https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #3 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Created attachment 189235 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189235&action=edit Bug 39224: add Koha object models for shibboleth configuration Add Koha::ShibbolethConfig and Koha::ShibbolethFieldMapping classes to manage Shibboleth configuration stored in the database. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #5 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Created attachment 189237 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189237&action=edit Bug 39224: integrate database-backed shibboleth configuration Update authentication code to read Shibboleth configuration from database instead of koha-conf.xml. Add get_force_sso_setting function to retrieve SSO settings from database. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #7 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Created attachment 189239 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189239&action=edit Bug 39224: integrate shibboleth UI into staff interface Add menu entry, configure build system, and set up routing for Shibboleth configuration interface. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #9 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Created attachment 189241 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189241&action=edit Bug 39224: replace deprecated shibboleth sysprefs with ShibbolethAuthentication - Remove OPACShibOnly and staffShibOnly sysprefs (now in shibboleth_config table) - Add ShibbolethAuthentication syspref to replace useshibboleth XML config - Update to check syspref instead of XML - Only show Shibboleth configuration link when ShibbolethAuthentication is enabled -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #11 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- Created attachment 189243 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=189243&action=edit Bug 39224: add is_boolean definitions for shibboleth tables to schema This applies to controllers: - ShibolethConfig - sync - welcome - autocreate - force{opac/staff}sso - ShibbolethFieldMapping - is_matchpoint -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #13 from Jacob O'Mara <jacob.omara@openfifth.co.uk> --- To make the testing of this a bit easier (since SSO is a pain in the ass) I've written an improvement to the koha-testing docker (that requires this branch) that incidentally should also make testing this branch a bit easier. If you boot up a ktd instance with `ktd --localrun --sso up` while on this branch: https://github.com/Jacobomara901/koha-testing-docker/tree/sso-but-better it will boot up a keycloak instance with the realm already configured to koha. It will also enable Shibboleth in koha, turn on sync and autocreate and also configure all of the mappings in koha that are currently configured in keycloak. If you want to log in as an admin to keycloak to check, head to localhost:8082 as usual with the login details keycloak:keycloak for logging in to koha via this sso setup, use the credentials kohadev:kohadev (or set up your own in the keycloak admin panel) Obviously this has no ssl and Koha is hard coded in auth_with_shibboleth.pm to use https, so you'll need to change the code here to http instead for the _get_uri() sub. The above work will be upstreamed to the koha-testing-docker repo once this bug has been pushed to main Thanks in advance -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Jacob O'Mara <jacob.omara@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrew.auld@openfifth.co.uk -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Tomás Cohen Arazi (tcohen) <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Bug 39224 depends on bug 38201, which changed state. Bug 38201 Summary: VueJS architecture rethink https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38201 What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #16 from Nick Clemens (kidclamp) <nick@bywatersolutions.com> --- Also, http://localhost:8081/cgi-bin/koha/shibboleth/config can be loaded when shib is disabled - is this intentional? It's nice because then you can config shib before turning it on, but I actually kind of want the syspref, plus a switch in the config to activate/deactive shibboleth while setting up/testing -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #18 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- I'm having a crack at combining the two config UI's, Identity Providers and Shibboleth. Bare with me. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40596 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40596 [Bug 40596] Migrate CAS and Shibboleth into the identity providers -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |40596 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40596 [Bug 40596] Migrate CAS configuration into the identity providers -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189234|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189236|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189238|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189240|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189242|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #189244|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #20 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193619 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193619&action=edit Bug 39224: DBIx::Class schema update Auto-generated DBIx::Class schema updates from database changes: - New Result classes: Hostname, IdentityProviderHostname, IdentityProviderMapping - Updated Result classes: IdentityProvider (new columns and relationships), IdentityProviderDomain (new relationships) Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #22 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193621 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193621&action=edit Bug 39224: Add and Update Koha Object classes Updates the Koha object layer for unified identity providers: - Koha::Auth::Hostname(s): Manage library hostnames - Koha::Auth::Identity::Provider::Hostname(s): Link providers to hostnames with force_sso support - Koha::Auth::Identity::Provider::Mapping(s): Map provider fields to patron attributes - Updates Koha::Auth::Identity::Provider with mappings/hostnames accessors and simplified to_api - Updates Koha::Auth::Identity::Providers with find_forced_provider and polymorphic dispatch via object_class - Updates C4::Auth for hostname-based provider selection - Updates C4::Auth_with_shibboleth for new provider structure - Adds ForceIdentityProvider support in Koha::Config::SysPref - Updates AuthClient template plugin for hostname-aware login Test plan: 1. Run: prove t/db_dependent/Koha/Auth/Identity/Provider.t 2. Verify provider objects can be created and linked to hostnames Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #24 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193623 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193623&action=edit Bug 39224: Add SAML2 as a supported identity provider protocol Adds SAML2 support to the identity provider framework: - New Koha::Auth::Identity::Provider::SAML2 class implementing SAML2-specific configuration and behaviour - Registers SAML2 in the polymorphic protocol map in Koha::Auth::Identity::Providers This extends the existing OAuth/OIDC provider framework to also handle SAML2 identity providers through the same unified interface. Test plan: 1. Create a SAML2 identity provider Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #26 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193625 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193625&action=edit Bug 39224: API tests for identity providers, mappings and hostnames Adds API test coverage: - t/db_dependent/api/v1/identity_providers.t: Tests for provider CRUD including new protocol and SAML2 config fields - t/db_dependent/api/v1/identity_provider_mappings.t: Tests for mapping CRUD operations - t/db_dependent/api/v1/identity_provider_hostnames.t: Tests for hostname association CRUD Test plan: 1. Run: prove t/db_dependent/api/v1/identity_providers.t 2. Run: prove t/db_dependent/api/v1/identity_provider_mappings.t 3. Run: prove t/db_dependent/api/v1/identity_provider_hostnames.t Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #28 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193627 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193627&action=edit Bug 39224: Identity providers Vue SPA and admin interface Replaces the legacy jQuery-based identity providers admin page with a modern Vue 3 SPA: - Vue router with views for list, show, add, and edit providers - Provider, domain, and mapping resource components - API client for identity provider endpoints - Rspack build configuration for the new module - Updated OPAC templates for hostname-based provider selection - Updated system preferences (moves provider prefs to admin section) - Apache configuration for Vue SPA routing - Simplified admin/identity_providers.pl (delegates to Vue SPA) Test plan: 1. Navigate to Administration > Identity providers 2. Verify the list view shows existing providers 3. Add a new identity provider with mappings 4. Edit an existing provider 5. Verify OPAC login shows appropriate provider buttons 6. Run: yarn build && restart_all Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |31378 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=31378 [Bug 31378] Add a generic OAuth2/OIDC client implementation -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193619|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193621|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193623|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193625|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193627|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #31 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193682 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193682&action=edit Bug 39224: DBIx::Class schema update Auto-generated DBIx::Class schema updates from database changes: - New Result classes: Hostname, IdentityProviderHostname, IdentityProviderMapping - Updated Result classes: IdentityProvider (new columns and relationships), IdentityProviderDomain (new relationships) Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #33 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193684 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193684&action=edit Bug 39224: Add and Update Koha Object classes Updates the Koha object layer for unified identity providers: - Koha::Auth::Hostname(s): Manage library hostnames - Koha::Auth::Identity::Provider::Hostname(s): Link providers to hostnames with force_sso support - Koha::Auth::Identity::Provider::Mapping(s): Map provider fields to patron attributes - Updates Koha::Auth::Identity::Provider with mappings/hostnames accessors and simplified to_api - Updates Koha::Auth::Identity::Providers with find_forced_provider and polymorphic dispatch via object_class - Updates C4::Auth for hostname-based provider selection - Updates C4::Auth_with_shibboleth for new provider structure - Adds ForceIdentityProvider support in Koha::Config::SysPref - Updates AuthClient template plugin for hostname-aware login Test plan: 1. Run: prove t/db_dependent/Koha/Auth/Identity/Provider.t 2. Verify provider objects can be created and linked to hostnames Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #35 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193686 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193686&action=edit Bug 39224: Unit tests for identity provider object classes Adds unit tests for the new Koha object classes: - t/db_dependent/Koha/Auth/Hostname.t: Tests for hostname CRUD and validation - t/db_dependent/Koha/Auth/Identity/Provider.t: Extended tests for provider with mappings and hostnames - t/db_dependent/Koha/Auth/Identity/Provider/Mapping.t: Tests for field mapping CRUD and validation - t/db_dependent/Auth_with_shibboleth.t: Updated tests for new provider structure Test plan: 1. Run: prove t/db_dependent/Koha/Auth/Hostname.t 2. Run: prove t/db_dependent/Koha/Auth/Identity/Provider.t 3. Run: prove t/db_dependent/Koha/Auth/Identity/Provider/Mapping.t 4. Run: prove t/db_dependent/Auth_with_shibboleth.t Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #37 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193688 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193688&action=edit Bug 39224: REST API for identity providers, mappings and hostnames Adds REST API endpoints for managing identity providers, their field mappings, and hostname associations: - GET/POST /api/v1/auth/identity_providers/{id}/mappings - GET/PUT/DELETE /api/v1/auth/identity_providers/{id}/mappings/{id} - GET/POST /api/v1/auth/identity_providers/{id}/hostnames - GET/PUT/DELETE /api/v1/auth/identity_providers/{id}/hostnames/{id} - GET /api/v1/auth/hostnames (for hostname lookup) - Updates existing provider endpoints with new fields Includes OpenAPI/Swagger definitions for all new endpoints and updated definitions for existing endpoints. Test plan: 1. Run: prove t/db_dependent/api/v1/identity_providers.t 2. Test CRUD operations on mappings and hostnames via API Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #39 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193690 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193690&action=edit Bug 39224: Vue framework component enhancements Enhances shared Vue components to support the identity providers admin interface and improve reusability: - AccordionWrapper: Adds dynamic slot support - FormElement: Adds textarea and select type support - FormSection: New component for grouping form fields - KohaTable: Adds column visibility and action customisation - RelationshipWidget: Adds slot for custom content - ResourceFormSave: Adds support for nested resources and custom save handlers - ResourceShow: Adds support for related resource display - ShowElement: Adds boolean and list display support - base-resource composable: Adds relationship management and improved error handling Test plan: 1. Verify existing Vue SPAs (e.g. ERM) still function correctly 2. Components should be backwards compatible Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #41 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 193692 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=193692&action=edit Bug 39224: Cypress tests for identity providers admin interface Add cypress integration tests for the new identity providers vue app. Test plan 1) Run the new tests with: yarn cypress run --spec t/cypress/integration/Admin/IdentityProviders_spec.ts Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |33538 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=33538 [Bug 33538] Allow for independent shibboleth autocreate and sync mapping -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Michaela Sieber <michaela.sieber@kit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |clemens.tubach@kit.edu, | |lukasz.koszyk@kit.edu, | |michaela.sieber@kit.edu -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |40650 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40650 [Bug 40650] Identity providers lack support for extended patron attribute type mapping -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #193681|0 |1 is obsolete| | Attachment #193682|0 |1 is obsolete| | Attachment #193683|0 |1 is obsolete| | Attachment #193684|0 |1 is obsolete| | Attachment #193685|0 |1 is obsolete| | Attachment #193686|0 |1 is obsolete| | Attachment #193687|0 |1 is obsolete| | Attachment #193688|0 |1 is obsolete| | Attachment #193689|0 |1 is obsolete| | Attachment #193690|0 |1 is obsolete| | Attachment #193691|0 |1 is obsolete| | Attachment #193692|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #46 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 195776 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195776&action=edit Bug 39224: DBIx::Class schema update Auto-generated DBIx::Class schema updates from database changes: - New Result classes: Hostname, IdentityProviderHostname, IdentityProviderMapping - Updated Result classes: IdentityProvider (new columns and relationships), IdentityProviderDomain (new relationships) Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #48 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 195778 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195778&action=edit Bug 39224: Add and Update Koha Object classes Updates the Koha object layer for unified identity providers: - Koha::Auth::Hostname(s): Manage library hostnames - Koha::Auth::Identity::Provider::Hostname(s): Link providers to hostnames with force_sso support - Koha::Auth::Identity::Provider::Mapping(s): Map provider fields to patron attributes - Updates Koha::Auth::Identity::Provider with mappings/hostnames accessors and simplified to_api - Updates Koha::Auth::Identity::Providers with find_forced_provider and polymorphic dispatch via object_class - Updates C4::Auth for hostname-based provider selection - Updates C4::Auth_with_shibboleth for new provider structure - Adds ForceIdentityProvider support in Koha::Config::SysPref - Updates AuthClient template plugin for hostname-aware login Test plan: 1. Run: prove t/db_dependent/Koha/Auth/Identity/Provider.t 2. Verify provider objects can be created and linked to hostnames Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #50 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 195780 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195780&action=edit Bug 39224: Unit tests for identity provider object classes Adds unit tests for the new Koha object classes: - t/db_dependent/Koha/Auth/Hostname.t: Tests for hostname CRUD and validation - t/db_dependent/Koha/Auth/Identity/Provider.t: Extended tests for provider with mappings and hostnames - t/db_dependent/Koha/Auth/Identity/Provider/Mapping.t: Tests for field mapping CRUD and validation - t/db_dependent/Auth_with_shibboleth.t: Updated tests for new provider structure Test plan: 1. Run: prove t/db_dependent/Koha/Auth/Hostname.t 2. Run: prove t/db_dependent/Koha/Auth/Identity/Provider.t 3. Run: prove t/db_dependent/Koha/Auth/Identity/Provider/Mapping.t 4. Run: prove t/db_dependent/Auth_with_shibboleth.t Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #52 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 195782 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195782&action=edit Bug 39224: REST API for identity providers, mappings and hostnames Adds REST API endpoints for managing identity providers, their field mappings, and hostname associations: - GET/POST /api/v1/auth/identity_providers/{id}/mappings - GET/PUT/DELETE /api/v1/auth/identity_providers/{id}/mappings/{id} - GET/POST /api/v1/auth/identity_providers/{id}/hostnames - GET/PUT/DELETE /api/v1/auth/identity_providers/{id}/hostnames/{id} - GET /api/v1/auth/hostnames (for hostname lookup) - Updates existing provider endpoints with new fields Includes OpenAPI/Swagger definitions for all new endpoints and updated definitions for existing endpoints. Test plan: 1. Run: prove t/db_dependent/api/v1/identity_providers.t 2. Test CRUD operations on mappings and hostnames via API Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #54 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 195784 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195784&action=edit Bug 39224: Vue framework component enhancements Enhances shared Vue components to support the identity providers admin interface and improve reusability: - AccordionWrapper: Adds dynamic slot support - FormElement: Adds textarea and select type support - FormSection: New component for grouping form fields - KohaTable: Adds column visibility and action customisation - RelationshipWidget: Adds slot for custom content - ResourceFormSave: Adds support for nested resources and custom save handlers - ResourceShow: Adds support for related resource display - ShowElement: Adds boolean and list display support - base-resource composable: Adds relationship management and improved error handling Test plan: 1. Verify existing Vue SPAs (e.g. ERM) still function correctly 2. Components should be backwards compatible Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #56 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 195786 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=195786&action=edit Bug 39224: Cypress tests for identity providers admin interface Add cypress integration tests for the new identity providers vue app. Test plan 1) Run the new tests with: yarn cypress run --spec t/cypress/integration/Admin/IdentityProviders_spec.ts Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #195775|0 |1 is obsolete| | Attachment #195776|0 |1 is obsolete| | Attachment #195777|0 |1 is obsolete| | Attachment #195778|0 |1 is obsolete| | Attachment #195779|0 |1 is obsolete| | Attachment #195780|0 |1 is obsolete| | Attachment #195781|0 |1 is obsolete| | Attachment #195782|0 |1 is obsolete| | Attachment #195783|0 |1 is obsolete| | Attachment #195784|0 |1 is obsolete| | Attachment #195785|0 |1 is obsolete| | Attachment #195786|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #58 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196537 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196537&action=edit Bug 39224: DBIx::Class schema update Automated schema update for new and modified tables: - New: Hostname, IdentityProviderHostname, IdentityProviderMapping result classes - Updated IdentityProvider: remove mapping/matchpoint columns, add enabled, update protocol enum, add identity_provider_hostnames has_many relationship - Updated IdentityProviderDomain: add send_welcome_email column Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #60 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196539 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196539&action=edit Bug 39224: Modernise the identity providers admin interface The TT-rendered form was too limiting to support the features required for SAML2/Shibboleth parity. Replace it with a Vue SPA giving full management of: - Providers: code, description, protocol (OAuth/OIDC/SAML2), config, icon, enabled flag. Field mappings are now stored as individual relational records (identity_provider_mappings) rather than a JSON blob on the provider row. - Mappings: per-provider attribute-to-borrower-field mapping records, editable inline in the provider form. - Domain settings: per-provider domain rules (auto-register, update-on-auth, send_welcome_email) managed via the existing domain sub-resource panel. - Hostname assignments: providers can be linked to specific server hostnames with per-hostname enabled/exclusive flags (admin UI; auth enforcement follows in a later commit). Backend additions: - New Koha object classes: Koha::Auth::Hostname/Hostnames, Koha::Auth::Identity::Provider::Hostname/Hostnames, ::Mapping/Mappings, ::SAML2 - REST API: /api/v1/auth/identity_providers (and sub-resources /mappings, /hostnames), /api/v1/auth/hostnames - Shared Vue component improvements: ResourceShow/ResourceFormSave sub-resource panels, RelationshipWidget, FormSection, ShowElement, base-resource composable - Apache RewriteRule to route the new SPA URL to identity_providers.pl - Adds Authen::SAML2 Perl dependency for the SAML2 protocol handler Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #62 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196541 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196541&action=edit Bug 39224: Migrate Shibboleth/SAML2 configuration from koha-conf.xml to database Reads the existing useshibboleth/shibboleth block from koha-conf.xml and migrates it into the unified identity_providers system: 1. Creates a SAML2 provider record from the shibboleth config block 2. Migrates domain settings (auto-register, update-on-auth, matchpoint, attribute mapping) to identity_provider_domains and identity_provider_mappings records 3. Migrates OPACShibOnly/staffShibOnly to is_exclusive on identity_provider_hostnames for the relevant hostname(s) 4. Adds a wildcard ('*') hostname entry for any enabled provider without explicit hostname assignments, preserving existing behaviour 5. Removes the OPACShibOnly and staffShibOnly system preferences Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|40596 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=40596 [Bug 40596] Migrate CAS configuration into Identity Providers -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #63 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196561 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196561&action=edit Bug 39224: Database schema for identity provider modernisation Restructures identity_providers to support SAML2 and per-provider mappings: - Drops mapping/matchpoint columns (moved to new identity_provider_mappings table) - Adds enabled column and updates protocol enum to include SAML2 Adds identity_provider_mappings table for per-provider field mapping records. Adds hostnames and identity_provider_hostnames tables for per-hostname provider visibility and exclusivity (replacing OPACShibOnly/staffShibOnly sysprefs). Adds send_welcome_email column to identity_provider_domains. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #65 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196563 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196563&action=edit Bug 39224: DBIC Schema customisations Add koha_object_class/koha_objects_class accessors for new result classes: - Hostname → Koha::Auth::Hostname / Koha::Auth::Hostnames - IdentityProviderHostname → Koha::Auth::Identity::Provider::Hostname / ::Hostnames - IdentityProviderMapping → Koha::Auth::Identity::Provider::Mapping / ::Mappings Add is_boolean column flags for send_welcome_email in IdentityProviderDomain. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #67 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196565&action=edit Bug 39224: Add per-hostname provider routing, exclusive login and update login pages Providers are now associated with specific server hostnames, mirroring the per-vhost model used by Shibboleth. This benefits all provider types: Exclusive provider support: the per-hostname is_exclusive flag replaces the OPACShibOnly and staffShibOnly system preferences. When set, the login page suppresses local username/password fields and the user is directed straight to that provider — the same force-SSO behaviour previously only available for Shibboleth, now available for any OAuth, OIDC or SAML2 provider. Login page updates: staff auth.tt, OPAC opac-auth.tt and the masthead login modal now query the identity provider REST plugin and render a login button for every enabled provider on the current hostname, not just a single Shibboleth button. SCO/SCI terminals are excluded from exclusive-provider enforcement so self-checkout can always fall back to local login. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #69 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196567 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196567&action=edit Bug 39224: Improve hostname field hint to document '*' wildcard option Patch from commit 0b81ea2 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #71 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 196569 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=196569&action=edit Bug 39224: Add tooltips to clarify the two-layer default value system Explain how mapping-level 'Default value' and domain-level 'Default library'/'Default category' work together: - Mapping Default value: per-field static fallback at patron creation (requires Sync on creation, never used on update). Cross-references domain-level defaults for the library/category use case. - Domain Default library/Default category: per-domain fallbacks applied after attribute mappings, so mappings take precedence. Clarifies that the per-domain placement is intentional — it allows patrons from different email domains to be routed to different libraries/categories. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #73 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- I've tried to clarify how the mapping defaults work, but it's a difficult concept having the branch and category defaults at the email domain level whilst also having defaults at the IdP mapping level. I'd appreciate feedback on this.. are my hints enough to clarify the situation or do we need to rethink how these mappings work a little with regards to 'Email domain rules' level field handling vs IdP Mappings level field handling (this also applies to 'sync' options added in the next bug in this tree really.) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch complexity|Medium patch |Large patch -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #74 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197214 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197214&action=edit Bug 39224: Database schema for identity provider modernisation Restructures identity_providers to support SAML2 and per-provider mappings: - Drops mapping/matchpoint columns (moved to new identity_provider_mappings table) - Adds enabled column and updates protocol enum to include SAML2 Adds identity_provider_mappings table for per-provider field mapping records. Adds hostnames and identity_provider_hostnames tables for per-hostname provider visibility and exclusivity (replacing OPACShibOnly/staffShibOnly sysprefs). Adds send_welcome_email column to identity_provider_domains. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #76 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197216 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197216&action=edit Bug 39224: DBIC Schema customisations Add koha_object_class/koha_objects_class accessors for new result classes: - Hostname → Koha::Auth::Hostname / Koha::Auth::Hostnames - IdentityProviderHostname → Koha::Auth::Identity::Provider::Hostname / ::Hostnames - IdentityProviderMapping → Koha::Auth::Identity::Provider::Mapping / ::Mappings Add is_boolean column flags for send_welcome_email in IdentityProviderDomain. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #78 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197218 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197218&action=edit Bug 39224: Rewrite identity providers admin as a Vue SPA Replaces the previous Template Toolkit driven identity-provider admin form with a Vue SPA that supports the full new schema: providers, per-provider attribute mappings, per-hostname visibility, and domain settings. REST API additions (under /api/v1/auth/): - identity_providers — CRUD for provider records - identity_providers/:id/mappings — CRUD for attribute mappings - identity_providers/:id/domains — existing, now includes send_welcome_email - hostnames — CRUD for global hostname records - identity_providers/:id/hostnames — per-provider hostname assignments New Koha:: object classes: Hostname, IdentityProviderHostname, IdentityProviderMapping, plus SAML2 provider stub. Vue component improvements: RelationshipWidget, FormSection, ResourceShow, ResourceFormSave — shared across the ERM/ILL Vue toolchain. Test plan: 1. Go to Administration > Identity providers. 2. Add a new OAuth provider; configure mappings, domain and hostname assignments — confirm each step saves and displays correctly. 3. Edit an existing provider; verify changes persist. 4. Delete a provider; confirm it disappears from the list. 5. Confirm the REST endpoints respond under /api/v1/auth/identity_providers. Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #80 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197220 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197220&action=edit Bug 39224: Migrate Shibboleth/SAML2 configuration from koha-conf.xml to database Reads the existing useshibboleth/shibboleth block from koha-conf.xml and migrates it into the unified identity_providers system: 1. Creates a SAML2 provider record from the shibboleth config block 2. Migrates domain settings (auto-register, update-on-auth, matchpoint, attribute mapping) to identity_provider_domains and identity_provider_mappings records 3. Migrates OPACShibOnly/staffShibOnly to is_exclusive on identity_provider_hostnames for the relevant hostname(s) 4. Adds a wildcard ('*') hostname entry for any enabled provider without explicit hostname assignments, preserving existing behaviour 5. Removes the OPACShibOnly and staffShibOnly system preferences Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #82 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197222 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197222&action=edit Bug 39224: Unify patron mapping and lookup into Koha::Auth::Client base class Moves three pieces of logic into the Koha::Auth::Client base class so they are available to all identity provider mechanisms: - _get_mapped_data: maps raw IdP data to Koha borrower fields via provider mappings - _find_patron_by_matchpoint: locates a patron by a given matchpoint value; throws the new Koha::Exceptions::Auth::DuplicateMatchpoint when the result is non-unique - _update_patron_from_mapped_data: applies mapped data to a patron object, updating core borrower fields Koha::Auth::Client::OAuth drops its local _find_patron_by_matchpoint in favour of the shared implementation. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #84 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197224 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197224&action=edit Bug 39224: Improve hostname field hint to document '*' wildcard option Patch from commit 3505b4e -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #86 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197226 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197226&action=edit Bug 39224: Add tooltips to clarify the two-layer default value system Explain how mapping-level 'Default value' and domain-level 'Default library'/'Default category' work together: - Mapping Default value: per-field static fallback at patron creation (requires Sync on creation, never used on update). Cross-references domain-level defaults for the library/category use case. - Domain Default library/Default category: per-domain fallbacks applied after attribute mappings, so mappings take precedence. Clarifies that the per-domain placement is intentional — it allows patrons from different email domains to be routed to different libraries/categories. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #197214|0 |1 is obsolete| | Attachment #197215|0 |1 is obsolete| | Attachment #197216|0 |1 is obsolete| | Attachment #197217|0 |1 is obsolete| | Attachment #197218|0 |1 is obsolete| | Attachment #197219|0 |1 is obsolete| | Attachment #197220|0 |1 is obsolete| | Attachment #197221|0 |1 is obsolete| | Attachment #197222|0 |1 is obsolete| | Attachment #197223|0 |1 is obsolete| | Attachment #197224|0 |1 is obsolete| | Attachment #197225|0 |1 is obsolete| | Attachment #197226|0 |1 is obsolete| | Attachment #197227|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #89 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197285 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197285&action=edit Bug 39224: DBIx::Class schema update Automated schema update for new and modified tables: - New: Hostname, IdentityProviderHostname, IdentityProviderMapping result classes - Updated IdentityProvider: remove mapping/matchpoint columns, add enabled, update protocol enum, add identity_provider_hostnames has_many relationship - Updated IdentityProviderDomain: add send_welcome_email column Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #91 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197287 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197287&action=edit Bug 39224: Shared Vue component improvements for sub-resource panels Several shared Vue framework components are improved to better support the inline sub-resource panel pattern used across ERM, ILL, and the new identity providers SPA: - AccordionWrapper: add placeholder group support — a group with a `placeholder` config renders an info-styled banner (description text) instead of a form fieldset, useful for "nothing configured yet" states. - FormElement: fix radio button id/name attributes to use `getElementId` computed property instead of raw `attr.name`, avoiding duplicate ids when the same field appears more than once on a page. - FormSection (new): lightweight wrapper that renders a labelled fieldset section inside a form, replacing ad-hoc `<fieldset>` markup in individual resource forms. - RelationshipWidget: minor prop alignment for consistency. - ResourceShow / ResourceFormSave: extend slot API and layout options for sub-resource panels (used by Mapping and Domain panels in the identity providers SPA, and available to future sub-resources). - ShowElement: add `copy` and `truncate` props to the display component used in ResourceShow panels. - base-resource.js (composable): refactor shared create/update/delete logic so sub-resource panels only need to override the minimal API surface, reducing boilerplate in each resource component. These improvements are self-contained and do not change behaviour for existing ERM or ILL components. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #93 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197289 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197289&action=edit Bug 39224: Add per-hostname provider routing, exclusive login and update login pages Providers are now associated with specific server hostnames, mirroring the per-vhost model used by Shibboleth. This benefits all provider types: Exclusive provider support: the per-hostname is_exclusive flag replaces the OPACShibOnly and staffShibOnly system preferences. When set, the login page suppresses local username/password fields and the user is directed straight to that provider — the same force-SSO behaviour previously only available for Shibboleth, now available for any OAuth, OIDC or SAML2 provider. Login page updates: staff auth.tt, OPAC opac-auth.tt and the masthead login modal now query the identity provider REST plugin and render a login button for every enabled provider on the current hostname, not just a single Shibboleth button. SCO/SCI terminals are excluded from exclusive-provider enforcement so self-checkout can always fall back to local login. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #95 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197291 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197291&action=edit Bug 39224: Introduce Koha::Auth::Client::SAML2 for IPC Shibboleth authentication, remove C4::Auth_with_shibboleth C4::Auth_with_shibboleth was a thin wrapper around legacy Shibboleth IPC functionality. This commit removes it entirely and introduces a new Koha::Auth::Client::SAML2 class that implements IPC Shibboleth authentication using the identity provider framework: - Koha::Auth::Client::SAML2->is_enabled() (was shib_ok()) - Koha::Auth::Client::SAML2->get_matchpoint_value() (was get_login_shib()) - checkpw() reads Apache ENV vars via _load_saml_attributes_from_request() - login_url() / logout_url() for redirect handling - _get_shib_config(), _request_hostname(), _get_session_id_from_env() as private IPC helpers C4/Auth.pm and opac/opac-user.pl updated to call Koha::Auth::Client::SAML2 directly. t/db_dependent/Auth_with_shibboleth.t removed; IPC-mode tests migrated into t/db_dependent/Koha/Auth/Client/SAML2.t. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #97 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197293 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197293&action=edit Bug 39224: Add send_welcome_email support to identity provider authentication Updates identity provider authentication to correctly use the domain-level send_welcome_email setting when creating new patron accounts via OAuth, OIDC, Shibboleth and SAML2 identity providers. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #99 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197295 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197295&action=edit Bug 39224: Reorder attribute mapping fields and make IdP field optional Put 'Koha field' before 'IdP field' in both the display table and the edit form. Remove the required constraint from 'IdP field' so that a mapping can be used solely for its default value without needing an IdP attribute to map from. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #101 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197297 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197297&action=edit Bug 39224: Smart default value input for attribute mappings Replace the plain text input for 'Default value' in the attribute mappings form with a context-aware component (PatronFieldValueInput) that adapts based on the selected Koha field: - branchcode → library selector (v-select populated from libraries_map) - categorycode → patron category selector (v-select from categories_map) - all others → plain text input (existing behaviour) The default value is also cleared automatically when the Koha field changes, preventing stale values (e.g. a branchcode) from persisting silently when the mapping target is switched to a different field. PatronFieldValueInput is placed at the top-level components/ directory rather than under IdentityProviders/ as the concept — rendering an appropriate input for a given patron field value — is reusable across any part of the Vue application that needs it. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Clemens Tubach <clemens.tubach@kit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Failed QA --- Comment #103 from Clemens Tubach <clemens.tubach@kit.edu> --- When migrating an existing provider (updatedatabase), the matchpoint is lost. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #104 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 197371 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=197371&action=edit Bug 39224: (follow-up) Preserve matchpoint on upgrade and use wildcard fallback The atomicupdate dropped identity_providers.matchpoint before the orphan-provider loop seeded the per-hostname wildcard row, so pre-existing OAuth/OIDC providers landed in the new schema with matchpoint=NULL. The OAuth and SAML2 clients also did an exact hostname match when loading the matchpoint, so the wildcard row the atomicupdate does seed was never consulted, leaving $matchpoint undef and producing: Use of uninitialized value \$matchpoint in hash element at Koha/Auth/Client/OAuth.pm line 77 (and 96) Use of uninitialized value within @_ in list assignment at Koha/Auth/Client.pm line 235 Koha::Exceptions::Auth::Unauthorized -- External auth user cannot access resource This patch: * In installer/data/mysql/atomicupdate/bug_39224.pl, reads the old identity_providers.matchpoint values into a hash before dropping the column and threads them through the orphan-provider INSERT into identity_provider_hostnames, so the upgraded matchpoint survives. * Adds Koha::Auth::Identity::Provider->hostname_link(\$http_host) which walks Koha::Auth::Identity::Providers->hostname_candidates (full host, bare host, '*') and returns the first matching identity_provider_hostname row in preference order. * Uses the new helper from Koha::Auth::Client::OAuth and the two matchpoint-lookup sites in Koha::Auth::Client::SAML2 so the wildcard row is actually consulted when no specific hostname row exists. Test plan: 1. On a database with an OAuth/OIDC provider that has a matchpoint set under the old schema, run updatedatabase. The output now echoes the preserved matchpoint (e.g. "Added wildcard hostname entry for provider 'X' (matchpoint=userid)") and \`SELECT matchpoint FROM identity_provider_hostnames\` shows the carried-over value instead of NULL. 2. Re-run updatedatabase; no errors, no changes (idempotent). 3. prove t/db_dependent/Koha/Auth/Client.t \\ t/db_dependent/Koha/Auth/Client/OAuth.t \\ t/db_dependent/Koha/Auth/Client/SAML2.t \\ t/db_dependent/Koha/Auth/Identity/Provider.t 4. Trigger an OAuth login from a hostname that only has a wildcard hostname row for the provider. The three "uninitialized value" warnings above no longer appear and the existing patron is resolved. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #106 from Clemens Tubach <clemens.tubach@kit.edu> --- (In reply to Martin Renvoize (ashimema) from comment #105)

Thanks for testing Clemens.. I see the issue now and it highlighted a small bug in the code for hostname lookup on top of the migration issue.

I've added a follow-up which should hopefully resolve both.

You are welcome! Yes, both issues have been resolved, thank you! The test plan in #104 works. Output from the updatedatabase re-run: Removed system preferences 'OPACShibOnly' and 'staffShibOnly' Ensured wildcard hostname '*' exists (hostname_id=3) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Clemens Tubach <clemens.tubach@kit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Patch doesn't apply --- Comment #108 from Clemens Tubach <clemens.tubach@kit.edu> --- I can't test everything. For example, I can't test the attachment "Migrate Shibboleth/SAML2 configuration from koha-conf.xml to database." I can test the test plans from comments 92 and 104. Is that enough? Should I sign off anyway? -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #110 from Clemens Tubach <clemens.tubach@kit.edu> --- (In reply to David Cook from comment #109)

(In reply to Clemens Tubach from comment #108)

...

I can't test everything. For example, I can't test the attachment "Migrate Shibboleth/SAML2 configuration from koha-conf.xml to database." I can test the test plans from comments 92 and 104. Is that enough? Should I sign off anyway?

Did you mean to mark it as "Patch doesn't apply"? Were the patches able to successfully apply or not?

No, not at the moment. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Patch doesn't apply |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #112 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202030 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202030&action=edit Bug 39224: Database schema for identity provider modernisation Restructures identity_providers to support SAML2 and per-provider mappings: - Drops mapping/matchpoint columns (moved to new identity_provider_mappings table) - Adds enabled column and updates protocol enum to include SAML2 Adds identity_provider_mappings table for per-provider field mapping records. Adds hostnames and identity_provider_hostnames tables for per-hostname provider visibility and exclusivity (replacing OPACShibOnly/staffShibOnly sysprefs). Adds send_welcome_email column to identity_provider_domains. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #114 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202032 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202032&action=edit Bug 39224: DBIC Schema customisations Add koha_object_class/koha_objects_class accessors for new result classes: - Hostname → Koha::Auth::Hostname / Koha::Auth::Hostnames - IdentityProviderHostname → Koha::Auth::Identity::Provider::Hostname / ::Hostnames - IdentityProviderMapping → Koha::Auth::Identity::Provider::Mapping / ::Mappings Add is_boolean column flags for send_welcome_email in IdentityProviderDomain. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #116 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202034 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202034&action=edit Bug 39224: Rewrite identity providers admin as a Vue SPA Replaces the previous Template Toolkit driven identity-provider admin form with a Vue SPA that supports the full new schema: providers, per-provider attribute mappings, per-hostname visibility, and domain settings. REST API additions (under /api/v1/auth/): - identity_providers — CRUD for provider records - identity_providers/:id/mappings — CRUD for attribute mappings - identity_providers/:id/domains — existing, now includes send_welcome_email - hostnames — CRUD for global hostname records - identity_providers/:id/hostnames — per-provider hostname assignments New Koha:: object classes: Hostname, IdentityProviderHostname, IdentityProviderMapping, plus SAML2 provider stub. Vue component improvements: RelationshipWidget, FormSection, ResourceShow, ResourceFormSave — shared across the ERM/ILL Vue toolchain. Test plan: 1. Go to Administration > Identity providers. 2. Add a new OAuth provider; configure mappings, domain and hostname assignments — confirm each step saves and displays correctly. 3. Edit an existing provider; verify changes persist. 4. Delete a provider; confirm it disappears from the list. 5. Confirm the REST endpoints respond under /api/v1/auth/identity_providers. Sponsored-by: ByWater Solutions -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #118 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202036 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202036&action=edit Bug 39224: Migrate Shibboleth/SAML2 configuration from koha-conf.xml to database Reads the existing useshibboleth/shibboleth block from koha-conf.xml and migrates it into the unified identity_providers system: 1. Creates a SAML2 provider record from the shibboleth config block 2. Migrates domain settings (auto-register, update-on-auth, matchpoint, attribute mapping) to identity_provider_domains and identity_provider_mappings records 3. Migrates OPACShibOnly/staffShibOnly to is_exclusive on identity_provider_hostnames for the relevant hostname(s) 4. Adds a wildcard ('*') hostname entry for any enabled provider without explicit hostname assignments, preserving existing behaviour 5. Removes the OPACShibOnly and staffShibOnly system preferences Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #120 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202038 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202038&action=edit Bug 39224: Unify patron mapping and lookup into Koha::Auth::Client base class Moves three pieces of logic into the Koha::Auth::Client base class so they are available to all identity provider mechanisms: - _get_mapped_data: maps raw IdP data to Koha borrower fields via provider mappings - _find_patron_by_matchpoint: locates a patron by a given matchpoint value; throws the new Koha::Exceptions::Auth::DuplicateMatchpoint when the result is non-unique - _update_patron_from_mapped_data: applies mapped data to a patron object, updating core borrower fields Koha::Auth::Client::OAuth drops its local _find_patron_by_matchpoint in favour of the shared implementation. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #122 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202040 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202040&action=edit Bug 39224: Improve hostname field hint to document '*' wildcard option -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #124 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202042 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202042&action=edit Bug 39224: Add tooltips to clarify the two-layer default value system Explain how mapping-level 'Default value' and domain-level 'Default library'/'Default category' work together: - Mapping Default value: per-field static fallback at patron creation (requires Sync on creation, never used on update). Cross-references domain-level defaults for the library/category use case. - Domain Default library/Default category: per-domain fallbacks applied after attribute mappings, so mappings take precedence. Clarifies that the per-domain placement is intentional — it allows patrons from different email domains to be routed to different libraries/categories. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #126 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202044 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202044&action=edit Bug 39224: Re-throw errors in onFormSave so save failures are visible The catch blocks in ProviderResource and MappingResource were swallowing errors, causing ResourceFormSave to silently stay on the form with no indication the save failed. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #128 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 202046 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202046&action=edit Bug 39224: (QA follow-up) Enforce provider config validation at store time Config invariants were only enforced in set_config(), which callers can bypass entirely (set_from_api, direct accessor writes). Following the pattern established by Koha::File::Transport - which validates in store() so an invalid transport can never be persisted - the provider's mandatory config attributes are now also checked at store time, resolving the concrete subclass through the collection's polymorphic map. The REST controller already routes Koha::Exceptions::MissingParameter to a 400 response, so API behaviour is unchanged for valid requests. Test plan: 1. prove t/db_dependent/Koha/Auth/Identity/Provider.t 2. Attempt to save an OAuth provider without config via the API => SUCCESS: 400 missing_parameter response, nothing persisted -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Clemens Tubach <clemens.tubach@kit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202030|0 |1 is obsolete| | Attachment #202031|0 |1 is obsolete| | Attachment #202032|0 |1 is obsolete| | Attachment #202033|0 |1 is obsolete| | Attachment #202034|0 |1 is obsolete| | Attachment #202035|0 |1 is obsolete| | Attachment #202036|0 |1 is obsolete| | Attachment #202037|0 |1 is obsolete| | Attachment #202038|0 |1 is obsolete| | Attachment #202039|0 |1 is obsolete| | Attachment #202040|0 |1 is obsolete| | Attachment #202041|0 |1 is obsolete| | Attachment #202042|0 |1 is obsolete| | Attachment #202043|0 |1 is obsolete| | Attachment #202044|0 |1 is obsolete| | Attachment #202045|0 |1 is obsolete| | Attachment #202046|0 |1 is obsolete| | Attachment #202047|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #131 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202446 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202446&action=edit Bug 39224: DBIx::Class schema update Automated schema update for new and modified tables: - New: Hostname, IdentityProviderHostname, IdentityProviderMapping result classes - Updated IdentityProvider: remove mapping/matchpoint columns, add enabled, update protocol enum, add identity_provider_hostnames has_many relationship - Updated IdentityProviderDomain: add send_welcome_email column Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #133 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202448 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202448&action=edit Bug 39224: Shared Vue component improvements for sub-resource panels Several shared Vue framework components are improved to better support the inline sub-resource panel pattern used across ERM, ILL, and the new identity providers SPA: - AccordionWrapper: add placeholder group support — a group with a `placeholder` config renders an info-styled banner (description text) instead of a form fieldset, useful for "nothing configured yet" states. - FormElement: fix radio button id/name attributes to use `getElementId` computed property instead of raw `attr.name`, avoiding duplicate ids when the same field appears more than once on a page. - FormSection (new): lightweight wrapper that renders a labelled fieldset section inside a form, replacing ad-hoc `<fieldset>` markup in individual resource forms. - RelationshipWidget: minor prop alignment for consistency. - ResourceShow / ResourceFormSave: extend slot API and layout options for sub-resource panels (used by Mapping and Domain panels in the identity providers SPA, and available to future sub-resources). - ShowElement: add `copy` and `truncate` props to the display component used in ResourceShow panels. - base-resource.js (composable): refactor shared create/update/delete logic so sub-resource panels only need to override the minimal API surface, reducing boilerplate in each resource component. These improvements are self-contained and do not change behaviour for existing ERM or ILL components. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #135 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202450 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202450&action=edit Bug 39224: Add per-hostname provider routing, exclusive login and update login pages Providers are now associated with specific server hostnames, mirroring the per-vhost model used by Shibboleth. This benefits all provider types: Exclusive provider support: the per-hostname is_exclusive flag replaces the OPACShibOnly and staffShibOnly system preferences. When set, the login page suppresses local username/password fields and the user is directed straight to that provider — the same force-SSO behaviour previously only available for Shibboleth, now available for any OAuth, OIDC or SAML2 provider. Login page updates: staff auth.tt, OPAC opac-auth.tt and the masthead login modal now query the identity provider REST plugin and render a login button for every enabled provider on the current hostname, not just a single Shibboleth button. SCO/SCI terminals are excluded from exclusive-provider enforcement so self-checkout can always fall back to local login. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #137 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202452 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202452&action=edit Bug 39224: Introduce Koha::Auth::Client::SAML2 for IPC Shibboleth authentication, remove C4::Auth_with_shibboleth C4::Auth_with_shibboleth was a thin wrapper around legacy Shibboleth IPC functionality. This commit removes it entirely and introduces a new Koha::Auth::Client::SAML2 class that implements IPC Shibboleth authentication using the identity provider framework: - Koha::Auth::Client::SAML2->is_enabled() (was shib_ok()) - Koha::Auth::Client::SAML2->get_matchpoint_value() (was get_login_shib()) - checkpw() reads Apache ENV vars via _load_saml_attributes_from_request() - login_url() / logout_url() for redirect handling - _get_shib_config(), _request_hostname(), _get_session_id_from_env() as private IPC helpers C4/Auth.pm and opac/opac-user.pl updated to call Koha::Auth::Client::SAML2 directly. t/db_dependent/Auth_with_shibboleth.t removed; IPC-mode tests migrated into t/db_dependent/Koha/Auth/Client/SAML2.t. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #139 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202454 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202454&action=edit Bug 39224: Add send_welcome_email support to identity provider authentication Updates identity provider authentication to correctly use the domain-level send_welcome_email setting when creating new patron accounts via OAuth, OIDC, Shibboleth and SAML2 identity providers. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #141 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202456 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202456&action=edit Bug 39224: Reorder attribute mapping fields and make IdP field optional Put 'Koha field' before 'IdP field' in both the display table and the edit form. Remove the required constraint from 'IdP field' so that a mapping can be used solely for its default value without needing an IdP attribute to map from. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #143 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202458 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202458&action=edit Bug 39224: Smart default value input for attribute mappings Replace the plain text input for 'Default value' in the attribute mappings form with a context-aware component (PatronFieldValueInput) that adapts based on the selected Koha field: - branchcode → library selector (v-select populated from libraries_map) - categorycode → patron category selector (v-select from categories_map) - all others → plain text input (existing behaviour) The default value is also cleared automatically when the Koha field changes, preventing stale values (e.g. a branchcode) from persisting silently when the mapping target is switched to a different field. PatronFieldValueInput is placed at the top-level components/ directory rather than under IdentityProviders/ as the concept — rendering an appropriate input for a given patron field value — is reusable across any part of the Vue application that needs it. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #145 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202460 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202460&action=edit Bug 39224: (follow-up) Preserve matchpoint on upgrade and use wildcard fallback The atomicupdate dropped identity_providers.matchpoint before the orphan-provider loop seeded the per-hostname wildcard row, so pre-existing OAuth/OIDC providers landed in the new schema with matchpoint=NULL. The OAuth and SAML2 clients also did an exact hostname match when loading the matchpoint, so the wildcard row the atomicupdate does seed was never consulted, leaving $matchpoint undef and producing: Use of uninitialized value \$matchpoint in hash element at Koha/Auth/Client/OAuth.pm line 77 (and 96) Use of uninitialized value within @_ in list assignment at Koha/Auth/Client.pm line 235 Koha::Exceptions::Auth::Unauthorized -- External auth user cannot access resource This patch: * In installer/data/mysql/atomicupdate/bug_39224.pl, reads the old identity_providers.matchpoint values into a hash before dropping the column and threads them through the orphan-provider INSERT into identity_provider_hostnames, so the upgraded matchpoint survives. * Adds Koha::Auth::Identity::Provider->hostname_link(\$http_host) which walks Koha::Auth::Identity::Providers->hostname_candidates (full host, bare host, '*') and returns the first matching identity_provider_hostname row in preference order. * Uses the new helper from Koha::Auth::Client::OAuth and the two matchpoint-lookup sites in Koha::Auth::Client::SAML2 so the wildcard row is actually consulted when no specific hostname row exists. Test plan: 1. On a database with an OAuth/OIDC provider that has a matchpoint set under the old schema, run updatedatabase. The output now echoes the preserved matchpoint (e.g. "Added wildcard hostname entry for provider 'X' (matchpoint=userid)") and \`SELECT matchpoint FROM identity_provider_hostnames\` shows the carried-over value instead of NULL. 2. Re-run updatedatabase; no errors, no changes (idempotent). 3. prove t/db_dependent/Koha/Auth/Client.t \\ t/db_dependent/Koha/Auth/Client/OAuth.t \\ t/db_dependent/Koha/Auth/Client/SAML2.t \\ t/db_dependent/Koha/Auth/Identity/Provider.t 4. Trigger an OAuth login from a hostname that only has a wildcard hostname row for the provider. The three "uninitialized value" warnings above no longer appear and the existing patron is resolved. Sponsored-by: ByWater Solutions Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #147 from Clemens Tubach <clemens.tubach@kit.edu> --- Created attachment 202462 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202462&action=edit Bug 39224: (QA follow-up) Add Koha::Auth::Client->for_protocol factory Callers dispatching on a provider's protocol column had to hard-code client class names (if/else chains naming Koha::Auth::Client::SAML2 etc). This adds a small factory so new auth mechanisms only need a new entry in the protocol map, and uses it at the exclusive-provider redirect site in C4::Auth. Unknown protocols throw the new Koha::Exceptions::Auth::UnsupportedProtocol exception. Also documents why the exclusive SAML2 redirect is additionally guarded by $shib (is_enabled() validates web-server integration beyond the DB enabled flag). Test plan: 1. prove t/db_dependent/Koha/Auth/Client.t 2. Configure an exclusive SAML2 provider for a hostname and verify the login page still redirects to the IdP Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Clemens Tubach <clemens.tubach@kit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #202445|0 |1 is obsolete| | Attachment #202446|0 |1 is obsolete| | Attachment #202447|0 |1 is obsolete| | Attachment #202448|0 |1 is obsolete| | Attachment #202449|0 |1 is obsolete| | Attachment #202450|0 |1 is obsolete| | Attachment #202451|0 |1 is obsolete| | Attachment #202452|0 |1 is obsolete| | Attachment #202453|0 |1 is obsolete| | Attachment #202454|0 |1 is obsolete| | Attachment #202455|0 |1 is obsolete| | Attachment #202456|0 |1 is obsolete| | Attachment #202457|0 |1 is obsolete| | Attachment #202458|0 |1 is obsolete| | Attachment #202459|0 |1 is obsolete| | Attachment #202460|0 |1 is obsolete| | Attachment #202461|0 |1 is obsolete| | Attachment #202462|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #150 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204698 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204698&action=edit Bug 39224: DBIx::Class schema update Automated schema update for new and modified tables: - New: Hostname, IdentityProviderHostname, IdentityProviderMapping result classes - Updated IdentityProvider: remove mapping/matchpoint columns, add enabled, update protocol enum, add identity_provider_hostnames has_many relationship - Updated IdentityProviderDomain: add send_welcome_email column Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #152 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204700 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204700&action=edit Bug 39224: Shared Vue component improvements for sub-resource panels Several shared Vue framework components are improved to better support the inline sub-resource panel pattern used across ERM, ILL, and the new identity providers SPA: - AccordionWrapper: add placeholder group support — a group with a `placeholder` config renders an info-styled banner (description text) instead of a form fieldset, useful for "nothing configured yet" states. - FormElement: fix radio button id/name attributes to use `getElementId` computed property instead of raw `attr.name`, avoiding duplicate ids when the same field appears more than once on a page. - FormSection (new): lightweight wrapper that renders a labelled fieldset section inside a form, replacing ad-hoc `<fieldset>` markup in individual resource forms. - RelationshipWidget: minor prop alignment for consistency. - ResourceShow / ResourceFormSave: extend slot API and layout options for sub-resource panels (used by Mapping and Domain panels in the identity providers SPA, and available to future sub-resources). - ShowElement: add `copy` and `truncate` props to the display component used in ResourceShow panels. - base-resource.js (composable): refactor shared create/update/delete logic so sub-resource panels only need to override the minimal API surface, reducing boilerplate in each resource component. These improvements are self-contained and do not change behaviour for existing ERM or ILL components. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #154 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204702 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204702&action=edit Bug 39224: Add per-hostname provider routing, exclusive login and update login pages Providers are now associated with specific server hostnames, mirroring the per-vhost model used by Shibboleth. This benefits all provider types: Exclusive provider support: the per-hostname is_exclusive flag replaces the OPACShibOnly and staffShibOnly system preferences. When set, the login page suppresses local username/password fields and the user is directed straight to that provider — the same force-SSO behaviour previously only available for Shibboleth, now available for any OAuth, OIDC or SAML2 provider. Login page updates: staff auth.tt, OPAC opac-auth.tt and the masthead login modal now query the identity provider REST plugin and render a login button for every enabled provider on the current hostname, not just a single Shibboleth button. SCO/SCI terminals are excluded from exclusive-provider enforcement so self-checkout can always fall back to local login. Sponsored-by: ByWater Solutions Co-authored-by: Jacob O'Mara <jacob.omara@openfifth.co.uk> Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #156 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204704 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204704&action=edit Bug 39224: Introduce Koha::Auth::Client::SAML2 for IPC Shibboleth authentication, remove C4::Auth_with_shibboleth C4::Auth_with_shibboleth was a thin wrapper around legacy Shibboleth IPC functionality. This commit removes it entirely and introduces a new Koha::Auth::Client::SAML2 class that implements IPC Shibboleth authentication using the identity provider framework: - Koha::Auth::Client::SAML2->is_enabled() (was shib_ok()) - Koha::Auth::Client::SAML2->get_matchpoint_value() (was get_login_shib()) - checkpw() reads Apache ENV vars via _load_saml_attributes_from_request() - login_url() / logout_url() for redirect handling - _get_shib_config(), _request_hostname(), _get_session_id_from_env() as private IPC helpers C4/Auth.pm and opac/opac-user.pl updated to call Koha::Auth::Client::SAML2 directly. t/db_dependent/Auth_with_shibboleth.t removed; IPC-mode tests migrated into t/db_dependent/Koha/Auth/Client/SAML2.t. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #158 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204706 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204706&action=edit Bug 39224: Add send_welcome_email support to identity provider authentication Updates identity provider authentication to correctly use the domain-level send_welcome_email setting when creating new patron accounts via OAuth, OIDC, Shibboleth and SAML2 identity providers. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #160 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204708 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204708&action=edit Bug 39224: Reorder attribute mapping fields and make IdP field optional Put 'Koha field' before 'IdP field' in both the display table and the edit form. Remove the required constraint from 'IdP field' so that a mapping can be used solely for its default value without needing an IdP attribute to map from. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #162 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204710 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204710&action=edit Bug 39224: Smart default value input for attribute mappings Replace the plain text input for 'Default value' in the attribute mappings form with a context-aware component (PatronFieldValueInput) that adapts based on the selected Koha field: - branchcode → library selector (v-select populated from libraries_map) - categorycode → patron category selector (v-select from categories_map) - all others → plain text input (existing behaviour) The default value is also cleared automatically when the Koha field changes, preventing stale values (e.g. a branchcode) from persisting silently when the mapping target is switched to a different field. PatronFieldValueInput is placed at the top-level components/ directory rather than under IdentityProviders/ as the concept — rendering an appropriate input for a given patron field value — is reusable across any part of the Vue application that needs it. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #164 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204712 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204712&action=edit Bug 39224: (follow-up) Preserve matchpoint on upgrade and use wildcard fallback The atomicupdate dropped identity_providers.matchpoint before the orphan-provider loop seeded the per-hostname wildcard row, so pre-existing OAuth/OIDC providers landed in the new schema with matchpoint=NULL. The OAuth and SAML2 clients also did an exact hostname match when loading the matchpoint, so the wildcard row the atomicupdate does seed was never consulted, leaving $matchpoint undef and producing: Use of uninitialized value \$matchpoint in hash element at Koha/Auth/Client/OAuth.pm line 77 (and 96) Use of uninitialized value within @_ in list assignment at Koha/Auth/Client.pm line 235 Koha::Exceptions::Auth::Unauthorized -- External auth user cannot access resource This patch: * In installer/data/mysql/atomicupdate/bug_39224.pl, reads the old identity_providers.matchpoint values into a hash before dropping the column and threads them through the orphan-provider INSERT into identity_provider_hostnames, so the upgraded matchpoint survives. * Adds Koha::Auth::Identity::Provider->hostname_link(\$http_host) which walks Koha::Auth::Identity::Providers->hostname_candidates (full host, bare host, '*') and returns the first matching identity_provider_hostname row in preference order. * Uses the new helper from Koha::Auth::Client::OAuth and the two matchpoint-lookup sites in Koha::Auth::Client::SAML2 so the wildcard row is actually consulted when no specific hostname row exists. Test plan: 1. On a database with an OAuth/OIDC provider that has a matchpoint set under the old schema, run updatedatabase. The output now echoes the preserved matchpoint (e.g. "Added wildcard hostname entry for provider 'X' (matchpoint=userid)") and \`SELECT matchpoint FROM identity_provider_hostnames\` shows the carried-over value instead of NULL. 2. Re-run updatedatabase; no errors, no changes (idempotent). 3. prove t/db_dependent/Koha/Auth/Client.t \\ t/db_dependent/Koha/Auth/Client/OAuth.t \\ t/db_dependent/Koha/Auth/Client/SAML2.t \\ t/db_dependent/Koha/Auth/Identity/Provider.t 4. Trigger an OAuth login from a hostname that only has a wildcard hostname row for the provider. The three "uninitialized value" warnings above no longer appear and the existing patron is resolved. Sponsored-by: ByWater Solutions Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #166 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204714 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204714&action=edit Bug 39224: (QA follow-up) Add Koha::Auth::Client->for_protocol factory Callers dispatching on a provider's protocol column had to hard-code client class names (if/else chains naming Koha::Auth::Client::SAML2 etc). This adds a small factory so new auth mechanisms only need a new entry in the protocol map, and uses it at the exclusive-provider redirect site in C4::Auth. Unknown protocols throw the new Koha::Exceptions::Auth::UnsupportedProtocol exception. Also documents why the exclusive SAML2 redirect is additionally guarded by $shib (is_enabled() validates web-server integration beyond the DB enabled flag). Test plan: 1. prove t/db_dependent/Koha/Auth/Client.t 2. Configure an exclusive SAML2 provider for a hostname and verify the login page still redirects to the IdP Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #168 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204716 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204716&action=edit Bug 39224: (QA follow-up) Unify identity provider login link rendering across protocols The SAML2 branch skipped the | url filter (needed because its URL is already fully percent-encoded server-side by Koha::Auth::Client::SAML2's login_url(), and re-encoding would double-encode it) while OAuth/OIDC applied it. The asymmetry looked like an escaping bug but wasn't one: AuthClient.pm's _provider_entry() already strips <>"' from every provider's URL regardless of protocol, which is what actually prevents href attribute breakout - the | url filter was redundant defense-in-depth on the OAuth/OIDC branch only. Drop the per-protocol branching entirely and use the same '| $raw' output for every protocol, matching the pattern already used elsewhere in these same templates (casServerUrl, Koha.CSPNonce). Verified against Koha::Template::Plugin::raw's own source (a documented no-op pass-through filter, required by Koha's auto-escaping TT setup) and confirmed both templates still pass xt/tt_tidy.t. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Initiative type|--- |Epic Target Milestone|--- |26.11 Strategic theme|--- |Modernisation -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on|38201 | Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38201 [Bug 38201] VueJS architecture rethink -- You are receiving this mail because: You are watching all bug changes.