|
Lines 145-152
sub checkpw_ldap {
Link Here
|
| 145 |
# Perform a LDAP bind for the given username using the matched DN |
145 |
# Perform a LDAP bind for the given username using the matched DN |
| 146 |
my $res = $db->bind( $principal_name, password => $password ); |
146 |
my $res = $db->bind( $principal_name, password => $password ); |
| 147 |
if ( $res->code ) { |
147 |
if ( $res->code ) { |
| 148 |
warn "LDAP bind failed as kohauser $userid: " . description($res); |
148 |
if ( $ldap->{anonymous_bind} ) { |
| 149 |
return -1; |
149 |
# With anonymous_bind approach we can be sure we have found the correct user |
|
|
150 |
# and that any 'code' response indicates a 'bad' user (be that blocked, banned |
| 151 |
# or password changed). We should not fall back to local accounts in this case. |
| 152 |
warn "LDAP bind failed as kohauser $userid: " . description($res); |
| 153 |
return -1; |
| 154 |
} else { |
| 155 |
# Without a anonymous_bind, we cannot be sure we are looking at a valid ldap user |
| 156 |
# at all, and thus we should fall back to local logins to restore previous behaviour |
| 157 |
# see bug 12831 |
| 158 |
warn "LDAP bind failed as kohauser $userid: " . description($res); |
| 159 |
return 0; |
| 160 |
} |
| 150 |
} |
161 |
} |
| 151 |
if ( !defined($userldapentry) |
162 |
if ( !defined($userldapentry) |
| 152 |
&& ( $config{update} or $config{replicate} ) ) |
163 |
&& ( $config{update} or $config{replicate} ) ) |
| 153 |
- |
|
|