|
Lines 282-290
sub exists_local {
Link Here
|
| 282 |
return 0; |
282 |
return 0; |
| 283 |
} |
283 |
} |
| 284 |
|
284 |
|
|
|
285 |
# This function performs a password update, given the userid, borrowerid, |
| 286 |
# and digested password. It will verify that things are correct and return the |
| 287 |
# borrowers cardnumber. The idea is that it is used to keep the local |
| 288 |
# passwords in sync with the LDAP passwords. |
| 289 |
# |
| 290 |
# $cardnum = _do_changepassword($userid, $borrowerid, $digest) |
| 291 |
# |
| 292 |
# Note: if the LDAP config has the update_password tag set to a false value, |
| 293 |
# then this will not update the password, it will simply return the cardnumber. |
| 285 |
sub _do_changepassword { |
294 |
sub _do_changepassword { |
| 286 |
my ($userid, $borrowerid, $password) = @_; |
295 |
my ($userid, $borrowerid, $password) = @_; |
| 287 |
|
296 |
|
|
|
297 |
if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) { |
| 298 |
|
| 299 |
# We don't store the password in the database |
| 300 |
my $sth = C4::Context->dbh->prepare( |
| 301 |
'SELECT cardnumber FROM borrowers WHERE borrowernumber=?'); |
| 302 |
$sth->execute($borrowerid); |
| 303 |
die |
| 304 |
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid" |
| 305 |
if !$sth->rows; |
| 306 |
my ($cardnum) = $sth->fetchrow; |
| 307 |
return $cardnum; |
| 308 |
} |
| 288 |
my $digest = hash_password($password); |
309 |
my $digest = hash_password($password); |
| 289 |
|
310 |
|
| 290 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
311 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
|
Lines 444-450
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
| 444 |
<principal_name>%s@my_domain.com</principal_name> |
465 |
<principal_name>%s@my_domain.com</principal_name> |
| 445 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid. |
466 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid. |
| 446 |
Not used with anonymous_bind. --> |
467 |
Not used with anonymous_bind. --> |
| 447 |
|
468 |
<update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords |
|
|
469 |
synced to the local database --> |
| 448 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
470 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
| 449 |
<firstname is="givenname" ></firstname> |
471 |
<firstname is="givenname" ></firstname> |
| 450 |
<surname is="sn" ></surname> |
472 |
<surname is="sn" ></surname> |
|
Lines 502-507
attribute that the server allows to be used for binding could be used.
Link Here
|
| 502 |
|
524 |
|
| 503 |
Currently, principal_name only operates when auth_by_bind is enabled. |
525 |
Currently, principal_name only operates when auth_by_bind is enabled. |
| 504 |
|
526 |
|
|
|
527 |
=head2 update_password |
| 528 |
|
| 529 |
If this tag is left out or set to a true value, then the user's LDAP password |
| 530 |
will be stored (hashed) in the local Koha database. If you don't want this |
| 531 |
to happen, then set the value of this to '0'. Note that if passwords are not |
| 532 |
stored locally, and the connection to the LDAP system fails, then the users |
| 533 |
will not be able to log in at all. |
| 534 |
|
| 505 |
=head2 Active Directory |
535 |
=head2 Active Directory |
| 506 |
|
536 |
|
| 507 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
537 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
| 508 |
- |
|
|