|
Lines 105-134
sub checkpw_ldap {
Link Here
|
| 105 |
my $db = Net::LDAP->new(\@hosts); |
105 |
my $db = Net::LDAP->new(\@hosts); |
| 106 |
#$debug and $db->debug(5); |
106 |
#$debug and $db->debug(5); |
| 107 |
my $userldapentry; |
107 |
my $userldapentry; |
| 108 |
if ( $ldap->{auth_by_bind} ) { |
|
|
| 109 |
my $principal_name = $ldap->{principal_name}; |
| 110 |
if ($principal_name and $principal_name =~ /\%/) { |
| 111 |
$principal_name = sprintf($principal_name,$userid); |
| 112 |
} else { |
| 113 |
$principal_name = $userid; |
| 114 |
} |
| 115 |
my $res = $db->bind( $principal_name, password => $password ); |
| 116 |
if ( $res->code ) { |
| 117 |
$debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res); |
| 118 |
return 0; |
| 119 |
} |
| 120 |
|
108 |
|
| 121 |
# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind! |
109 |
if ( $ldap->{auth_by_bind} ) { |
|
|
110 |
# Perform an anonymous bind |
| 111 |
my $res = $db->bind; |
| 112 |
if ( $res->code ) { |
| 113 |
$debug and warn "Anonymous LDAP bind failed: ". description($res); |
| 114 |
return 0; |
| 115 |
} |
| 116 |
|
| 117 |
# Perform a LDAP search for the given username |
| 118 |
my $search = search_method($db, $userid) or return 0; # warnings are in the sub |
| 119 |
$userldapentry = $search->shift_entry; |
| 122 |
|
120 |
|
| 123 |
# BUG #5094 |
121 |
# Perform a LDAP bind for the given username using the matched DN |
| 124 |
# 2010-08-04 JeremyC |
122 |
my $res = $db->bind( $userldapentry->dn, password => $password ); |
| 125 |
# a $userldapentry is only needed if either updating or replicating are enabled |
123 |
if ( $res->code ) { |
| 126 |
if($config{update} or $config{replicate}) { |
124 |
$debug and warn "LDAP bind failed as kohauser $userid: ". description($res); |
| 127 |
my $search = search_method($db, $userid) or return 0; # warnings are in the sub |
125 |
return 0; |
| 128 |
$userldapentry = $search->shift_entry; |
126 |
} |
| 129 |
} |
|
|
| 130 |
|
127 |
|
| 131 |
} else { |
128 |
} else { |
| 132 |
my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); |
129 |
my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); |
| 133 |
if ($res->code) { # connection refused |
130 |
if ($res->code) { # connection refused |
| 134 |
warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); |
131 |
warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); |
|
Lines 419-426
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
| 419 |
<update>1</update> <!-- update existing users in Koha database --> |
416 |
<update>1</update> <!-- update existing users in Koha database --> |
| 420 |
<auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of |
417 |
<auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of |
| 421 |
password comparison, e.g., to use Active Directory --> |
418 |
password comparison, e.g., to use Active Directory --> |
| 422 |
<principal_name>%s@my_domain.com</principal_name> |
|
|
| 423 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid --> |
| 424 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
419 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
| 425 |
<firstname is="givenname" ></firstname> |
420 |
<firstname is="givenname" ></firstname> |
| 426 |
<surname is="sn" ></surname> |
421 |
<surname is="sn" ></surname> |
| 427 |
- |
|
|