gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 18506: Add xShibOnly preference for Shibboleth authentication 

This patch adds two system preferences to Koha, opacShibOnly and
staffShibOnly, allowing users to restrict authentication to just
one method, Shibboleth.

We do however, allow for local fallback for the SCO/SCI logins.

A system preference was chosen over a configuration file update to
allow for local override at the virtualhost level. In this way a
hosting provider can setup a 'backdoor opac' for example to allow
fallback to local logins for support operations.

Signed-off-by: Matthias Meusburger <matthias.meusburger@biblibre.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 1a81264ac1)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Martin Renvoize 2017-04-26 12:39:15 +01:00 committed by Fridolin Somers
parent fd75ab1808
commit 802f80d5d4
5 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
C4/Auth.pm
View File

@ -1101,6 +1101,23 @@ sub checkauth {
}
}
# If shib configured and shibOnly enabled, we should ignore anything other than a shibboleth type login.
if (
$shib
&& !$shibSuccess
&& (
(
( $type eq 'opac' )
&& C4::Context->preference('opacShibOnly')
)
|| ( ( $type ne 'opac' )
&& C4::Context->preference('staffShibOnly') )
)
)
{
$return = 0;
}
# $return: 1 = valid user
if ($return) {
@ -1395,6 +1412,13 @@ sub checkauth {
}
if ($shib) {
#If shibOnly is enabled just go ahead and redirect directly
if ( (($type eq 'opac') && C4::Context->preference('opacShibOnly')) || (($type ne 'opac') && C4::Context->preference('staffShibOnly')) ) {
my $redirect_url = login_shib_url( $query );
print $query->redirect( -uri => "$redirect_url", -status => 303 );
safe_exit;
}
$template->param(
shibbolethAuthentication => $shib,
shibbolethLoginUrl => login_shib_url($query),

6
installer/data/mysql/atomicupdate/shibOnly.perl Normal file
View File

@ -0,0 +1,6 @@
$DBversion = 'XXX'; # will be replaced by the RM
if( CheckVersion( $DBversion ) ) {
$dbh->do( "INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type) VALUES ('opacShibOnly','0','If ON enables shibboleth only authentication for the opac','','YesNo'),('staffShibOnly','0','If ON enables shibboleth only authentication for the staff client','','YesNo')" );
SetVersion( $DBversion );
print "Upgrade to $DBversion done (Bug XXXXX - shibOnly preferences)\n";
}

7
koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/opac.pref
View File

@ -932,3 +932,10 @@ OPAC:
BaseURL: "OPACBaseURL"
OPACAlias: "configured return URL"
- "."
Authentication:
-
- pref: opacShibOnly
choices:
yes: "Don't allow"
no: Allow
- patrons to login by means other than Shibboleth.

7
koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/staff_interface.pref
View File

@ -181,3 +181,10 @@ Staff interface:
yes: Show
no: "Don't show"
- a search field pulldown for 'Search the catalog' boxes.
Authentication:
-
- pref: staffShibOnly
choices:
yes: "Don't allow"
no: Allow
- staff to login by means other than shibboleth.

8
koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
View File

@ -79,6 +79,7 @@
<!-- This is what is displayed if shibboleth login has failed to match a koha user -->
<div class="alert alert-info">
<p>Sorry, your Shibboleth identity does not match a valid library identity.</p>
[% UNLESS ( Koha.Preference('opacShibOnly') ) %]
[% IF ( casAuthentication ) %]
[% IF ( invalidCasLogin ) %]
<!-- This is what is displayed if cas login has failed -->
@ -89,11 +90,13 @@
[% ELSE %]
<p>If you have a local account, you may use that below.</p>
[% END %]
[% END %]
</div>
[% ELSE %]
<h3>Shibboleth Login</h3>
<p><a href="[% shibbolethLoginUrl | $raw %]">If you have a Shibboleth account, please click here to log in.</a></p>
[% END # /IF invalidShibLogin %]
[% UNLESS ( Koha.Preference('opacShibOnly') ) %]
[% IF ( casAuthentication ) %]
<h3>CAS login</h3>
<p>If you do not have a Shibboleth account, but you do have a CAS account, you can use CAS.</p>
@ -101,8 +104,10 @@
<h3>Local login</h3>
<p>If you do not have a Shibboleth account, but you do have a local login, then you may login below.</p>
[% END %]
[% END %]
[% END # /IF shibbolethAuthentication %]
[% UNLESS ( Koha.Preference('opacShibOnly') ) %]
[% IF ( casAuthentication ) %]
[% IF ( shibbolethAuthentication ) %]
[% IF ( casServerUrl ) %]
@ -158,7 +163,9 @@
<a href="/cgi-bin/koha/svc/auth/googleopenidconnect" class="btn btn-primary" id="openid_connect">Log in with Google</a>
<p>If you do not have a Google account, but do have a local account, you can still log in: </p>
[% END # /IF GoogleOpenIDConnect %]
[% END # /UNLESS opacShibOnly %]
[% IF !Koha.Preference('opacShibOnly') or SCO_login or SCI_login %]
[% IF SCO_login %]
<form action="/cgi-bin/koha/sco/sco-main.pl" name="auth" id="auth" method="post" autocomplete="off">
[% ELSIF SCI_login %]
@ -208,6 +215,7 @@
[% END %]
</div>
</form>
[% END # / IF !opacShibOnly or SCO_login or SCI_login %]
[% END # / IF loginprompt %]
[% ELSE %]