Bug 10925 - LDAP Auth fails if DEBUG is enable
Summary: LDAP Auth fails if DEBUG is enable
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 10927
  Show dependency treegraph
 
Reported: 2013-09-20 15:20 UTC by Jonathan Druart
Modified: 2014-05-26 21:04 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 10925: LDAP auth fails if DEBUG is enable (1.61 KB, patch)
2013-09-20 15:38 UTC, Jonathan Druart
Details | Diff | Splinter Review
[SIGNED OFF] Bug 10925: LDAP auth fails if DEBUG is enable (1.68 KB, patch)
2013-09-28 15:47 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 10925: LDAP auth fails if DEBUG is enable (1.77 KB, patch)
2013-09-30 22:04 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2013-09-20 15:20:19 UTC
It the env var DEBUG is enable, the LDAP auth fails.
Comment 1 Jonathan Druart 2013-09-20 15:38:21 UTC Comment hidden (obsolete)
Comment 2 I'm just a bot 2013-09-24 05:40:42 UTC
Patch applied cleanly, go forth and signoff
Comment 3 Mark Tompsett 2013-09-28 15:47:56 UTC Comment hidden (obsolete)
Comment 4 Mark Tompsett 2013-09-28 15:48:55 UTC
Comment on attachment 21282 [details] [review]
Bug 10925: LDAP auth fails if DEBUG is enable

Figured out how to test this....

I set up an LDAP server on my koha VM:
$ sudo apt-get install ldap-server
$ sudo slapcat
The second entry's 'dn' line will be important in setting up LDAP authentication.

Made sure to set up the koha-conf.xml
 <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on -->
<ldapserver id='ldapserver'  listenref='ldapserver'>
<hostname>demo.library.kohasystem.ca</hostname>
<base>dc=nodomain</base>
<user>CN=admin,OU=Special,OU=Accounts,DC=nodomain</user>
<pass>ldap123</pass>
<replicate>1</replicate>
<update>1</update>
<auth_by_bind>1</auth_by_bind>
<principal_name>CN=%s,DC=nodomain</principal_name>
<mapping>
<firstname    is='givenname'></firstname>
<surname      is='sn'> </surname>
<address      is='postaladdress'>3900 University Blvd</address>
<city         is='l'>Tyler, TX</city>
<zipcode      is='postalcode'>75799</zipcode>
<branchcode   is=''>MNL</branchcode>
<userid       is='cn'></userid>
<password     is=''></password>
<cardnumber   is='extensionattribute2'></cardnumber>
<email        is='userprincipalname'></email>
<categorycode is=''>PT</categorycode>
<phone        is='telephonenumber'>903-566-7343</phone>
<dateenrolled is=''>2011-03-27</dateenrolled>
<dateexpiry   is=''>2011-05-13</dateexpiry>
</mapping>
</ldapserver>

It is important to get the patron type and branch code to match something in your DB. Notice the principle_name line is similar to the second entry's 'dn' line.

And yes, I was lazy setting it up and used ldap123 as the password for the admin account. And since I didn't know how to set up any other accounts, I just used the admin account.

I then proceeded to log in using OPAC.

BEFORE PATCH:
#SetEnv DEBUG 1
delete patron
log in, log out, log in, log out (previously exist or not cases)
-- ALL GOOD!

SetEnv DEBUG 1
delete patron
log in, log in (previously exist or not cases)
-- ALL FAIL!


AFTER PATCH:
-- ALL GOOD!

Signed off. YAY!
Comment 5 Chris Cormack 2013-09-30 22:04:38 UTC
Created attachment 21685 [details] [review]
Bug 10925: LDAP auth fails if DEBUG is enable

To reproduce:
1/ Edit your apache virtual host and set the DEBUG environment variable
(SetEnv DEBUG 1).
2/ Try to login with an ldap user
3/ You will be redirected to the 500 error page.
The Koha logs contains:
malformed header from script. Bad header=------------------------------: mainpage.pl

The hashdump routine directly punks to the STDOUT (!) and breaks the
headers.
It appears Net::LDAP::?->dump does the same thing.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Maybe we can kill C4::Utils after getting rid of this
Comment 6 Mark Tompsett 2013-09-30 22:36:02 UTC
(In reply to Chris Cormack from comment #5)
> Maybe we can kill C4::Utils after getting rid of this

That's what 10927 does. I've signed it off. It is awaiting QA.
Comment 7 Galen Charlton 2013-10-02 14:27:41 UTC
Pushed to master.  Thanks, Jonathan!
Comment 8 Tomás Cohen Arazi (tcohen) 2013-11-13 17:33:33 UTC
This patch has been pushed to 3.12.x, will be in 3.12.7.

Thanks Jonathan!