Attachment #9233 for bug #7973

View | Details | Raw Unified | Return to bug 7973
Collapse All | Expand All




    my ($dbh, $userid, $password) = @_;
    my @hosts = split(',', $prefhost);
    my $db = Net::LDAP->new(\@hosts);
    #$debug and $db->debug(5);
    print STDERR "Checking Password!!";
    my $userldapentry;
    if ( $ldap->{auth_by_bind} ) {
        my $principal_name = $ldap->{principal_name};
        if ($principal_name and $principal_name =~ /\%/) {
            $principal_name = sprintf($principal_name,$userid);
        } else {
            $principal_name = $userid;
        }
	my $res = $db->bind( $principal_name, password => $password );
        if ( $res->code ) {
            $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);
            return 0;
        }
	
	# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!
	
	# BUG #5094
	# 2010-08-04 JeremyC
	# a $userldapentry is only needed if either updating or replicating are enabled

	    my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
	    $userldapentry = $search->shift_entry;
	}
    } elsif($ldap->{bind_with_service}) {
        my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
	if ($res->code) {               # connection refused                                                                                                                                                                                                                                                                
            warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
            return 0;
        }
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub                                                                                                                                                                                                                                    
        $userldapentry = $search->shift_entry;
        my $ldapusername = $userldapentry->get('distinguishedName');
        $res = $db->bind(@$ldapusername[0], password => $password);
        if ( $res->code ) {
            $debug and warn "LDAP bind failed as kohauser ". @$ldapusername[0] . " " . description($res);
            return 0;
        }
    } else {
	my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
	if ($res->code) {		# connection refused
	    warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
	    return 0;
	}
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
        $userldapentry = $search->shift_entry;
	my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password );
	if ($cmpmesg->code != 6) {
	    warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg);
	    return 0;
		}
	}
    }
    
    # To get here, LDAP has accepted our user's login attempt.
    # But we still have work to do.  See perldoc below for detailed breakdown.
    
    my (%borrower);
    my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid);
    
    if (( $borrowernumber and $config{update}   ) or
        (!$borrowernumber and $config{replicate})   ) {
        %borrower = ldap_entry_2_hash($userldapentry,$userid);
- 

Return to bug 7973

Lines 103-125 sub checkpw_ldap { Link Here

(-)a/C4/Auth_with_ldap.pm (-22 / +35 lines)
103	my ($dbh, $userid, $password) = @_;	103	my ($dbh, $userid, $password) = @_;
104	my @hosts = split(',', $prefhost);	104	my @hosts = split(',', $prefhost);
105	my $db = Net::LDAP->new(\@hosts);	105	my $db = Net::LDAP->new(\@hosts);
106	#$debug and $db->debug(5);	106	#$debug and $db->debug(5);
		107	print STDERR "Checking Password!!";
107	my $userldapentry;	108	my $userldapentry;
108	if ( $ldap->{auth_by_bind} ) {	109	if ( $ldap->{auth_by_bind} ) {
109	my $principal_name = $ldap->{principal_name};	110	my $principal_name = $ldap->{principal_name};
110	if ($principal_name and $principal_name =~ /\%/) {	111	if ($principal_name and $principal_name =~ /\%/) {
111	$principal_name = sprintf($principal_name,$userid);	112	$principal_name = sprintf($principal_name,$userid);
112	} else {	113	} else {
113	$principal_name = $userid;	114	$principal_name = $userid;
114	}	115	}
115	my $res = $db->bind( $principal_name, password => $password );	116	my $res = $db->bind( $principal_name, password => $password );
116	if ( $res->code ) {	117	if ( $res->code ) {
117	$debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);	118	$debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);
118	return 0;	119	return 0;
119	}	120	}
120		121
121	# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!	122	# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!
122		123
123	# BUG #5094	124	# BUG #5094
124	# 2010-08-04 JeremyC	125	# 2010-08-04 JeremyC
125	# a $userldapentry is only needed if either updating or replicating are enabled	126	# a $userldapentry is only needed if either updating or replicating are enabled
Lines 127-154 sub checkpw_ldap { Link Here
127	my $search = search_method($db, $userid) or return 0; # warnings are in the sub	128	my $search = search_method($db, $userid) or return 0; # warnings are in the sub
128	$userldapentry = $search->shift_entry;	129	$userldapentry = $search->shift_entry;
129	}	130	}
130		131	} elsif($ldap->{bind_with_service}) {
131	} else {	132	my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
132	my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);	133	if ($res->code) { # connection refused
133	if ($res->code) { # connection refused	134	warn "LDAP bind failed as ldapuser " . ($ldapname \|\| '[ANONYMOUS]') . ": " . description($res);
134	warn "LDAP bind failed as ldapuser " . ($ldapname \|\| '[ANONYMOUS]') . ": " . description($res);	135	return 0;
135	return 0;	136	}
136	}	137	my $search = search_method($db, $userid) or return 0; # warnings are in the sub
		138	$userldapentry = $search->shift_entry;
		139	my $ldapusername = $userldapentry->get('distinguishedName');
		140	$res = $db->bind(@$ldapusername[0], password => $password);
		141	if ( $res->code ) {
		142	$debug and warn "LDAP bind failed as kohauser ". @$ldapusername[0] . " " . description($res);
		143	return 0;
		144	}
		145	} else {
		146	my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
		147	if ($res->code) { # connection refused
		148	warn "LDAP bind failed as ldapuser " . ($ldapname \|\| '[ANONYMOUS]') . ": " . description($res);
		149	return 0;
		150	}
137	my $search = search_method($db, $userid) or return 0; # warnings are in the sub	151	my $search = search_method($db, $userid) or return 0; # warnings are in the sub
138	$userldapentry = $search->shift_entry;	152	$userldapentry = $search->shift_entry;
139	my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password );	153	my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password );
140	if ($cmpmesg->code != 6) {	154	if ($cmpmesg->code != 6) {
141	warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg);	155	warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg);
142	return 0;	156	return 0;
143	}
144	}	157	}
145		158	}
		159
146	# To get here, LDAP has accepted our user's login attempt.	160	# To get here, LDAP has accepted our user's login attempt.
147	# But we still have work to do. See perldoc below for detailed breakdown.	161	# But we still have work to do. See perldoc below for detailed breakdown.
148		162
149	my (%borrower);	163	my (%borrower);
150	my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid);	164	my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid);
151		165
152	if (( $borrowernumber and $config{update} ) or	166	if (( $borrowernumber and $config{update} ) or
153	(!$borrowernumber and $config{replicate}) ) {	167	(!$borrowernumber and $config{replicate}) ) {
154	%borrower = ldap_entry_2_hash($userldapentry,$userid);	168	%borrower = ldap_entry_2_hash($userldapentry,$userid);
155	-