|
Lines 293-301
sub exists_local {
Link Here
|
| 293 |
return 0; |
293 |
return 0; |
| 294 |
} |
294 |
} |
| 295 |
|
295 |
|
|
|
296 |
# This function performs a password update, given the userid, borrowerid, |
| 297 |
# and digested password. It will verify that things are correct and return the |
| 298 |
# borrowers cardnumber. The idea is that it is used to keep the local |
| 299 |
# passwords in sync with the LDAP passwords. |
| 300 |
# |
| 301 |
# $cardnum = _do_changepassword($userid, $borrowerid, $digest) |
| 302 |
# |
| 303 |
# Note: if the LDAP config has the update_password tag set to a false value, |
| 304 |
# then this will not update the password, it will simply return the cardnumber. |
| 296 |
sub _do_changepassword { |
305 |
sub _do_changepassword { |
| 297 |
my ($userid, $borrowerid, $password) = @_; |
306 |
my ($userid, $borrowerid, $password) = @_; |
| 298 |
|
307 |
|
|
|
308 |
if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) { |
| 309 |
|
| 310 |
# We don't store the password in the database |
| 311 |
my $sth = C4::Context->dbh->prepare( |
| 312 |
'SELECT cardnumber FROM borrowers WHERE borrowernumber=?'); |
| 313 |
$sth->execute($borrowerid); |
| 314 |
die |
| 315 |
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid" |
| 316 |
if !$sth->rows; |
| 317 |
my ($cardnum) = $sth->fetchrow; |
| 318 |
return $cardnum; |
| 319 |
} |
| 299 |
my $digest = hash_password($password); |
320 |
my $digest = hash_password($password); |
| 300 |
|
321 |
|
| 301 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
322 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
|
Lines 455-461
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
| 455 |
<principal_name>%s@my_domain.com</principal_name> |
476 |
<principal_name>%s@my_domain.com</principal_name> |
| 456 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid. |
477 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid. |
| 457 |
Not used with anonymous_bind. --> |
478 |
Not used with anonymous_bind. --> |
| 458 |
|
479 |
<update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords |
|
|
480 |
synced to the local database --> |
| 459 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
481 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
| 460 |
<firstname is="givenname" ></firstname> |
482 |
<firstname is="givenname" ></firstname> |
| 461 |
<surname is="sn" ></surname> |
483 |
<surname is="sn" ></surname> |
|
Lines 513-518
attribute that the server allows to be used for binding could be used.
Link Here
|
| 513 |
|
535 |
|
| 514 |
Currently, principal_name only operates when auth_by_bind is enabled. |
536 |
Currently, principal_name only operates when auth_by_bind is enabled. |
| 515 |
|
537 |
|
|
|
538 |
=head2 update_password |
| 539 |
|
| 540 |
If this tag is left out or set to a true value, then the user's LDAP password |
| 541 |
will be stored (hashed) in the local Koha database. If you don't want this |
| 542 |
to happen, then set the value of this to '0'. Note that if passwords are not |
| 543 |
stored locally, and the connection to the LDAP system fails, then the users |
| 544 |
will not be able to log in at all. |
| 545 |
|
| 516 |
=head2 Active Directory |
546 |
=head2 Active Directory |
| 517 |
|
547 |
|
| 518 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
548 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
| 519 |
- |
|
|