, QA Followup: Cleanup tabs and license

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 120 Martin Renvoize 2014-10-15 16:23:31 UTC
Created attachment 32372 [details] [review]
BUG8446, QA Followup: Minor Code Tidies

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 121 Martin Renvoize 2014-10-15 16:23:36 UTC
Created attachment 32373 [details] [review]
BUG8446, QA Followup: Use DBIx::Class

- Convert Auth_with_shibboleth to use dbic stanzas.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Comment 122 Martin Renvoize 2014-10-15 16:23:40 UTC
Created attachment 32374 [details] [review]
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies

- To correct tests after converting module to dbic, we need to add the
  Test::DBIx::Class module as a dependancy.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
The dependency will probably need to be packaged by us until
it can get into Debian proper.
Comment 123 Martin Renvoize 2014-10-15 16:26:54 UTC
Minor rebase (database change as usual in first patch, which is then removed in second patch anyway).

Added first patch back in to tree, as caits bz managed to nuke it during upload it seems.

Should apply fine again now ;)
Comment 124 Tomás Cohen Arazi 2014-10-16 15:34:45 UTC
Created attachment 32426 [details] [review]
Bug 8446: (qa followup) Tests should be conditional on Test::DBIx::Class

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Comment 125 Tomás Cohen Arazi 2014-10-16 15:36:07 UTC
Created attachment 32427 [details] [review]
Bug 8446: (qa followup) Patch reintroduces SolR stuff

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Comment 126 Tomás Cohen Arazi 2014-10-16 15:58:59 UTC
Feature pushed to master.

Thanks Matthias, Martin and Jesee!