|
Lines 258-278
sub exists_local {
Link Here
|
| 258 |
return 0; |
258 |
return 0; |
| 259 |
} |
259 |
} |
| 260 |
|
260 |
|
|
|
261 |
# This function performs a password update, given the userid, borrowerid, |
| 262 |
# and digested password. It will verify that things are correct and return the |
| 263 |
# borrowers cardnumber. The idea is that it is used to keep the local |
| 264 |
# passwords in sync with the LDAP passwords. |
| 265 |
# |
| 266 |
# $cardnum = _do_changepassword($userid, $borrowerid, $digest) |
| 267 |
# |
| 268 |
# Note: if the LDAP config has the update_password tag set to a false value, |
| 269 |
# then this will not update the password, it will simply return the cardnumber. |
| 261 |
sub _do_changepassword { |
270 |
sub _do_changepassword { |
| 262 |
my ($userid, $borrowerid, $digest) = @_; |
271 |
my ( $userid, $borrowerid, $digest ) = @_; |
| 263 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
272 |
|
| 264 |
changepassword($userid, $borrowerid, $digest); |
273 |
if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) { |
| 265 |
|
274 |
|
| 266 |
# Confirm changes |
275 |
# This path doesn't update the password, just returns the |
| 267 |
my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); |
276 |
# card number |
| 268 |
$sth->execute($borrowerid); |
277 |
my $sth = C4::Context->dbh->prepare( |
| 269 |
if ($sth->rows) { |
278 |
'SELECT cardnumber FROM borrowers WHERE borrowernumber=?' ); |
| 270 |
my ($md5password, $cardnum) = $sth->fetchrow; |
279 |
$sth->execute($borrowerid); |
| 271 |
($digest eq $md5password) and return $cardnum; |
280 |
die |
| 272 |
warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; |
281 |
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid" |
| 273 |
return; |
282 |
if !$sth->rows; |
| 274 |
} |
283 |
my ($cardnum) = $sth->fetchrow; |
| 275 |
die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; |
284 |
return $cardnum; |
|
|
285 |
} |
| 286 |
else { |
| 287 |
|
| 288 |
# This path updates the password in the database |
| 289 |
print STDERR |
| 290 |
"changing local password for borrowernumber=$borrowerid to '$digest'\n" |
| 291 |
if $debug; |
| 292 |
changepassword( $userid, $borrowerid, $digest ); |
| 293 |
|
| 294 |
# Confirm changes |
| 295 |
my $sth = C4::Context->dbh->prepare( |
| 296 |
"SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? " |
| 297 |
); |
| 298 |
$sth->execute($borrowerid); |
| 299 |
if ( $sth->rows ) { |
| 300 |
my ( $md5password, $cardnum ) = $sth->fetchrow; |
| 301 |
( $digest eq $md5password ) and return $cardnum; |
| 302 |
warn |
| 303 |
"Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; |
| 304 |
return; |
| 305 |
} |
| 306 |
die |
| 307 |
"Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; |
| 308 |
} |
| 276 |
} |
309 |
} |
| 277 |
|
310 |
|
| 278 |
sub update_local { |
311 |
sub update_local { |
|
Lines 416-421
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
| 416 |
<update>1</update> <!-- update existing users in Koha database --> |
449 |
<update>1</update> <!-- update existing users in Koha database --> |
| 417 |
<auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of |
450 |
<auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of |
| 418 |
password comparison, e.g., to use Active Directory --> |
451 |
password comparison, e.g., to use Active Directory --> |
|
|
452 |
<principal_name>%s@my_domain.com</principal_name> |
| 453 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid --> |
| 454 |
<update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords |
| 455 |
synced to the local database --> |
| 419 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
456 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
| 420 |
<firstname is="givenname" ></firstname> |
457 |
<firstname is="givenname" ></firstname> |
| 421 |
<surname is="sn" ></surname> |
458 |
<surname is="sn" ></surname> |
|
Lines 473-478
attribute that the server allows to be used for binding could be used.
Link Here
|
| 473 |
|
510 |
|
| 474 |
Currently, principal_name only operates when auth_by_bind is enabled. |
511 |
Currently, principal_name only operates when auth_by_bind is enabled. |
| 475 |
|
512 |
|
|
|
513 |
=head2 update_password |
| 514 |
|
| 515 |
If this tag is left out or set to a true value, then the user's LDAP password |
| 516 |
will be stored (hashed) in the local Koha database. If you don't want this |
| 517 |
to happen, then set the value of this to '0'. Note that if passwords are not |
| 518 |
stored locally, and the connection to the LDAP system fails, then the users |
| 519 |
will not be able to log in at all. |
| 520 |
|
| 476 |
=head2 Active Directory |
521 |
=head2 Active Directory |
| 477 |
|
522 |
|
| 478 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
523 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
| 479 |
- |
|
|