Lines 278-286
sub exists_local {
Link Here
|
278 |
return 0; |
278 |
return 0; |
279 |
} |
279 |
} |
280 |
|
280 |
|
|
|
281 |
# This function performs a password update, given the userid, borrowerid, |
282 |
# and digested password. It will verify that things are correct and return the |
283 |
# borrowers cardnumber. The idea is that it is used to keep the local |
284 |
# passwords in sync with the LDAP passwords. |
285 |
# |
286 |
# $cardnum = _do_changepassword($userid, $borrowerid, $digest) |
287 |
# |
288 |
# Note: if the LDAP config has the update_password tag set to a false value, |
289 |
# then this will not update the password, it will simply return the cardnumber. |
281 |
sub _do_changepassword { |
290 |
sub _do_changepassword { |
282 |
my ($userid, $borrowerid, $password) = @_; |
291 |
my ($userid, $borrowerid, $password) = @_; |
283 |
|
292 |
|
|
|
293 |
if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) { |
294 |
|
295 |
# We don't store the password in the database |
296 |
my $sth = C4::Context->dbh->prepare( |
297 |
'SELECT cardnumber FROM borrowers WHERE borrowernumber=?'); |
298 |
$sth->execute($borrowerid); |
299 |
die |
300 |
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid" |
301 |
if !$sth->rows; |
302 |
my ($cardnum) = $sth->fetchrow; |
303 |
return $cardnum; |
304 |
} |
284 |
my $digest = hash_password($password); |
305 |
my $digest = hash_password($password); |
285 |
|
306 |
|
286 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
307 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
Lines 440-446
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
440 |
<principal_name>%s@my_domain.com</principal_name> |
461 |
<principal_name>%s@my_domain.com</principal_name> |
441 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid. |
462 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid. |
442 |
Not used with anonymous_bind. --> |
463 |
Not used with anonymous_bind. --> |
443 |
|
464 |
<update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords |
|
|
465 |
synced to the local database --> |
444 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
466 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
445 |
<firstname is="givenname" ></firstname> |
467 |
<firstname is="givenname" ></firstname> |
446 |
<surname is="sn" ></surname> |
468 |
<surname is="sn" ></surname> |
Lines 498-503
attribute that the server allows to be used for binding could be used.
Link Here
|
498 |
|
520 |
|
499 |
Currently, principal_name only operates when auth_by_bind is enabled. |
521 |
Currently, principal_name only operates when auth_by_bind is enabled. |
500 |
|
522 |
|
|
|
523 |
=head2 update_password |
524 |
|
525 |
If this tag is left out or set to a true value, then the user's LDAP password |
526 |
will be stored (hashed) in the local Koha database. If you don't want this |
527 |
to happen, then set the value of this to '0'. Note that if passwords are not |
528 |
stored locally, and the connection to the LDAP system fails, then the users |
529 |
will not be able to log in at all. |
530 |
|
501 |
=head2 Active Directory |
531 |
=head2 Active Directory |
502 |
|
532 |
|
503 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
533 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
504 |
- |
|
|