View | Details | Raw Unified | Return to bug 9165
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-15 / +57 lines)
Lines 261-281 sub exists_local { Link Here
261
	return 0;
261
	return 0;
262
}
262
}
263
263
264
# This function performs a password update, given the userid, borrowerid,
265
# and digested password. It will verify that things are correct and return the
266
# borrowers cardnumber. The idea is that it is used to keep the local 
267
# passwords in sync with the LDAP passwords.
268
#
269
#   $cardnum = _do_changepassword($userid, $borrowerid, $digest)
270
#
271
# Note: if the LDAP config has the update_password tag set to a false value,
272
# then this will not update the password, it will simply return the cardnumber.
264
sub _do_changepassword {
273
sub _do_changepassword {
265
    my ($userid, $borrowerid, $digest) = @_;
274
    my ( $userid, $borrowerid, $digest ) = @_;
266
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
275
267
    changepassword($userid, $borrowerid, $digest);
276
    if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) {
268
277
269
	# Confirm changes
278
        # This path doesn't update the password, just returns the
270
	my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? ");
279
        # card number
271
	$sth->execute($borrowerid);
280
        my $sth = C4::Context->dbh->prepare(
272
	if ($sth->rows) {
281
            'SELECT cardnumber FROM borrowers WHERE borrowernumber=?' );
273
		my ($md5password, $cardnum) = $sth->fetchrow;
282
        $sth->execute($borrowerid);
274
        ($digest eq $md5password) and return $cardnum;
283
        die
275
		warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)";
284
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid"
276
		return;
285
          if !$sth->rows;
277
	}
286
        my ($cardnum) = $sth->fetchrow;
278
	die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid.";
287
        return $cardnum;
288
    }
289
    else {
290
291
        # This path updates the password in the database
292
        print STDERR
293
"changing local password for borrowernumber=$borrowerid to '$digest'\n"
294
          if $debug;
295
        changepassword( $userid, $borrowerid, $digest );
296
297
        # Confirm changes
298
        my $sth = C4::Context->dbh->prepare(
299
            "SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "
300
        );
301
        $sth->execute($borrowerid);
302
        if ( $sth->rows ) {
303
            my ( $md5password, $cardnum ) = $sth->fetchrow;
304
            ( $digest eq $md5password ) and return $cardnum;
305
            warn
306
"Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)";
307
            return;
308
        }
309
        die
310
"Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid.";
311
    }
279
}
312
}
280
313
281
sub update_local {
314
sub update_local {
Lines 421-426 Example XML stanza for LDAP configuration in KOHA_CONF. Link Here
421
                                        password comparison, e.g., to use Active Directory -->
454
                                        password comparison, e.g., to use Active Directory -->
422
    <principal_name>%s@my_domain.com</principal_name>
455
    <principal_name>%s@my_domain.com</principal_name>
423
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid -->
456
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid -->
457
    <update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords
458
                                              synced to the local database -->
424
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
459
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
425
      <firstname    is="givenname"      ></firstname>
460
      <firstname    is="givenname"      ></firstname>
426
      <surname      is="sn"             ></surname>
461
      <surname      is="sn"             ></surname>
Lines 478-483 attribute that the server allows to be used for binding could be used. Link Here
478
513
479
Currently, principal_name only operates when auth_by_bind is enabled.
514
Currently, principal_name only operates when auth_by_bind is enabled.
480
515
516
=head2 update_password
517
518
If this tag is left out or set to a true value, then the user's LDAP password
519
will be stored (hashed) in the local Koha database. If you don't want this
520
to happen, then set the value of this to '0'. Note that if passwords are not
521
stored locally, and the connection to the LDAP system fails, then the users
522
will not be able to log in at all.
523
481
=head2 Active Directory 
524
=head2 Active Directory 
482
525
483
The auth_by_bind and principal_name settings are recommended for Active Directory.
526
The auth_by_bind and principal_name settings are recommended for Active Directory.
484
- 

Return to bug 9165