Bugzilla – Attachment 21154 Details for
Bug 10908
Fix broken auth_by_bind LDAP mode
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 10908 - fix broken LDAP
Bug-10908---fix-broken-LDAP.patch (text/plain), 4.16 KB, created by
Robin Sheat
on 2013-09-18 05:28:09 UTC
(
hide
)
Description:
Bug 10908 - fix broken LDAP
Filename:
MIME Type:
Creator:
Robin Sheat
Created:
2013-09-18 05:28:09 UTC
Size:
4.16 KB
patch
obsolete
>From 1ca7f9f1094691e07044c7d4e3fe76c8afd57832 Mon Sep 17 00:00:00 2001 >From: Robin Sheat <robin@catalyst.net.nz> >Date: Wed, 18 Sep 2013 17:16:51 +1200 >Subject: [PATCH] Bug 10908 - fix broken LDAP > >Recent changes to LDAP broke auth_by_bind in many situations. This bug >resets the behaviour to what it used to be, however also allows the new >behaviour by adding the 'anonymous_bind' parameter to the LDAP config. > >Testing: > 1) Find an LDAP configuration that was broken recently that uses > auth_by_bind > 2) Apply this patch > 3) See if it works again. >Additionally, testing the original path in the case of 'anonymous_bind' >being set should probably be done too, but I have no idea about the LDAP >server config for that. >--- > C4/Auth_with_ldap.pm | 60 +++++++++++++++++++++++++++++++++++----------------- > 1 file changed, 41 insertions(+), 19 deletions(-) > >diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm >index 6143c9f..0296829 100644 >--- a/C4/Auth_with_ldap.pm >+++ b/C4/Auth_with_ldap.pm >@@ -111,26 +111,46 @@ sub checkpw_ldap { > #$debug and $db->debug(5); > my $userldapentry; > >- if ( $ldap->{auth_by_bind} ) { >- # Perform an anonymous bind >- my $res = $db->bind; >- if ( $res->code ) { >- $debug and warn "Anonymous LDAP bind failed: ". description($res); >- return 0; >- } >- >- # Perform a LDAP search for the given username >- my $search = search_method($db, $userid) or return 0; # warnings are in the sub >- $userldapentry = $search->shift_entry; >- >- # Perform a LDAP bind for the given username using the matched DN >- $res = $db->bind( $userldapentry->dn, password => $password ); >- if ( $res->code ) { >- $debug and warn "LDAP bind failed as kohauser $userid: ". description($res); >- return 0; >- } >+ if ( $ldap->{auth_by_bind} ) { >+ my $principal_name; >+ if ( $ldap->{anonymous_bind} ) { >+ >+ # Perform an anonymous bind >+ my $res = $db->bind; >+ if ( $res->code ) { >+ warn "Anonymous LDAP bind failed: " . description($res); >+ return 0; >+ } >+ >+ # Perform a LDAP search for the given username >+ my $search = search_method( $db, $userid ) >+ or return 0; # warnings are in the sub >+ $userldapentry = $search->shift_entry; >+ $principal_name = $userldapentry->dn; >+ } >+ else { >+ $principal_name = $ldap->{principal_name}; >+ if ( $principal_name and $principal_name =~ /\%/ ) { >+ $principal_name = sprintf( $principal_name, $userid ); >+ } >+ else { >+ $principal_name = $userid; >+ } >+ } > >- } else { >+ # Perform a LDAP bind for the given username using the matched DN >+ my $res = $db->bind( $principal_name, password => $password ); >+ if ( $res->code ) { >+ warn "LDAP bind failed as kohauser $userid: " . description($res); >+ return 0; >+ } >+ if ( !defined($userldapentry) >+ && ( $config{update} or $config{replicate} ) ) >+ { >+ my $search = search_method( $db, $userid ) or return 0; >+ $userldapentry = $search->shift_entry; >+ } >+ } else { > my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); > if ($res->code) { # connection refused > warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); >@@ -421,6 +441,8 @@ Example XML stanza for LDAP configuration in KOHA_CONF. > <update>1</update> <!-- update existing users in Koha database --> > <auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of > password comparison, e.g., to use Active Directory --> >+ <anonymous_bind>0</anonymous_bind> <!-- set to 1 if users should be searched using >+ an anonymous bind, even when auth_by_bind is on --> > <mapping> <!-- match koha SQL field names to your LDAP record field names --> > <firstname is="givenname" ></firstname> > <surname is="sn" ></surname> >-- >1.8.1.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 10908
:
21154
|
21155
|
21652
|
21653
|
22119
|
22121
|
22137
|
22138