Koha & ldap authentication fail authenticating new users when enabling plack, it works fine only if plack is desabled. Ldap authentication works fine with old registered users.
More on this bug: the problem is add new user from LDAP, using the automatic population of Koha borrower table by LDAP.
This is a rather bad bug, can we do something about it?
Is anybody interested in fixing this bad bug?
Hello Jonathan, We plan to work on this bug with Fridolin during our tech camp (30/01 -> 03/02). I'm comfortable with LDAP things and Fridolin with plack.
A slightly more concerning part of this, is after you fix the more obvious problem of C4::AddMember being undefined (even though it's technically there), there is a problem with the sessions between the OPAC and the intranet - i.e. the next action a logged in staff user will make is "permission denied" requiring them to log in again. I'm still testing to see if this is specifically to do with "replicate" or if it happens with LDAP logins generally. Liz
and when that ldap user logs out, the staff user, no matter who it is, is logged out as well.
Created attachment 59644 [details] [review] Bug 17775 - Add new user with LDAP not works under Plack This patch fixes internal server error: Undefined subroutine &C4::Auth_with_ldap::AddMember called at /srv/koha_ffzg/C4/Auth_with_ldap.pm line 213. It occurs only under plack, and it's strange since C4::Members does EXPORT AddMember and we are importing it into Auth_with_ldap.pm (and it does work under CGI).
Alex, sorry to steal this one from you, but we hit this one when we deploy master in production, so here if fix for it.
Hi, I thought this was the problem too - but there is another problem. Sessions created for the LDAP created user hijack any sessions from the same IP, including staff ones. I don't think of it as a separate bug - I think symptoms of the same problem. Cheers, Liz
Actually never mind, this sessions thing is a problem generally with plack, with or without LDAP. I only wish I had submitted my identical patch 2 weeks ago >.< Thanks for fixing this, Dobrica! Liz
Created attachment 59662 [details] [review] y# Attachment to Bug 17775 - Add new user with LDAP not works under Plack Bug 17775 - Add new user with LDAP not works under Plack This patch fixes internal server error: Undefined subroutine &C4::Auth_with_ldap::AddMember called at /srv/koha_ffzg/C4/Auth_with_ldap.pm line 213. It occurs only under plack, and it's strange since C4::Members does EXPORT AddMember and we are importing it into Auth_with_ldap.pm (and it does work under CGI). Signed-off-by: Liz Rea <liz@catalyst.net.nz>
Having a quick look at C4::Auth_with_ldap I am pretty sure there are other bugs under plack. Variable scoping in this module is very bad, have a look at $ldap, $prefhost, $base,...
(In reply to Liz Rea from comment #9) > Hi, > I thought this was the problem too - but there is another problem. Sessions > created for the LDAP created user hijack any sessions from the same IP, > including staff ones. I don't think of it as a separate bug - I think > symptoms of the same problem. > > Cheers, > Liz Liz, can you expand on this a little bit more? I know that login into OPAC or Intranet will be transferred between then (so if you login into intranet you will also be logged into opac). Is that what you are having problem with? This behavior is because we are registering cookies on hostname (whole hostname) so if OPAC and intranet are on the same hostname (but different path or ports) they will share session. If they are on different hostnames, they will not share sessions. Does this make sense?
(In reply to Jonathan Druart from comment #12) > Having a quick look at C4::Auth_with_ldap I am pretty sure there are other > bugs under plack. Variable scoping in this module is very bad, have a look > at $ldap, $prefhost, $base,... Yes, it's very bad code but we haven't hit any bugs in it (yet) and we'll need to rewrite it for DBIx anyway.
Just forget I said anything at all. Patch fixes the issue, and it's quite a bad one.
Created attachment 59722 [details] [review] Bug 17775 - Add new user with LDAP not works under Plack This patch fixes internal server error: Undefined subroutine &C4::Auth_with_ldap::AddMember called at /srv/koha_ffzg/C4/Auth_with_ldap.pm line 213. It occurs only under plack, and it's strange since C4::Members does EXPORT AddMember and we are importing it into Auth_with_ldap.pm (and it does work under CGI). Signed-off-by: Liz Rea <liz@catalyst.net.nz> Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com> I did not test but trust author and signoffer. The change cannot hurt.
Pushed to master for 17.05, thanks Dobrica!
This patch has been pushed to 16.11.x and will be in 16.11.04.
Pushed to 3.22.x for 3.22.17
Pushed to 16.05.x, for 16.05.10 release