Bug 7973 breaks LDAP for many users, particularly those using active directory by removing the normal auth_by_bind behaviour and requiring that there is an anonymous user to search LDAP with.
These are the sort of errors you'll see in the logs: [Wed Sep 18 15:39:10 2013] opac-user.pl: LDAP Auth rejected : (cn=testuser) gets 0 hits [Wed Sep 18 15:39:10 2013] opac-user.pl: LDAP error #1: LDAP_OPERATIONS_ERROR [Wed Sep 18 15:39:10 2013] opac-user.pl: # Server encountered an internal error
Created attachment 21154 [details] [review] Bug 10908 - fix broken LDAP Recent changes to LDAP broke auth_by_bind in many situations. This bug resets the behaviour to what it used to be, however also allows the new behaviour by adding the 'anonymous_bind' parameter to the LDAP config. Testing: 1) Find an LDAP configuration that was broken recently that uses auth_by_bind 2) Apply this patch 3) See if it works again. Additionally, testing the original path in the case of 'anonymous_bind' being set should probably be done too, but I have no idea about the LDAP server config for that.
Created attachment 21155 [details] [review] Bug 10908 - restore docs on principal_name
So, going back to the ldap methods described in bug 7973 and bug 10842, the new set of methods including your patch would be? Method 1: 1) Bind with a service account 2) Search for user entered 3) Bind as user if found Method 2: 1) Bind with an Anonymous user 2) Search for user entered 3) Bind as user if found. Method 3 (The original): 1) Bind directly to the user, no search takes place. Just trying to clarify for myself and others. Is that correct Robin?
That's how I understand it, though method three actually does do a search in that it searches for itself in order to fetch the whole record from LDAP. However, in essence you're correct as far as I can tell.
Created attachment 21652 [details] [review] Bug 10908 - fix broken LDAP tested with OpenLDAP in front of AD
Created attachment 21653 [details] [review] Bug 10908 - restore docs on principal_name
Thanks Uli! :)
This is a blocker - as Uli from BSZ has signed off I shouldn't do QA and I honestly can't because I don't know how to set up a test environment for LDAP. Is there someone else who can on the QA team?
sudo apt-get install ldap-server Make sure to remember the password you use to set this up! Next, we'll figure out the connection string. sudo slapcat The second entries 'dn' line will be important in setting up LDAP authentication sudo apt-get install phpldapadmin Now you should be able to web browse to http.../phpldapadmin and actually log in with the information you got from slapcat. cn=admin;dc=<from slapcat> <password set while installing ldap-server> Congratulations, you have an LDAP server with just the admin user set up on your machine. Feel free to "sudo apt-get remove phpldapadmin". That was just to prove the set up was working. Then you'll need to tweak your koha-conf.xml hostname should be the nice name you'd use for the machine. base I matched to be "dc=<slapcat mess>" same with user. and of course principle_name. in the mapping section, the branchcode and patron code better be in your system already. <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id='ldapserver' listenref='ldapserver'> <hostname>demo.library.kohasystem.ca</hostname> <base>dc=nodomain</base> <user>CN=admin,OU=Special,OU=Accounts,DC=nodomain</user> <pass>ldap123</pass> <replicate>1</replicate> <update>1</update> <auth_by_bind>1</auth_by_bind> <principal_name>CN=%s,DC=nodomain</principal_name> <mapping> <firstname is='givenname'></firstname> <surname is='sn'> </surname> <address is='postaladdress'>3900 University Blvd</address> <city is='l'>Tyler, TX</city> <zipcode is='postalcode'>75799</zipcode> <branchcode is=''>MNL</branchcode> <userid is='cn'></userid> <password is=''></password> <cardnumber is='extensionattribute2'></cardnumber> <email is='userprincipalname'></email> <categorycode is=''>PT</categorycode> <phone is='telephonenumber'>903-566-7343</phone> <dateenrolled is=''>2011-03-27</dateenrolled> <dateexpiry is=''>2011-05-13</dateexpiry> </mapping> </ldapserver> Hope this helps, KF.
Thx Mark. I am not sure when I have time for this - if anyone wants to have a go on this I would appreciate it.
Created attachment 22119 [details] [PASSED-QA] Bug 10908 - fix broken LDAP Recent changes to LDAP broke auth_by_bind in many situations. This bug resets the behaviour to what it used to be, however also allows the new behaviour by adding the 'anonymous_bind' parameter to the LDAP config. Testing: 1) Find an LDAP configuration that was broken recently that uses auth_by_bind 2) Apply this patch 3) See if it works again. Additionally, testing the original path in the case of 'anonymous_bind' being set should probably be done too, but I have no idea about the LDAP server config for that. Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Created attachment 22121 [details] [review] [PASSED-QA] Bug 10908 - restore docs on principal_name Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Created attachment 22137 [details] [review] [PASSED-QA] Bug 10908 - fix broken LDAP Recent changes to LDAP broke auth_by_bind in many situations. This bug resets the behaviour to what it used to be, however also allows the new behaviour by adding the 'anonymous_bind' parameter to the LDAP config. Testing: 1) Find an LDAP configuration that was broken recently that uses auth_by_bind 2) Apply this patch 3) See if it works again. Additionally, testing the original path in the case of 'anonymous_bind' being set should probably be done too, but I have no idea about the LDAP server config for that. Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Created attachment 22138 [details] [review] [PASSED-QA] Bug 10908 - restore docs on principal_name Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Pushed to master. Thanks, Robin!
I see that we use those patches locally on 3.12.7 and wonder why I marked it resolved fixed. Resetting to pushed to stable to get it checked for backporting.
*** Bug 10842 has been marked as a duplicate of this bug. ***