|
Lines 261-281
sub exists_local {
Link Here
|
| 261 |
return 0; |
261 |
return 0; |
| 262 |
} |
262 |
} |
| 263 |
|
263 |
|
|
|
264 |
# This function performs a password update, given the userid, borrowerid, |
| 265 |
# and digested password. It will verify that things are correct and return the |
| 266 |
# borrowers cardnumber. The idea is that it is used to keep the local |
| 267 |
# passwords in sync with the LDAP passwords. |
| 268 |
# |
| 269 |
# $cardnum = _do_changepassword($userid, $borrowerid, $digest) |
| 270 |
# |
| 271 |
# Note: if the LDAP config has the update_password tag set to a false value, |
| 272 |
# then this will not update the password, it will simply return the cardnumber. |
| 264 |
sub _do_changepassword { |
273 |
sub _do_changepassword { |
| 265 |
my ($userid, $borrowerid, $digest) = @_; |
274 |
my ( $userid, $borrowerid, $digest ) = @_; |
| 266 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
275 |
|
| 267 |
changepassword($userid, $borrowerid, $digest); |
276 |
if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) { |
| 268 |
|
277 |
|
| 269 |
# Confirm changes |
278 |
# This path doesn't update the password, just returns the |
| 270 |
my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); |
279 |
# card number |
| 271 |
$sth->execute($borrowerid); |
280 |
my $sth = C4::Context->dbh->prepare( |
| 272 |
if ($sth->rows) { |
281 |
'SELECT cardnumber FROM borrowers WHERE borrowernumber=?' ); |
| 273 |
my ($md5password, $cardnum) = $sth->fetchrow; |
282 |
$sth->execute($borrowerid); |
| 274 |
($digest eq $md5password) and return $cardnum; |
283 |
die |
| 275 |
warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; |
284 |
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid" |
| 276 |
return; |
285 |
if !$sth->rows; |
| 277 |
} |
286 |
my ($cardnum) = $sth->fetchrow; |
| 278 |
die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; |
287 |
return $cardnum; |
|
|
288 |
} |
| 289 |
else { |
| 290 |
|
| 291 |
# This path updates the password in the database |
| 292 |
print STDERR |
| 293 |
"changing local password for borrowernumber=$borrowerid to '$digest'\n" |
| 294 |
if $debug; |
| 295 |
changepassword( $userid, $borrowerid, $digest ); |
| 296 |
|
| 297 |
# Confirm changes |
| 298 |
my $sth = C4::Context->dbh->prepare( |
| 299 |
"SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? " |
| 300 |
); |
| 301 |
$sth->execute($borrowerid); |
| 302 |
if ( $sth->rows ) { |
| 303 |
my ( $md5password, $cardnum ) = $sth->fetchrow; |
| 304 |
( $digest eq $md5password ) and return $cardnum; |
| 305 |
warn |
| 306 |
"Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; |
| 307 |
return; |
| 308 |
} |
| 309 |
die |
| 310 |
"Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; |
| 311 |
} |
| 279 |
} |
312 |
} |
| 280 |
|
313 |
|
| 281 |
sub update_local { |
314 |
sub update_local { |
|
Lines 421-426
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
| 421 |
password comparison, e.g., to use Active Directory --> |
454 |
password comparison, e.g., to use Active Directory --> |
| 422 |
<principal_name>%s@my_domain.com</principal_name> |
455 |
<principal_name>%s@my_domain.com</principal_name> |
| 423 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid --> |
456 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid --> |
|
|
457 |
<update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords |
| 458 |
synced to the local database --> |
| 424 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
459 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
| 425 |
<firstname is="givenname" ></firstname> |
460 |
<firstname is="givenname" ></firstname> |
| 426 |
<surname is="sn" ></surname> |
461 |
<surname is="sn" ></surname> |
|
Lines 478-483
attribute that the server allows to be used for binding could be used.
Link Here
|
| 478 |
|
513 |
|
| 479 |
Currently, principal_name only operates when auth_by_bind is enabled. |
514 |
Currently, principal_name only operates when auth_by_bind is enabled. |
| 480 |
|
515 |
|
|
|
516 |
=head2 update_password |
| 517 |
|
| 518 |
If this tag is left out or set to a true value, then the user's LDAP password |
| 519 |
will be stored (hashed) in the local Koha database. If you don't want this |
| 520 |
to happen, then set the value of this to '0'. Note that if passwords are not |
| 521 |
stored locally, and the connection to the LDAP system fails, then the users |
| 522 |
will not be able to log in at all. |
| 523 |
|
| 481 |
=head2 Active Directory |
524 |
=head2 Active Directory |
| 482 |
|
525 |
|
| 483 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
526 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
| 484 |
- |
|
|