[Bug 20854] New: Redirect after logout with CAS 3.0 broken
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Bug ID: 20854 Summary: Redirect after logout with CAS 3.0 broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: katrin.fischer@bsz-bw.de QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org There has been a change in the parameters for the logout request between CAS 2.0 und CAS 3.0: Redirect URL parameter CAS 2.0: url CAS 3.0: service The CAS module used by Koha officially only support CAS 2.0, so when you logout from a CAS 3.0 server now, the redirect to Koha will be broken. See here: https://github.com/apereo/cas/blob/master/docs/cas-server-documentation/prot... Note: The url parameter defined in the former CAS 2.0 specification is not a valid parameter in CAS 3.0 anymore. CAS Servers MUST ignore given url parameters. A CAS client MAY provide the service parameter as described above, as this ensures the parameter is validated against the registered service URLs when operating in non-open mode. See 2.3.2 for details. We are using the following 'hack' to make the redirect work correctly: C4/Auth_with_cas.pm $uri =~ s/\?logout\.x=1//; # We don't want to keep triggering a logout, if we got here, the borrower is already logged out of Koha - print $query->redirect( $cas->logout_url(url => $uri)); + my $logout_url = $cas->logout_url(url => $uri); + $logout_url =~ s/url/service/; + print $query->redirect( $logout_url ); We won't have time to fix this properly, but wanted to document problem and workaround at least. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tomascohen@gmail.com --- Comment #1 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Can we add a syspref to specify the CAS protocol version and have the behaviour adjust as required on each case? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #2 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- It could work - if people are ok with that. Cleaner would be fixing the external module, but much harder to do :( -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #3 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Katrin Fischer from comment #2)
It could work - if people are ok with that. Cleaner would be fixing the external module, but much harder to do :(
Is there a bug filed for the Authen::CAS::Client library? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Thx, Tomas! https://rt.cpan.org/Ticket/Display.html?id=125833 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #5 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Katrin Fischer from comment #4)
Thx, Tomas!
I still think we should have a 'CASVersion' syspref that controls this behaviour, until there's a response from the library maintainer. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #6 from Matthias Meusburger <matthias.meusburger@biblibre.com> --- Created attachment 112561 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=112561&action=edit Bug 20854: Allow correct redirect on logout for Cas servers 3.0 and superior. Test plan: 1) Apply the patch 2) Set the system preference casLogout to "Yes" 3) Set the new system preference CasServerVersion to "CAS 3 or superior" 4) Check that you are redirected to Koha after a CAS logout from a CAS 3 server 5) Set the new system preference CasServerVersion to "CAS 2 or inferior" 6) Check that you are redirected to Koha after a CAS logout from a CAS 2 server -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Matthias Meusburger <matthias.meusburger@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff CC| |matthias.meusburger@biblibr | |e.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Matthias Meusburger <matthias.meusburger@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |matthias.meusburger@biblibr |ity.org |e.com -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Tomás Cohen Arazi <tomascohen@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #112561|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #7 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 118347 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=118347&action=edit Bug 20854: Allow correct redirect on logout for Cas servers 3.0 and superior. Test plan: 1) Apply the patch 2) Set the system preference casLogout to "Yes" 3) Set the new system preference CasServerVersion to "CAS 3 or superior" 4) Check that you are redirected to Koha after a CAS logout from a CAS 3 server 5) Set the new system preference CasServerVersion to "CAS 2 or inferior" 6) Check that you are redirected to Koha after a CAS logout from a CAS 2 server Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #8 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 118348 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=118348&action=edit Bug 20854: Add more CAS tests This patch aims to add full test coverage for 'logout_cas' the way we do it nowadays (in a subtest, mocking things, etc). It is provided as a separate patch so we can test the follow-up tidy and see no behavior change. To test: 1. Run: $ kshell k$ prove t/db_dependent/Auth_with_cas.t => SUCCESS: Tests pass! 2. Apply this patch 3. Repeat 1 => SUCCESS: Tests pass! 4. Apply the refactoring follow-up 5. Repeat 3 => SUCCESS: Tests still pass! 6. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #9 from Tomás Cohen Arazi <tomascohen@gmail.com> --- Created attachment 118349 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=118349&action=edit Bug 20854: (QA follow-up) Improve readability The logout_cas method does too little tasks. In this case, I consider we should not split it into a separate method. As the CAS implementation lacked tests, it made sense to do it like this, so it is testable. But now we have higher-level tests for logout_cas, we can bake the behavior inside of it, and it is testable. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #10 from Tomás Cohen Arazi <tomascohen@gmail.com> --- (In reply to Tomás Cohen Arazi from comment #5)
(In reply to Katrin Fischer from comment #4)
Thx, Tomas!
I still think we should have a 'CASVersion' syspref that controls this behaviour, until there's a response from the library maintainer.
Still no response, BTW. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- For comparison, this is the change we have been using in production for years now: - print $query->redirect( $cas->logout_url(url => $uri)); + my $logout_url = $cas->logout_url(url => $uri); + $logout_url =~ s/url/service/; + print $query->redirect( $logout_url ); This is from the patch: + my $logout_url = $cas->logout_url( url => $uri ); + $logout_url =~ s/url=/service=/ + if C4::Context->preference('casServerVersion') eq '3'; + + print $query->redirect($logout_url); -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #118347|0 |1 is obsolete| | --- Comment #12 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 119789 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=119789&action=edit Bug 20854: Allow correct redirect on logout for Cas servers 3.0 and superior. Test plan: 1) Apply the patch 2) Set the system preference casLogout to "Yes" 3) Set the new system preference CasServerVersion to "CAS 3 or superior" 4) Check that you are redirected to Koha after a CAS logout from a CAS 3 server 5) Set the new system preference CasServerVersion to "CAS 2 or inferior" 6) Check that you are redirected to Koha after a CAS logout from a CAS 2 server Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #118348|0 |1 is obsolete| | --- Comment #13 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 119790 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=119790&action=edit Bug 20854: Add more CAS tests This patch aims to add full test coverage for 'logout_cas' the way we do it nowadays (in a subtest, mocking things, etc). It is provided as a separate patch so we can test the follow-up tidy and see no behavior change. To test: 1. Run: $ kshell k$ prove t/db_dependent/Auth_with_cas.t => SUCCESS: Tests pass! 2. Apply this patch 3. Repeat 1 => SUCCESS: Tests pass! 4. Apply the refactoring follow-up 5. Repeat 3 => SUCCESS: Tests still pass! 6. Sign off :-D Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #118349|0 |1 is obsolete| | --- Comment #14 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 119791 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=119791&action=edit Bug 20854: (QA follow-up) Improve readability The logout_cas method does too little tasks. In this case, I consider we should not split it into a separate method. As the CAS implementation lacked tests, it made sense to do it like this, so it is testable. But now we have higher-level tests for logout_cas, we can bake the behavior inside of it, and it is testable. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #15 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Created attachment 119792 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=119792&action=edit Bug 20854: (QA follow-up) Rephrase of the new casServerVersion pref description For another related change, see: https://en.wikipedia.org/wiki/Central_Authentication_Service CAS = Central Authentication Service Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the| |This patch adds a new release notes| |system preference | |casServerUrl, that will | |allow Koha to work | |correctly with different | |CAS protocol versions. In | |this case it fixes a | |problem that arose by | |changing the name of a | |parameter in the logout | |request between CAS 2 and 3 | |that broke the redirect | |after successful logout. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Manual -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #16 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Shouldn't the default for new installs be 3? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Text to go in the|This patch adds a new |This patch adds a new release notes|system preference |system preference |casServerUrl, that will |casServerVersion, that will |allow Koha to work |allow Koha to work |correctly with different |correctly with different |CAS protocol versions. In |CAS protocol versions. In |this case it fixes a |this case it fixes a |problem that arose by |problem that arose by |changing the name of a |changing the name of a |parameter in the logout |parameter in the logout |request between CAS 2 and 3 |request between CAS 2 and 3 |that broke the redirect |that broke the redirect |after successful logout. |after successful logout. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to master Version(s)| |21.05.00 released in| | -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 --- Comment #17 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Pushed to master for 21.05, thanks to everybody involved! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #18 from David Cook <dcook@prosentient.com.au> --- I didn't realize that people were still using the CAS protocol. So interesting. By the way, it looks like there is a Docker container for the CAS server. It looks like it supports CAS, SAML, and OpenID Connect protocols, so this could be an interesting server to add to koha-testing-docker for testing. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Fridolin Somers <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version(s)|21.05.00 |21.05.00,20.11.06 released in| | Status|Pushed to master |Pushed to stable CC| |fridolin.somers@biblibre.co | |m --- Comment #19 from Fridolin Somers <fridolin.somers@biblibre.com> --- Pushed to 20.11.x for 20.11.06 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Andrew Fuerste-Henry <andrew@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to stable |Pushed to oldstable CC| |andrew@bywatersolutions.com Version(s)|21.05.00,20.11.06 |21.05.00,20.11.06,20.05.12 released in| | --- Comment #20 from Andrew Fuerste-Henry <andrew@bywatersolutions.com> --- Pushed to 20.05.x for 20.05.12 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20854 Victor Grousset/tuxayo <victor@tuxayo.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to oldstable |RESOLVED CC| |victor@tuxayo.net --- Comment #21 from Victor Grousset/tuxayo <victor@tuxayo.net> --- Not backported to oldoldstable (19.11.x). Feel free to ask if it's needed. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org