8446 – Shibboleth authentication

Bug 8446 - Shibboleth authentication

Summary: Shibboleth authentication

Status:	CLOSED FIXED

Alias:	None

Product:	Koha
Classification:	Unclassified
Component:	Authentication (show other bugs)
Version:	Main
Hardware:	All All

Importance:	P5 - low new feature
Assignee:	Martin Renvoize (ashimema)
QA Contact:

URL:
Keywords:

Depends on:
Blocks:	12680 12681 12682 20266 12026 12027 13114 13569 17776 18507
	Show dependency tree / graph

Reported:	2012-07-14 10:28 UTC by Tom Francart
Modified:	2018-09-28 09:17 UTC (History)
CC List:	12 users (show)

See Also:	12547 5010
Change sponsored?:	---
Patch complexity:	---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Shibboleth patch for Auth.pm on Koha 3.8 (3.43 KB, patch) 2012-07-14 10:28 UTC, Tom Francart	Details \| Diff \| Splinter Review
Matthias's work, rebased on master (16.36 KB, patch) 2013-10-20 18:55 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
Matthias's work, rebased upon master (16.43 KB, patch) 2013-10-20 20:38 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (16.53 KB, patch) 2013-11-11 14:40 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
Bug 8446: Ensure user is returned to requested page after auth (1.09 KB, patch) 2013-11-29 14:02 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (16.47 KB, patch) 2013-11-29 14:38 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.00 KB, patch) 2013-11-29 14:38 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (16.21 KB, patch) 2014-03-03 14:00 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.34 KB, patch) 2014-03-03 14:00 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (15.80 KB, patch) 2014-03-12 13:42 UTC, Jesse Weaver	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.38 KB, patch) 2014-03-12 13:42 UTC, Jesse Weaver	Details \| Diff \| Splinter Review
Bug 8446 - Followup: Remove unnecessary sysprefs, move to config (11.16 KB, patch) 2014-03-12 13:42 UTC, Jesse Weaver	Details \| Diff \| Splinter Review
[SIGNED OFF] Bug 8446 - Followup: Remove unnecessary sysprefs, move to config (11.24 KB, patch) 2014-03-12 14:55 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.82 KB, patch) 2014-04-02 08:01 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.40 KB, patch) 2014-04-02 08:01 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.20 KB, patch) 2014-04-02 08:02 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (13.34 KB, patch) 2014-04-02 08:03 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (13.36 KB, patch) 2014-04-02 12:38 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch) 2014-04-02 12:44 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch) 2014-04-02 12:44 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (15.81 KB, patch) 2014-06-17 13:28 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch) 2014-06-17 13:28 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.19 KB, patch) 2014-06-17 13:28 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (13.10 KB, patch) 2014-06-17 13:28 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch) 2014-06-17 13:28 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch) 2014-06-17 13:28 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.82 KB, patch) 2014-06-17 13:32 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.40 KB, patch) 2014-06-17 13:32 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.20 KB, patch) 2014-06-17 13:32 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (13.10 KB, patch) 2014-06-17 13:32 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch) 2014-06-17 13:32 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch) 2014-06-17 13:32 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (15.81 KB, patch) 2014-07-24 10:57 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch) 2014-07-24 10:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (10.19 KB, patch) 2014-07-24 10:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (13.10 KB, patch) 2014-07-24 10:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct filenames to match guidlines (712 bytes, patch) 2014-07-24 10:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Correct paths after file rename (2.64 KB, patch) 2014-07-24 10:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Implimented single sign out (3.33 KB, patch) 2014-07-24 10:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Fixed bootstrap login via modal (2.86 KB, patch) 2014-07-24 14:33 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Add template rules for Shibboleth and CAS (5.53 KB, patch) 2014-07-24 14:33 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Added default config to config file (1.04 KB, patch) 2014-07-24 14:57 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
MT8122: Adds Shibboleth authentication (15.81 KB, patch) 2014-07-29 14:06 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch) 2014-07-29 14:06 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.23 KB, patch) 2014-07-29 14:06 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (23.79 KB, patch) 2014-07-29 14:07 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (31.84 KB, patch) 2014-07-30 13:48 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.81 KB, patch) 2014-07-30 20:21 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.39 KB, patch) 2014-07-30 20:21 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.23 KB, patch) 2014-07-30 20:22 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (31.95 KB, patch) 2014-07-30 20:22 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Improve local login fallback (32.01 KB, patch) 2014-07-31 09:20 UTC, Matthias Meusburger	Details \| Diff \| Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (5.59 KB, patch) 2014-08-07 18:57 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (6.33 KB, patch) 2014-08-07 23:00 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, followup: Add Unit Tests (5.71 KB, patch) 2014-08-07 23:00 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] MT8122: Adds Shibboleth authentication (15.80 KB, patch) 2014-08-08 11:12 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication (2.47 KB, patch) 2014-08-08 11:12 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.31 KB, patch) 2014-08-08 11:12 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED OFF] BUG8446, Follow up: Improve local login fallback (32.03 KB, patch) 2014-08-08 11:12 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (6.33 KB, patch) 2014-08-08 11:12 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, followup: Add Unit Tests (5.70 KB, patch) 2014-08-08 11:12 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, followup: Add Unit Tests (6.22 KB, patch) 2014-08-11 08:53 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[SIGNED-OFF] BUG8446, Follow up: Refactor to clean up bad practice (6.40 KB, patch) 2014-09-05 15:08 UTC, Matthias Meusburger	Details \| Diff \| Splinter Review
[SIGNED-OFF] BUG8446, followup: Add Unit Tests (6.29 KB, patch) 2014-09-05 15:08 UTC, Matthias Meusburger	Details \| Diff \| Splinter Review
BUG8446, qa-followup: Cleanup tabs and license (9.39 KB, patch) 2014-09-23 13:58 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Cleanup tabs and license (9.39 KB, patch) 2014-09-29 08:02 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Minor Code Tidies (1.71 KB, patch) 2014-09-29 08:02 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Use DBIx::Class (1.61 KB, patch) 2014-09-29 08:02 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Use DBIx::Class (7.13 KB, patch) 2014-10-10 08:29 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies (923 bytes, patch) 2014-10-10 14:42 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, Follow up: Adds Shibboleth authentication (2.77 KB, patch) 2014-10-10 15:05 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.36 KB, patch) 2014-10-10 15:06 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, Follow up: Improve local login fallback (32.07 KB, patch) 2014-10-10 15:06 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, Follow up: Refactor to clean up bad practice (6.47 KB, patch) 2014-10-10 15:07 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, followup: Add Unit Tests (6.35 KB, patch) 2014-10-10 15:08 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, QA Followup: Cleanup tabs and license (9.45 KB, patch) 2014-10-10 15:08 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, QA Followup: Minor Code Tidies (1.76 KB, patch) 2014-10-10 15:09 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, QA Followup: Use DBIx::Class (7.20 KB, patch) 2014-10-10 15:09 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
[PASSED QA] BUG8446, QA Followup: Add Test::DBIx::Class to dependancies (1.05 KB, patch) 2014-10-10 15:09 UTC, Katrin Fischer	Details \| Diff \| Splinter Review
BUG8446: Adds Shibboleth authentication (16.17 KB, patch) 2014-10-15 16:22 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Adds Shibboleth authentication (2.51 KB, patch) 2014-10-15 16:22 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Remove unnecessary sysprefs, move to config (11.35 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Improve local login fallback (32.07 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Refactor to clean up bad practice (6.46 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, Follow up: Add Unit Tests (6.34 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Cleanup tabs and license (9.44 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Minor Code Tidies (1.76 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Use DBIx::Class (7.19 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies (1.05 KB, patch) 2014-10-15 16:23 UTC, Martin Renvoize (ashimema)	Details \| Diff \| Splinter Review
Bug 8446: (qa followup) Tests should be conditional on Test::DBIx::Class (1.94 KB, patch) 2014-10-16 15:34 UTC, Tomás Cohen Arazi (tcohen)	Details \| Diff \| Splinter Review
Bug 8446: (qa followup) Patch reintroduces SolR stuff (1.08 KB, patch) 2014-10-16 15:36 UTC, Tomás Cohen Arazi (tcohen)	Details \| Diff \| Splinter Review
Show Obsolete (79) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Tom Francart 2012-07-14 10:28:59 UTC Comment hidden (obsolete)

Created attachment 10841 [details] [review]
Shibboleth patch for Auth.pm on Koha 3.8

I wrote rudimentary Shibboleth login support for Koha. It's quite
specific to our university and Koha setup, but should be easy to
modify. I hope someone finds it useful.

The attached patch can be applied to lib/C4/Auth.pm of Koha 3.8.2

Comment 1 Tomás Cohen Arazi (tcohen) 2012-07-17 13:39:20 UTC

What do u think the workflow for Shibboleth integration should be?
It looks you are assuming the user has logued in in another tab in the browser.
Maybe it should be better integrated. Also, how does a shibboleth user relates to a koha user? (has your Shibboleth implementation direct access to the Koha DB?)

I'd like to have this integration too, ence the questions.

Comment 2 Tom Francart 2012-07-17 13:45:02 UTC

(In reply to comment #1)
> What do u think the workflow for Shibboleth integration should be?
> It looks you are assuming the user has logued in in another tab in the
> browser.

I'm using .htaccess files, e.g.:

AuthType shibboleth
ShibRequireSession On
require KULouNumber 50000672


> Maybe it should be better integrated. Also, how does a shibboleth user
> relates to a koha user? (has your Shibboleth implementation direct access to
> the Koha DB?)

A new Koha user is added when the shibboleth user is not found in the Koha database (see patch)

Comment 3 Matthias Meusburger 2013-03-19 13:37:15 UTC

Hi, we also made a Shibboleth implementation for koha, you can have a look at it here:

http://git.biblibre.com/?p=koha;a=commit;h=b5257f7235a7cbad396d1a4036101ba6a0903ecb

Our implementation may be more generic in that:

  - you can enable/disable Shibboleth authentication.
  - you can choose which shibboleth attribute will match the koha login, with a syspref.
  - Shibboleth authentication is shown at OPAC when enabled, so users can connect through Shibboleth directly from Koha.


On the other hand, your implementation creates users when they don't exist in koha, and our does not. Our implementation also do not use other Shibboleth attributes than the one used for authentication.

Comment 4 Martin Renvoize (ashimema) 2013-07-11 14:10:03 UTC

I'm interested in testing either/both of these patches, and have grabbed a copy of Matthias's code for a start and rebased it onto 3.12 (I don't think it would be too difficult to rebase onto master, but 3.12 was what I had to hand).

Could one of your put up a test plan please, including any apache steps you've undertaken?

Cheers

Comment 5 Pete 2013-10-01 03:52:16 UTC

Martin, have you made any headway on shib in 3.12?  We're also hoping to get this running.  Thanks!

-Pete

(In reply to Martin Renvoize from comment #4)
> I'm interested in testing either/both of these patches, and have grabbed a
> copy of Matthias's code for a start and rebased it onto 3.12 (I don't think
> it would be too difficult to rebase onto master, but 3.12 was what I had to
> hand).
> 
> Could one of your put up a test plan please, including any apache steps
> you've undertaken?
> 
> Cheers

Comment 6 Martin Renvoize (ashimema) 2013-10-02 07:58:47 UTC

Hi Pete,

You have good timing, I've made lots of headway and am hoping to submit the patches soon.

I've based my work mostly upon the work done by Matthias linked to above, with a few additions inspired by Tom's work.

The biggest barrier to entry on this is understanding how shibboleth all fits together and how to test it so I'm currently writing a test plan with such instructions.

Comment 7 Martin Renvoize (ashimema) 2013-10-20 17:10:27 UTC

OK.. as an update from kohacon13 hackfest.

My aim is to rebase Matthias's git branch to apply to master and post his work up as a squashed patch that I'll have signed off.

I'll then add a full testplan (including a guide to the difficult bit of setting up the shibboleth apache modules and shibd deamon and metadata exchange)

Hopefully, I'll then be able to poke a few people into testing against our test shibboleth IdP to add additional signoffs...

Watch this space.

Comment 8 Martin Renvoize (ashimema) 2013-10-20 18:55:53 UTC Comment hidden (obsolete)

Created attachment 22098 [details] [review]
Matthias's work, rebased on master

OK.. Step one, I've rebased Matthias's work upon master and squashed it into one patch.

This patch impliments authentication only (i.e no update/additions of user data).. that will hopefully be in a followup patch on another bug by either myself or Jesse W (of Bywater Solutions).

Test plan, and my initial signoff to follow.

Comment 9 Martin Renvoize (ashimema) 2013-10-20 19:14:12 UTC

The promised test plan...

First up, you'll need to install some additional debian packages:

1. Install shibboleth deamon and apache shibboleth module (Testing upon Debian 7.1 is best, as packages are updated and simpler to configure)

    sudo apt-get install libapache2-mod-shib2 libshibsp5:amd64 shibboleth-sp2-schemas


2. Configure shibboleth 'party of trust' arrangement (i.e. trade metadata keys with your IdP.. see next comment for details)

3. Configure shibboleth attribute mapping (see next comment for further details)

4. Configure OPAC Virtualhost to enable shibboleth authentication (add the foloowing to your virtualhost)

   <Location />
      AuthType shibboleth
      Require shibboleth
   </Location>

Note: The above will enable shibboleth authentication with a fallback to local (or CAS, or LDAP, or Persona).. you can adapt this to enable Shibboleth only if you like

5. You should have some now options in the staff client under 'Administration > System Preferences >  Shibboleth Authentication'. Enable 'Shibboleth Authentication' and set the 'login attribute' to match what you setup in step 3.

6. Test login in the OPAC.  You should either be logged in directly (if you are already logged into your IdP by some other means) or when clicking 'Login' you should see the option to login via Shibboleth which will redirect you to your IdP for authentication.

Comment 10 Martin Renvoize (ashimema) 2013-10-20 20:03:23 UTC

So.... the most complicated bit of all this (as you may have guessed) is actually in steps 2. and 3. above!

Step 2 - Configuring Shibboleth party of trust.

Shibboleth config files should be located at: /etc/shibboleth

The important files are:
shibboleth2.xml - The main config file
attribute-map.xml - The attribute mapping file

You will also want to create a directory to keep IdP metadata backups within:
mkdir /var/cache/shibboleth/metadata/
chown -r _shibd:_shibd /var/shibboleth/metadata

Let's configure some things:

1. First up, we need to setup the SP (Service Provider) identity.

In the shibboleth2.xml file you should find a line similar to:

<ApplicationDefaults entityID="https://kohaopac.mytestserver.com"

Modify this so that the 'entityID' matches your OPAC URL.

2. Next, we need to tell the shibboleth daemon where the IdP (identity provider) is.

In the shibboleth2.xml file you should find a block similar to:

Modify this so that the entityID matches the IdP's sign in URL.

3. Finally, you'll need to tell the daemon where to fetch the IdP's metadata from and set a backup path:

In the shibboleth2.xml file you should find a block similar to:

Modify this so that the uri matches the IdP's public metadata page, and point the backingFilePath to the directory we created.

4. The config is now done... but you should create some keys to work with your shibboleth SP:

sudo openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 -keyout server.key -out server.crt

Your key and certicate names will obviously need to match those in the shibboleth2.xml config file.

5. Restart the shibd daemon:

sudo /etc/init.d/shibd restart

6. We're about ready to swap Matadata: Tell you're IdP provider that your Metadata is available at:

https://youropacurl.com/Shibboleth.sso/Metadata

Comment 11 Martin Renvoize (ashimema) 2013-10-20 20:38:47 UTC Comment hidden (obsolete)

Created attachment 22107 [details] [review]
Matthias's work, rebased upon master

Sign off - Tested as in above test plan and in live use at 2 Sites so far.

I would imagine it best to have at least one further signoff given the complexity of shibboleth.  

I am more than happy to be of assistance to anyone wishing to test this bug, and can offer the use of a test IdP should it be required as I found I had to set one up to get my head around this patch.

Comment 12 Matthias Meusburger 2013-11-07 14:22:21 UTC

Hello,

Thanks Matin, for rebasing my patch, and providing a test plan :)

One thing though, using $ENV{'SERVER_NAME'} is not such a good idea imho, because it won't work if koha is behind a reverse proxy.

Comment 13 Martin Renvoize (ashimema) 2013-11-08 09:08:59 UTC

Hmm, I hadn't thought of the reverse proxy case.. have you run up against this problem?

I assume using the OPACBaseURL syspref instead is a better approach?

Comment 14 Martin Renvoize (ashimema) 2013-11-11 14:40:49 UTC Comment hidden (obsolete)

Created attachment 22860 [details] [review]
MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

  - Fix logout bug: shibboleth logout now occurs only when
    the session is a shibboleth one.
  - Do some refactoring: getting shibboleth username is now
    done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

  - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
 in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
 multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

  - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 15 Martin Renvoize (ashimema) 2013-11-11 14:43:28 UTC

As suggested by Matthias I have updated the patch to use C4::Context->preference('OPACBaseURL') in place of $ENV{SERVER_NAME} within the Auth_with_Shibboleth script.

This seems to work in my testing, though I didn't know how to reproduce the issue Matthias highlights so couldn't test that it actually fixes the issue.

Setting back to 'Needs Signoff'

Comment 16 Martin Renvoize (ashimema) 2013-11-29 14:02:57 UTC Comment hidden (obsolete)

Created attachment 23224 [details] [review]
Bug 8446: Ensure user is returned to requested page after auth

Added querystring to the target path in shibboleth URL so that
when a user is authenticated he/she is returned to the correct
page they requested before authentication.  (think clicking a
link to opac-detail.pl?biblionumber=12345)

Comment 17 Martin Renvoize (ashimema) 2013-11-29 14:38:35 UTC Comment hidden (obsolete)

Created attachment 23225 [details] [review]
MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 18 Martin Renvoize (ashimema) 2013-11-29 14:38:48 UTC Comment hidden (obsolete)

Created attachment 23226 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

Comment 19 Martin Renvoize (ashimema) 2013-11-29 14:40:58 UTC

Re-based upon master and re-squashed the commits to better reflect their authors.

First patch is all Matthias's work, and second patch are my two follow up fixes to that work.

Hope we can find someone to test this, I'd love to see it in community.

Comment 20 Martin Renvoize (ashimema) 2014-03-03 14:00:21 UTC Comment hidden (obsolete)

Created attachment 25765 [details] [review]
MT8122: Adds Shibboleth authentication

 - Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 21 Martin Renvoize (ashimema) 2014-03-03 14:00:28 UTC Comment hidden (obsolete)

Created attachment 25766 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Comment 22 Martin Renvoize (ashimema) 2014-03-03 14:03:14 UTC

Rebased upon master and added a follow-up to remove unused imports from Auth_with_shibboleth.pm

Comment 23 Jesse Weaver 2014-03-12 13:42:09 UTC Comment hidden (obsolete)

Created attachment 26176 [details] [review]
MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 24 Jesse Weaver 2014-03-12 13:42:18 UTC Comment hidden (obsolete)

Created attachment 26177 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 25 Jesse Weaver 2014-03-12 13:42:30 UTC Comment hidden (obsolete)

Created attachment 26178 [details] [review]
Bug 8446 - Followup: Remove unnecessary sysprefs, move to config

Comment 26 Martin Renvoize (ashimema) 2014-03-12 14:55:49 UTC Comment hidden (obsolete)

Created attachment 26187 [details] [review]
[SIGNED OFF] Bug 8446 - Followup: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 27 Martin Renvoize (ashimema) 2014-03-12 14:57:16 UTC

Cheers Jesse, 

All sensible changes and some neatening of the code.  This is deffinitely somthing that should be based in config as apposed to sysprefs so very happy you've implimented that.

Lets hope we can get QA on this now ;)

Comment 28 Martin Renvoize (ashimema) 2014-04-02 08:01:41 UTC Comment hidden (obsolete)

Created attachment 26749 [details] [review]
[SIGNED OFF] MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 29 Martin Renvoize (ashimema) 2014-04-02 08:01:56 UTC Comment hidden (obsolete)

Created attachment 26750 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 30 Martin Renvoize (ashimema) 2014-04-02 08:02:15 UTC Comment hidden (obsolete)

Created attachment 26751 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 31 Martin Renvoize (ashimema) 2014-04-02 08:03:35 UTC Comment hidden (obsolete)

Created attachment 26752 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

Comment 32 Martin Renvoize (ashimema) 2014-04-02 08:06:58 UTC

Some follow-up work to allow better error handling when a shibboleth session exists but does not match a koha user, and allow for shibboleth login from the front page in bootstrap should you not already be logged in.

I've also added the beginnings of a perldoc to the Auth_with_shibboleth.pm module to guide configuration.

Comment 33 Martin Renvoize (ashimema) 2014-04-02 12:38:45 UTC Comment hidden (obsolete)

Created attachment 26760 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

Comment 34 Martin Renvoize (ashimema) 2014-04-02 12:41:15 UTC

I have a work in progress branch for all things shib related available at: https://github.com/PTFS-Europe/koha/tree/bug_8466-shibboleth

I intend so add some new bugs in the coming days to enhance upon this base.

Comment 35 Martin Renvoize (ashimema) 2014-04-02 12:44:02 UTC Comment hidden (obsolete)

Created attachment 26761 [details] [review]
BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

Comment 36 Martin Renvoize (ashimema) 2014-04-02 12:44:10 UTC Comment hidden (obsolete)

Created attachment 26762 [details] [review]
BUG8446, Follow up: Correct paths after file rename

Comment 37 David Cook 2014-05-14 00:44:57 UTC

Really interested by this one, but don't think I have any way of testing it...

Comment 38 Martin Renvoize (ashimema) 2014-05-14 07:37:10 UTC

I can walk you through testing if your willing... 

There an open IdP, https://openidp.feide.no/, in germany that allows registering of accounts for testing service providers.  It'll give you a login to koha via your google identity through feide's idp service.

Shout on IRC if you want some guidance on how to work through it, but we're now at a point where most of it is documented and feide provide the ability to test, and I'd love to get someone's opinion on what doc I've written so far.

Comment 39 Martin Renvoize (ashimema) 2014-06-17 13:28:33 UTC Comment hidden (obsolete)

Created attachment 28892 [details] [review]
MT8122: Adds Shibboleth authentication

 - Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 40 Martin Renvoize (ashimema) 2014-06-17 13:28:37 UTC Comment hidden (obsolete)

Created attachment 28893 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 41 Martin Renvoize (ashimema) 2014-06-17 13:28:40 UTC Comment hidden (obsolete)

Created attachment 28894 [details] [review]
BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 42 Martin Renvoize (ashimema) 2014-06-17 13:28:44 UTC Comment hidden (obsolete)

Created attachment 28895 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

Comment 43 Martin Renvoize (ashimema) 2014-06-17 13:28:47 UTC Comment hidden (obsolete)

Created attachment 28896 [details] [review]
BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

Comment 44 Martin Renvoize (ashimema) 2014-06-17 13:28:50 UTC Comment hidden (obsolete)

Created attachment 28897 [details] [review]
BUG8446, Follow up: Correct paths after file rename

Comment 45 Martin Renvoize (ashimema) 2014-06-17 13:32:24 UTC Comment hidden (obsolete)

Created attachment 28898 [details] [review]
[SIGNED OFF] MT8122: Adds Shibboleth authentication

 - Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 46 Martin Renvoize (ashimema) 2014-06-17 13:32:29 UTC Comment hidden (obsolete)

Created attachment 28899 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 47 Martin Renvoize (ashimema) 2014-06-17 13:32:34 UTC Comment hidden (obsolete)

Created attachment 28900 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 48 Martin Renvoize (ashimema) 2014-06-17 13:32:38 UTC Comment hidden (obsolete)

Created attachment 28901 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

Comment 49 Martin Renvoize (ashimema) 2014-06-17 13:32:42 UTC Comment hidden (obsolete)

Created attachment 28902 [details] [review]
BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

Comment 50 Martin Renvoize (ashimema) 2014-06-17 13:32:45 UTC Comment hidden (obsolete)

Created attachment 28903 [details] [review]
BUG8446, Follow up: Correct paths after file rename

Comment 51 Martin Renvoize (ashimema) 2014-07-24 10:57:52 UTC Comment hidden (obsolete)

Created attachment 30017 [details] [review]
MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 52 Martin Renvoize (ashimema) 2014-07-24 10:58:05 UTC Comment hidden (obsolete)

Created attachment 30018 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 53 Martin Renvoize (ashimema) 2014-07-24 10:58:13 UTC Comment hidden (obsolete)

Created attachment 30019 [details] [review]
BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 54 Martin Renvoize (ashimema) 2014-07-24 10:58:23 UTC Comment hidden (obsolete)

Created attachment 30020 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

Comment 55 Martin Renvoize (ashimema) 2014-07-24 10:58:29 UTC Comment hidden (obsolete)

Created attachment 30021 [details] [review]
BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

Comment 56 Martin Renvoize (ashimema) 2014-07-24 10:58:35 UTC Comment hidden (obsolete)

Created attachment 30022 [details] [review]
BUG8446, Follow up: Correct paths after file rename

Comment 57 Martin Renvoize (ashimema) 2014-07-24 10:58:43 UTC Comment hidden (obsolete)

Created attachment 30023 [details] [review]
BUG8446, Follow up: Implimented single sign out

- This followup rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implimented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implimentation issue that is well known.

Comment 58 Martin Renvoize (ashimema) 2014-07-24 11:04:19 UTC

As discussed with Thomas and Katrin I've now tracking this patch set in my public github repository and keeping it rebased appropriately.

The latest version of the patch will laways be available at: https://github.com/mrenvoize/Koha/tree/bug_8446

This is basically to make it easier to apply, as not wanting to loose attribution means that squashing the patches to prevent merge conflicts with updatedatabase would be 'bad'.

Comment 59 Katrin Fischer 2014-07-24 12:36:06 UTC

Finally got this working with Martin's help! Woohooo!

Some first remarks:
- The link to log in with Shibboleth seems to only appear on the start page, but not for example on the result list.
- It would be nice if Shib login also directed you to the patron account, like the normal login does. But maybe it's safer to always redirect to the place the user started from - in case someone logged in to place a hold or similar.

Tested ok:

From start page:
- OK Shib login with correct username/password
- OK Shib logout with correct username/password
- OK Koha login
- OK Koha logout

Comment 60 Martin Renvoize (ashimema) 2014-07-24 14:33:30 UTC Comment hidden (obsolete)

Created attachment 30030 [details] [review]
BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

Comment 61 Martin Renvoize (ashimema) 2014-07-24 14:33:37 UTC Comment hidden (obsolete)

Created attachment 30031 [details] [review]
BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template ruels so that CAS and Shibboleth can coexist.

Comment 62 Martin Renvoize (ashimema) 2014-07-24 14:34:09 UTC

Two QA followups

Comment 63 Martin Renvoize (ashimema) 2014-07-24 14:57:52 UTC Comment hidden (obsolete)

Created attachment 30033 [details] [review]
BUG8446, Follow up: Added default config to config file

Comment 64 Martin Renvoize (ashimema) 2014-07-29 14:06:16 UTC Comment hidden (obsolete)

Created attachment 30283 [details] [review]
MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 65 Martin Renvoize (ashimema) 2014-07-29 14:06:35 UTC Comment hidden (obsolete)

Created attachment 30284 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 66 Martin Renvoize (ashimema) 2014-07-29 14:06:48 UTC Comment hidden (obsolete)

Created attachment 30285 [details] [review]
BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 67 Martin Renvoize (ashimema) 2014-07-29 14:07:07 UTC Comment hidden (obsolete)

Created attachment 30286 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implimented single sign out

- This followup rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implimented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implimentation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template ruels so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embelished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

Comment 68 Matthias Meusburger 2014-07-30 10:38:07 UTC

Tested ok : 

 - CAS and Shibboleth template coexistence (even though login won't work because of the OPACBaseURL protocol issue, but that is another problem, see bug 12398 and bug 7770).
 - Shib login / logout (with single sign out)
 - koha login / logout

Comment 69 Martin Renvoize (ashimema) 2014-07-30 13:48:50 UTC Comment hidden (obsolete)

Created attachment 30335 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implimented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implimented single sign out

- This followup rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implimented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implimentation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template ruels so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embelished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

BUG8446, Follow up: Enable configuration of match field

- Added clearer, more flexible, configuration of shibboleth attribute to
  koha borrower field matching for authenticaion
- Correcting of documentation to make it more clear to the current
  implimentation
- Minor refactoring of code to reduce some code duplication

Comment 70 Martin Renvoize (ashimema) 2014-07-30 20:21:51 UTC Comment hidden (obsolete)

Created attachment 30353 [details] [review]
[SIGNED OFF] MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

http://bugs.koha-community.org/show_bug.cgi?id=8446
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
(ByWater employee.)

Comment 71 Martin Renvoize (ashimema) 2014-07-30 20:21:59 UTC Comment hidden (obsolete)

Created attachment 30354 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 72 Martin Renvoize (ashimema) 2014-07-30 20:22:05 UTC Comment hidden (obsolete)

Created attachment 30355 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Comment 73 Martin Renvoize (ashimema) 2014-07-30 20:22:12 UTC Comment hidden (obsolete)

Created attachment 30356 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implemented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implemented single sign out

- This follow up rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implemented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implementation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template rules so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embellished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

BUG8446, Follow up: Enable configuration of match field

- Added clearer, more flexible, configuration of shibboleth attribute to
  koha borrower field matching for authentication
- Correcting of documentation to make it more clear to the current
  implementation
- Minor refactoring of code to reduce some code duplication

Comment 74 Martin Renvoize (ashimema) 2014-07-30 20:32:59 UTC

Right.. I think we're finally there guys!

This last update to the final patch takes care of a configuration issue Matthias spotted whereby the config would be parsed incorrectly.

To enable forward compatibility with bug 12026 (preventing us having to handle a nasty breaking config change when pushing that patch) and to bring the config in line with that of the way the ldap config currently works the minimum xml required has changed from:

<usesshibboleth>1</usesshibboleth>
<shibboleth>
  <matchpoint>userid</matchpoint>
  <mapping>
    <userid>uid</userid>
  </mapping>
</shibboleth>

to:

<usesshibboleth>1</usesshibboleth>
<shibboleth>
  <matchpoint>userid</matchpoint>
  <mapping>
    <userid is="uid"></userid>
  </mapping>
</shibboleth>

I'm told this is more 'standard' amongst this kind of xml based mapping file and am happy going with it.

It also allows for a future form to look like the below without breaking compatibility:

<usesshibboleth>1</usesshibboleth>
<shibboleth>
  <matchpoint>userid</matchpoint>
  <mapping>
    <userid is="uid" regex="s/@school.ac.uk//g"></userid>
    <firstname is="fn">default</firstname>
  </mapping>
</shibboleth>

The above will hopefully give you a brief glimpse into what I'm thinking for enhancing bug 12026 once this is pushed.

Cheers for everyone efforts so far!

Comment 75 Matthias Meusburger 2014-07-31 09:15:00 UTC

Tested ok.

Comment 76 Matthias Meusburger 2014-07-31 09:20:38 UTC Comment hidden (obsolete)

Created attachment 30384 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Improve local login fallback

Signed-off patch.

Comment 77 Katrin Fischer 2014-07-31 09:24:57 UTC

Hi Matthias, can you add your sign off line to the other patches too please? And thx for signing off!

Comment 78 Martin Renvoize (ashimema) 2014-08-07 18:57:17 UTC Comment hidden (obsolete)

Created attachment 30594 [details] [review]
BUG8446, Follow up: Refactor to clean up bad practice

- A number of issues were highlighted whilst writing sensible unit tests
  for this module.
  - Removed unnessesary call to context->new();
  - Global variables are BAD!
  - Croaking is a wimps way out, we should handle errors early and
    properly.

Comment 79 Martin Renvoize (ashimema) 2014-08-07 23:00:39 UTC Comment hidden (obsolete)

Created attachment 30604 [details] [review]
BUG8446, Follow up: Refactor to clean up bad practice

- A number of issues were highlighted whilst writing sensible unit tests
  for this module.
  - Removed unnessesary call to context->new();
  - Global variables are BAD!
  - Croaking is a wimps way out, we should handle errors early and
    properly.

Comment 80 Martin Renvoize (ashimema) 2014-08-07 23:00:45 UTC Comment hidden (obsolete)

Created attachment 30605 [details] [review]
BUG8446, followup: Add Unit Tests

Comment 81 Martin Renvoize (ashimema) 2014-08-07 23:03:55 UTC

So, those last two patches are in need of signoff.

The first one does some much needed re-factoring of the original code to meet better (but still not best) practice ;)

The latter are some basic unit tests covering a fair range of the routines so far which will be needed at QA.

Comment 82 Paola Rossi 2014-08-08 09:07:46 UTC

I've tried to apply the patches today against 3.17.00.013

Applying: MT8122: Adds Shibboleth authentication
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Auto-merging opac/opac-user.pl
Auto-merging installer/data/mysql/updatedatabase.pl
CONFLICT (content): Merge conflict in installer/data/mysql/updatedatabase.pl
Auto-merging C4/Auth.pm
Failed to merge in the changes.
Patch failed at 0001 MT8122: Adds Shibboleth authentication

So I pass the patch to "Patch doesn't apply" status.

Comment 83 Martin Renvoize (ashimema) 2014-08-08 11:12:02 UTC Comment hidden (obsolete)

Created attachment 30616 [details] [review]
[SIGNED OFF] MT8122: Adds Shibboleth authentication

- Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

MT8122, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

MT8122, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

MT8122, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

MT8122, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>

Comment 84 Martin Renvoize (ashimema) 2014-08-08 11:12:09 UTC Comment hidden (obsolete)

Created attachment 30617 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>

Comment 85 Martin Renvoize (ashimema) 2014-08-08 11:12:17 UTC Comment hidden (obsolete)

Created attachment 30618 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>

Comment 86 Martin Renvoize (ashimema) 2014-08-08 11:12:26 UTC Comment hidden (obsolete)

Created attachment 30619 [details] [review]
[SIGNED OFF] BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implemented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implemented single sign out

- This follow up rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implemented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implementation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template rules so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embellished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

BUG8446, Follow up: Enable configuration of match field

- Added clearer, more flexible, configuration of shibboleth attribute to
  koha borrower field matching for authentication
- Correcting of documentation to make it more clear to the current
  implementation
- Minor refactoring of code to reduce some code duplication

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>

Comment 87 Martin Renvoize (ashimema) 2014-08-08 11:12:32 UTC Comment hidden (obsolete)

Created attachment 30620 [details] [review]
BUG8446, Follow up: Refactor to clean up bad practice

- A number of issues were highlighted whilst writing sensible unit tests
  for this module.
  - Removed unnessesary call to context->new();
  - Global variables are BAD!
  - Croaking is a wimps way out, we should handle errors early and
    properly.

Comment 88 Martin Renvoize (ashimema) 2014-08-08 11:12:39 UTC Comment hidden (obsolete)

Created attachment 30621 [details] [review]
BUG8446, followup: Add Unit Tests

Comment 89 Martin Renvoize (ashimema) 2014-08-08 11:15:22 UTC

Rebased again..

It's only a db change that is causing this conflict every time.. and said db change is backed out in a later patch in the series anyway. (It's only for attribution for Matthias that it's still there at all).

I have however got a tracking github branch which I've suggested people use for testing.. this branch is re-based nightly against master.

As for testing.. give me a shout if you need any help with the config.. it's the config outside of koha which is hardest to setup.

Comment 90 Martin Renvoize (ashimema) 2014-08-11 08:53:42 UTC Comment hidden (obsolete)

Created attachment 30684 [details] [review]
BUG8446, followup: Add Unit Tests

Comment 91 Zeno Tajoli 2014-08-22 18:54:15 UTC

There is a site that seems useful to test the patch:
http://testshib.org/index.html

But is not clear to me if it is possible to use it as IdP and my Koha install as Service Provider.

For example, do you undestand how to create a user/pwd in the IdP of http://testshib.org/ ?

Probably it is possible to use also this test service:
https://openidp.feide.no/.
But probably is better to be Norse.

Comment 92 Martin Renvoize (ashimema) 2014-08-26 15:17:27 UTC

Hi Zeno, 

I'm pretty sure you can use testshib, and can verify you can definitely use fiede as that's what I used for allot of my own testing.

The instructions on both sites seem pretty clear, but do let me know if you have any issues.

Martin

Comment 93 Matthias Meusburger 2014-09-05 15:08:02 UTC Comment hidden (obsolete)

Created attachment 31407 [details] [review]
[SIGNED-OFF] BUG8446, Follow up: Refactor to clean up bad practice

Comment 94 Matthias Meusburger 2014-09-05 15:08:48 UTC Comment hidden (obsolete)

Created attachment 31408 [details] [review]
[SIGNED-OFF] BUG8446, followup: Add Unit Tests

Comment 95 Martin Renvoize (ashimema) 2014-09-23 13:58:06 UTC Comment hidden (obsolete)

Created attachment 31836 [details] [review]
BUG8446, qa-followup: Cleanup tabs and license

Comment 96 Martin Renvoize (ashimema) 2014-09-29 08:02:23 UTC Comment hidden (obsolete)

Created attachment 31905 [details] [review]
BUG8446, QA Followup: Cleanup tabs and license

Comment 97 Martin Renvoize (ashimema) 2014-09-29 08:02:26 UTC Comment hidden (obsolete)

Created attachment 31906 [details] [review]
BUG8446, QA Followup: Minor Code Tidies

Comment 98 Martin Renvoize (ashimema) 2014-09-29 08:02:30 UTC Comment hidden (obsolete)

Created attachment 31907 [details] [review]
BUG8446, QA Followup: Use DBIx::Class

- Convert Auth_with_shibboleth to use dbic stanzas.

Comment 99 Katrin Fischer 2014-10-09 18:59:15 UTC

Setting this to failed for now - Martin is working on a follow-up for the tests as I ran into some problems running them.

Comment 100 Martin Renvoize (ashimema) 2014-10-10 07:16:08 UTC

:(

It seems that mocking the database with DBD::Mock when using DBIx::Class is simply incompatible (DBIx::Class just complains about an unrecognised DBI driver, then proceeds to drop back to some default SQL and fails badly)

I've been looking into alternatives, like Test::DBIx::Class (which is a module to create an in memory sql database to test against, but this route requires lots of work manually creating dummy data to test against). I then tried DBIx::Class::Sims (which is a module to automatically fill tables with randomly generated dummy data, but this approach also fails because our database schema has a large number of cyclic relationships and the Sims module doesn't cope with this well)

Interesting enough, the problem I'm facing (Not wanting to have to populate the whole structure of a Borrowers Row and satisfy all constraints manually) is basically solved by the TestBuilder module we recently decided not to adopt!

I'll keep battling with it, but I have a feeling the Test size will have to jump substantially as I add all the releated data in a transaction.  It shouldn't be this Hard!

Martin

Comment 101 Martin Renvoize (ashimema) 2014-10-10 08:29:29 UTC Comment hidden (obsolete)

Created attachment 32125 [details] [review]
BUG8446, QA Followup: Use DBIx::Class

- Convert Auth_with_shibboleth to use dbic stanzas.

Comment 102 Martin Renvoize (ashimema) 2014-10-10 08:38:39 UTC

Fixed!

Comment 103 Martin Renvoize (ashimema) 2014-10-10 14:42:56 UTC Comment hidden (obsolete)

Created attachment 32158 [details] [review]
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies

- To correct tests after converting module to dbic, we need to add the
  Test::DBIx::Class module as a dependancy.

Comment 104 Katrin Fischer 2014-10-10 15:05:49 UTC Comment hidden (obsolete)

Created attachment 32162 [details] [review]
[PASSED QA] BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested with the feide idp.
- LDAP login and logout are working
- local login/logout are still working
- CAS login/logout are still working

Instructions for setup can be found on the wiki:
http://wiki.koha-community.org/wiki/Shibboleth_Configuration

Comment 105 Katrin Fischer 2014-10-10 15:06:32 UTC Comment hidden (obsolete)

Created attachment 32163 [details] [review]
[PASSED QA] BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 106 Katrin Fischer 2014-10-10 15:06:40 UTC Comment hidden (obsolete)

Created attachment 32164 [details] [review]
[PASSED QA] BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implemented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implemented single sign out

- This follow up rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implemented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implementation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template rules so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embellished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

BUG8446, Follow up: Enable configuration of match field

- Added clearer, more flexible, configuration of shibboleth attribute to
  koha borrower field matching for authentication
- Correcting of documentation to make it more clear to the current
  implementation
- Minor refactoring of code to reduce some code duplication

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 107 Katrin Fischer 2014-10-10 15:07:22 UTC Comment hidden (obsolete)

Created attachment 32165 [details] [review]
[PASSED QA] BUG8446, Follow up: Refactor to clean up bad practice

- A number of issues were highlighted whilst writing sensible unit tests
  for this module.
  - Removed unnessesary call to context->new();
  - Global variables are BAD!
  - Croaking is a wimps way out, we should handle errors early and
    properly.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 108 Katrin Fischer 2014-10-10 15:08:00 UTC Comment hidden (obsolete)

Created attachment 32166 [details] [review]
[PASSED QA] BUG8446, followup: Add Unit Tests

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 109 Katrin Fischer 2014-10-10 15:08:48 UTC Comment hidden (obsolete)

Created attachment 32167 [details] [review]
[PASSED QA] BUG8446, QA Followup: Cleanup tabs and license

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 110 Katrin Fischer 2014-10-10 15:09:39 UTC Comment hidden (obsolete)

Created attachment 32168 [details] [review]
[PASSED QA] BUG8446, QA Followup: Minor Code Tidies

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 111 Katrin Fischer 2014-10-10 15:09:47 UTC Comment hidden (obsolete)

Created attachment 32169 [details] [review]
[PASSED QA] BUG8446, QA Followup: Use DBIx::Class

- Convert Auth_with_shibboleth to use dbic stanzas.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 112 Katrin Fischer 2014-10-10 15:09:55 UTC Comment hidden (obsolete)

Created attachment 32170 [details] [review]
[PASSED QA] BUG8446, QA Followup: Add Test::DBIx::Class to dependancies

- To correct tests after converting module to dbic, we need to add the
  Test::DBIx::Class module as a dependancy.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
The dependency will probably need to be packaged by us until
it can get into Debian proper.

Comment 113 Martin Renvoize (ashimema) 2014-10-15 16:22:46 UTC

Created attachment 32365 [details] [review]
BUG8446: Adds Shibboleth authentication

 - Use the shibbolethAuthentication syspref to enable Shibboleth authentication
 - Configure the shibbolethLoginAttribute to specify which shibboleth user
   attribute matches the koha login
 - Make sure the OPACBaseURL is correctly set

BUG8446, Follow-up: Adds Shibboleth authentication

 - Fix logout bug: shibboleth logout now occurs only when
   the session is a shibboleth one.
 - Do some refactoring: getting shibboleth username is now
   done in C4::Auth_with_Shibboleth.pm (get_login_shib function)

BUG8446, Follow-up: Adds Shibboleth authentication

 - Adds redirect to opac after logout

BUG8446, Follow-up: Adds Shibboleth authentication

 - Shibboleth is not compatible with basic http authentication
   in C4/Auth.pm. This patch fixes that.

BUG8446, Follow-up: Adds Shibboleth authentication

 - Use ENV{'SERVER_NAME'} instead of syspref OpacBaseURL in order to work with
   multiple vhosts.

BUG8446, Follow-up: Adds Shibboleth authentication

 - Adds missing protocol for $ENV{'SERVER_NAME'}

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
Tested with the feide idp.
- LDAP login and logout are working
- local login/logout are still working
- CAS login/logout are still working

Instructions for setup can be found on the wiki:
http://wiki.koha-community.org/wiki/Shibboleth_Configuration

Comment 114 Martin Renvoize (ashimema) 2014-10-15 16:22:53 UTC

Created attachment 32366 [details] [review]
BUG8446, Follow up: Adds Shibboleth authentication

- Use syspref OpacBaseURL instead of ENV{'SERVER_NAME'} as this wont
  work if koha is behind a reverse proxy.
  - To use multiple vhosts, set OpacBaseURL per vhost explicitly with
    'SetEnv OpacBaseURL Value' as per Bug 10325

BUG8446, Follow up: Adds Shibboleth authentication

- Ensure user is returned to requested page after authentication
  - Added querystring to the target path in shibboleth URL so
    that when a user is authenticated he/she is returned to the
    correct page they requested before authentication.
    Example where this is important: When a user clicks a direct
    biblio link of the form - /opac-detail.pl?biblionumber=12345

BUG8446, Follow up: Remove unused imports from scripts

- Remove import of deprecated C4::Utils module from shibboleth
  authentication module: Auth_with_shibboleth.pm

Signed-off-by: Jesse Weaver <pianohacker@gmail.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 115 Martin Renvoize (ashimema) 2014-10-15 16:23:00 UTC

Created attachment 32367 [details] [review]
BUG8446, Follow up: Remove unnecessary sysprefs, move to config

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 116 Martin Renvoize (ashimema) 2014-10-15 16:23:08 UTC

Created attachment 32368 [details] [review]
BUG8446, Follow up: Improve local login fallback

- Local fallback was not very well implemented, this patch adds
  better handling for such cases allowing clearer failure messages
- This patch also adds the ability to use single sign on via the
  top bar menu in the bootstrap theme.

BUG8446, Follow up: Adds perldoc documentation

- Add some documentation to the Auth_with_Shibboleth module
  including some guidance as to configuration.

BUG8446, Follow up: Correct filenames to match guidlines

- Moved Auth_with_Shibboleth.pm to Auth_with_shibboleth.pm to match
  other files present on the system.

BUG8446, Follow up: Correct paths after file rename

BUG8446, Follow up: Implemented single sign out

- This follow up rebases the code against 3.16+ which managed to break
  some of the original logic.
- As a side effect of the rebasing, we've also implemented the single
  sign out element. Upon logout, koha will request that the shibboleth
  session is destroyed, and then clear the local koha session upon
  return to koha.  Due to the nature of shibboleth however, you will
  only truly be signed out of the IdP if they properly support Single
  Sign Out (which many do not). As a consequence, although you may
  appear to be logged out in koha, you might find that upon clicking
  'login' the IdP does NOT request your login details again, but instead
  logs you silently back into your koha session. This is NOT a koha bug,
  but a shibboleth implementation issue that is well known.

BUG8446, Follow up: Fixed bootstrap login via modal

- The bootstrap theme enable login from any opac page via modal. To
  enable this with shibboleth we had to make some template parameters
  globally accessible when shibboleth is enabled.

BUG8446, Follow up: Add template rules for Shibboleth and CAS

- Add template rules so that CAS and Shibboleth can coexist.

BUG8446, Follow up: Added default config to config file

BUG8446, Follow up: Embellished perldoc documentation

- Updated perldoc to correct detail about configuring shibboleth
  authentication.
- Updated perldoc to include subroutines and their respective functions.

BUG8446, Follow up: Enable configuration of match field

- Added clearer, more flexible, configuration of shibboleth attribute to
  koha borrower field matching for authentication
- Correcting of documentation to make it more clear to the current
  implementation
- Minor refactoring of code to reduce some code duplication

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 117 Martin Renvoize (ashimema) 2014-10-15 16:23:15 UTC

Created attachment 32369 [details] [review]
BUG8446, Follow up: Refactor to clean up bad practice

- A number of issues were highlighted whilst writing sensible unit tests
  for this module.
  - Removed unnessesary call to context->new();
  - Global variables are BAD!
  - Croaking is a wimps way out, we should handle errors early and
    properly.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 118 Martin Renvoize (ashimema) 2014-10-15 16:23:19 UTC

Created attachment 32370 [details] [review]
BUG8446, Follow up: Add Unit Tests

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 119 Martin Renvoize (ashimema) 2014-10-15 16:23:25 UTC

Created attachment 32371 [details] [review]
BUG8446, QA Followup: Cleanup tabs and license

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 120 Martin Renvoize (ashimema) 2014-10-15 16:23:31 UTC

Created attachment 32372 [details] [review]
BUG8446, QA Followup: Minor Code Tidies

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 121 Martin Renvoize (ashimema) 2014-10-15 16:23:36 UTC

Created attachment 32373 [details] [review]
BUG8446, QA Followup: Use DBIx::Class

- Convert Auth_with_shibboleth to use dbic stanzas.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 122 Martin Renvoize (ashimema) 2014-10-15 16:23:40 UTC

Created attachment 32374 [details] [review]
BUG8446, QA Followup: Add Test::DBIx::Class to dependancies

- To correct tests after converting module to dbic, we need to add the
  Test::DBIx::Class module as a dependancy.

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>
The dependency will probably need to be packaged by us until
it can get into Debian proper.

Comment 123 Martin Renvoize (ashimema) 2014-10-15 16:26:54 UTC

Minor rebase (database change as usual in first patch, which is then removed in second patch anyway).

Added first patch back in to tree, as caits bz managed to nuke it during upload it seems.

Should apply fine again now ;)

Comment 124 Tomás Cohen Arazi (tcohen) 2014-10-16 15:34:45 UTC

Created attachment 32426 [details] [review]
Bug 8446: (qa followup) Tests should be conditional on Test::DBIx::Class

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>

Comment 125 Tomás Cohen Arazi (tcohen) 2014-10-16 15:36:07 UTC

Created attachment 32427 [details] [review]
Bug 8446: (qa followup) Patch reintroduces SolR stuff

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>

Comment 126 Tomás Cohen Arazi (tcohen) 2014-10-16 15:58:59 UTC

Feature pushed to master.

Thanks Matthias, Martin and Jesee!