Bug 5094

Summary: auth_by_bind authentication can fail even if given a correct password and userid
Product: Koha Reporter: Jeremy Crabtree <JeremyC>
Component: AuthenticationAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Bugs List <koha-bugs>
Severity: major    
Priority: PATCH-Sent (DO NOT USE) CC: chris, dpavlin, JeremyC, melia, ohiocore, wallen_tan
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Proposed fix for this bug

Description Jeremy Crabtree 2010-08-05 14:22:14 UTC
When using

<replicate>0</replicate> <!-- add new users from LDAP to Koha database -->
<update>0</update> <!-- update existing users in Koha database ->
<auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding instead of password comparison, e.g., to use Active Directory -->

Auth_with_ldap attempts to lookup the userid in the LDAP directory to fill $userldapentry despite it being unneeded in this case.  The information retrieved will be thrown away, thus there is no need to retrieve it.  This can cause authentication to fail overall even if the initial bind with the user's credentials succeeded.
Comment 1 Jeremy Crabtree 2010-08-05 14:32:37 UTC
Created attachment 2474 [details] [review]
Proposed fix for this bug

This is a proposed fix for this bug.  It skips the creation of $userldapentry if neither updating nor replicating are enabled.
Comment 2 Joe Atzberger 2011-06-14 15:14:47 UTC
Confirm bug from d114ebe80adc7b2c34d08d94c17d302b3ddda4be.  search_method must NOT be called if bind has already occurred, because it will bind again and with different credentials depending on config (likely anonymously).  This is important for auth_by_bind for obvious reasons, mainly that Active Directory doesn't allow you to view the same record anonymously that you would get when bound as the user.  

Even if it were successful (which it isn't), binding twice is logically incorrect and bad for performance.

The amount of complexity in the LDAP code is seriously regrettable.
Comment 3 Joe Atzberger 2011-06-15 22:51:53 UTC
Tested OK with auth_by_bind, no replicate, no update, no static bind user/pass.  Patch sent to the list.
Comment 4 Joe Atzberger 2011-06-15 23:22:02 UTC
Adding patch status.  Increasing importance.  This is actually a blocker for LDAP to Active Directory w/ a given config.
Comment 5 Chris Cormack 2011-06-17 03:09:58 UTC
Pushed to master, welcome to the Koha committer family Jeremy

Dobrica, can you please run your tests against master.
Comment 6 Dobrica Pavlinusic 2011-07-14 15:55:44 UTC
Testeda against current master, it works fine, thanks.

I would remove comment line with FIXME dpavlin from it, since it is unneeded left-over :-)
Comment 7 Melia Meggs 2011-09-21 18:11:07 UTC
Reopening in hopes that we can get update/replicate to work.
Comment 8 Rex Wallen Tan 2011-10-27 08:17:22 UTC
Proposing Bug 7099 with a fix

It deals with the Update/Replicate problem in ActiveDirectory (made a separate bug since its not related to the title)
Comment 9 Dobrica Pavlinusic 2011-10-27 20:07:12 UTC
*** Bug 7099 has been marked as a duplicate of this bug. ***
Comment 10 Dobrica Pavlinusic 2011-10-27 20:07:52 UTC
(In reply to comment #7)
> Reopening in hopes that we can get update/replicate to work.
Comment 11 Dobrica Pavlinusic 2011-10-27 20:08:25 UTC
Current master at http://git.koha-community.org includes this fix.