Bugzilla – Attachment 22590 Details for
Bug 8993
LDAP authentication improvements: multiple branch and transformation modules
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 8993 - my attempt to get this module working
Bug-8993---my-attempt-to-get-this-module-working.patch (text/plain), 6.72 KB, created by
Julian Maurice
on 2013-10-30 13:51:11 UTC
(
hide
)
Description:
Bug 8993 - my attempt to get this module working
Filename:
MIME Type:
Creator:
Julian Maurice
Created:
2013-10-30 13:51:11 UTC
Size:
6.72 KB
patch
obsolete
>From e299f89480a0bff12d6eada5427e6aeea2623229 Mon Sep 17 00:00:00 2001 >From: Dobrica Pavlinusic <dpavlin@rot13.org> >Date: Thu, 21 Mar 2013 15:48:47 +0100 >Subject: [PATCH] Bug 8993 - my attempt to get this module working > >QA note: please fail this patch. With all this changes, I'm still not >able to login using following configuration: > ><ldapserver uri="ldaps://ldap.ffzg.hr" > authmethod="search_dn" > replicate="1" update="0" > userid_from="uid" > > > > <branch dn="dc=ffzg,dc=hr" /> > > <transformation module="C4::LDAPTransform::RepeatableValues" /> > ></ldapserver> > >This should be one of more simple configuration, and it doesn't work >with this patch. While I would love to have LDAP transformations >in perl code, I think this patch is too big rewrite with a lot of >edge cases which aren't convered. >--- > C4/Auth_with_ldap.pm | 14 ++++++++----- > C4/LDAPAuthMethodTutorial.pod | 37 +++++++++++++++++++++++++--------- > C4/LDAPTransform/RepeatableValues.pm | 27 +++++++++++++++++++++++++ > 3 files changed, 64 insertions(+), 14 deletions(-) > create mode 100644 C4/LDAPTransform/RepeatableValues.pm > >diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm >index 95f22a0..4b9e4b9 100644 >--- a/C4/Auth_with_ldap.pm >+++ b/C4/Auth_with_ldap.pm >@@ -78,7 +78,7 @@ unless ( $$ldap{authmethod} ) { > > $ldapname = $ldap->{user}; > $ldappassword = $ldap->{pass}; >-our %mapping = %{$ldap->{mapping}}; # FIXME dpavlin -- don't die because of || (); from 6eaf8511c70eb82d797c941ef528f4310a15e9f9 >+our %mapping = %{$ldap->{mapping}} if $ldap->{mapping}; > my @mapkeys = keys %mapping; > $debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys ( total ): ", join ' ', @mapkeys, "\n"; > @mapkeys = grep {defined $mapping{$_}->{is}} @mapkeys; >@@ -178,7 +178,7 @@ sub accept_borrower { > } > } > >- my ($id) = exists_local( $userid ) or debug_msg "$userid is newcommer"; >+ my ($id, $cardnumber) = exists_local( $userid ) or debug_msg "$userid is newcommer"; > > my $newcommer = not $id; > >@@ -190,7 +190,7 @@ sub accept_borrower { > if ( $config{replicate} ) { > delete $$borrower{column}{dateenrolled}; > delete $$borrower{column}{dateexpiry}; >- my $cardnumber = update_local >+ $cardnumber = update_local > ( $userid, $$borrower{column}{password}, $id, $$borrower{column} ); > if ( my $old_cardnumber = $$borrower{column}{cardnumber} ) { > if ( $old_cardnumber ne $cardnumber ) { >@@ -206,7 +206,7 @@ sub accept_borrower { > set_xattr $id, $borrower; > } > >- return 1 >+ return ( 1, $cardnumber, $userid ); > } > > sub cnx { >@@ -215,7 +215,11 @@ sub cnx { > }; > # bind MUST success > my $msg = eval { >- $cnx->bind ($ldap->{manager}, password => $ldap->{password}) >+ if ( $ldap->{manager} ) { >+ $cnx->bind ($ldap->{manager}, password => $ldap->{password}) >+ } else { >+ $cnx->bind(); >+ } > }; > debug_msg "ldap $_:", $msg->$_ for qw/ error code /; > if ( $@ ) { >diff --git a/C4/LDAPAuthMethodTutorial.pod b/C4/LDAPAuthMethodTutorial.pod >index 92cac6b..440c110 100644 >--- a/C4/LDAPAuthMethodTutorial.pod >+++ b/C4/LDAPAuthMethodTutorial.pod >@@ -8,12 +8,12 @@ a try if your needs of mappings and transformations are low. > > =head3 How to reach the service > >-What we need is build the url of the ldap service we want to reach. So ask him >+What we need is build the uri of the ldap service we want to reach. So ask him > for the URL. If he don't know, ask for the scheme (or protocol), the hostname > and the port of the directory. Only hostname and scheme are mandatory. > > The scheme must be ldap or ldaps (ldaps is for crypted ldap, ldap over SSL). >-The url construction is: >+The uri construction is: > > scheme://hostname:port > scheme://hostname >@@ -49,17 +49,15 @@ First of all, you need to tell koha that ldap authentication is now relevant > > <useldapserver>1</useldapserver> > >-If you use anonymous method, you have to give credentials of koha account >+If you are using anonymous method, you just omit LDAP credentials > >- <ldapserver url="ldap://directory.example.com" >- manager="uid=koha,ou=people,dc=example,dc=com" >- password="MYS3CRET" >+ <ldapserver uri="ldap://directory.example.com" > authmethod="search_dn" > > > Also, you can set the values for replication and update (documented in legacy > pod): > >- <ldapserver url="ldap://directory.example.com" >+ <ldapserver uri="ldap://directory.example.com" > manager="uid=koha,ou=people,dc=example,dc=com" > password="MYS3CRET" > authmethod="search_dn" >@@ -69,7 +67,7 @@ pod): > You must now tell koha the ldap branches where to find users > > <useldapserver>1</useldapserver> >- <ldapserver url="ldap://directory.example.com" >+ <ldapserver uri="ldap://directory.example.com" > manager="uid=koha,ou=people,dc=example,dc=com" > password="MYS3CRET" > authmethod="search_dn" >@@ -85,7 +83,28 @@ sofisticated transformations directly in perl: > > <transformation module="C4::LDAPTransform::CustomTransform" /> > >-This module only have to define a subroutine named get_borrower >+This module only have to define a subroutine named get_borrower which will >+receive C<Net::LDAP::Entry> object and returns hash which corresponds to >+fields in C<borrowers> table similar to: > >+ { >+ column => { >+ email => "test.user\\@example.com", >+ firstname => "Test", >+ surname => "User" >+ userid => "testuser", >+ } >+ } > >+If you don't have <mapping> section in your C<kona-conf.xml> you will have >+to add additional attribute to your ldapserver directive to indicate which >+field will be used to bind to LDAP using <userid_from>: >+ >+ <ldapserver uri="ldap://directory.example.com" >+ manager="uid=koha,ou=people,dc=example,dc=com" >+ password="MYS3CRET" >+ authmethod="search_dn" >+ replicate="1" update="1" >+ userid_from="uid" >+ > > >diff --git a/C4/LDAPTransform/RepeatableValues.pm b/C4/LDAPTransform/RepeatableValues.pm >new file mode 100644 >index 0000000..dc7c289 >--- /dev/null >+++ b/C4/LDAPTransform/RepeatableValues.pm >@@ -0,0 +1,27 @@ >+package C4::LDAPTransform::Example; >+ >+use warnings; >+use strict; >+ >+my $mapping = { qw/ >+givenName firstname >+sn surname >+uid userid >+mail email >+/ }; >+ >+sub get_borrower { >+ my $ldap_entry = shift; >+ $ldap_entry->isa('Net::LDAP::Entry') or die "argument to transform get_borrower is not Net::LDAP::Entry"; >+ >+ my $user = { column => {} }; >+ >+ while (my ($from, $to) = each %$mapping) { >+ my @vals = $ldap_entry->get_value( $from ); >+ $user->{column}->{$to} = $vals[0]; >+ } >+ >+ return $user; >+} >+ >+1; >-- >1.7.10.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 8993
:
13129
|
13130
|
13131
|
13132
|
14219
|
14460
|
14461
|
16659
|
16796
|
18804
|
18805
|
18806
|
18807
|
18808
|
21345
|
21346
|
21347
|
21348
|
21349
|
22580
|
22581
|
22582
|
22583
|
22584
|
22588
|
22589
|
22590
|
22591
|
22592
|
38270
|
38271
|
38273
|
38274