From 13eef99427fd66219f033b875966bd9231e7303a Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Wed, 22 May 2024 10:43:03 -0400 Subject: [PATCH] Bug 36928 - Patron authentication / password validation will fail with 500 error for local users if external auth (LDAP/CAS/Shibboleth) is enabled If external auth ( such as LDAP ) is enabled, and use of /api/v1/auth/password/validation will fail with a 500 internal server error like: Can't call method "cardnumber" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/Auth/Password.pm line 83, line 1490. This is because the valid patron object is being overwritten with an undefined value if there is no LDAP patron returned. Since a failed LDAP query falls back to local user auth, we try to use the now undefined patron object thus generating an error. Test Plan: 1) Set up and enable LDAP 2) POST JSON to /api/v1/auth/password/validation like: { "userid": "koha", "password": "koha" } 3) Note the 500 erorr 4) Apply this patch 5) Restart all the things! 6) POST the data again 7) It works! --- C4/Auth.pm | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index e3478ea6913..cb15e5107db 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1982,10 +1982,11 @@ sub checkpw { # Nothing to check, account is locked } elsif ( $ldap && defined($password) ) { - my ( $retval, $retcard, $retuserid ); - ( $retval, $retcard, $retuserid, $patron ) = checkpw_ldap(@_); # EXTERNAL AUTH + my ( $retval, $retcard, $retuserid, $ldap_patron ); + ( $retval, $retcard, $retuserid, $ldap_patron ) = checkpw_ldap(@_); # EXTERNAL AUTH if ( $retval == 1 ) { - @return = ( $retval, $retcard, $retuserid, $patron ); + @return = ( $retval, $retcard, $retuserid, $ldap_patron ); + $patron = $ldap_patron; $passwd_ok = 1; } $check_internal_as_fallback = 1 if $retval == 0; @@ -1995,10 +1996,11 @@ sub checkpw { # In case of a CAS authentication, we use the ticket instead of the password my $ticket = $query->param('ticket'); $query->delete('ticket'); # remove ticket to come back to original URL - my ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) = + my ( $retval, $retcard, $retuserid, $cas_ticket, $cas_patron ) = checkpw_cas( $ticket, $query, $type ); # EXTERNAL AUTH if ($retval) { - @return = ( $retval, $retcard, $retuserid, $patron, $cas_ticket ); + @return = ( $retval, $retcard, $retuserid, $cas_patron, $cas_ticket ); + $patron = $cas_patron; } else { @return = (0); } @@ -2016,10 +2018,11 @@ sub checkpw { # Then, we check if it matches a valid koha user if ($shib_login) { - my ( $retval, $retcard, $retuserid, $patron ) = + my ( $retval, $retcard, $retuserid, $shib_patron ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login); # EXTERNAL AUTH if ($retval) { @return = ( $retval, $retcard, $retuserid, $patron ); + $patron = $shib_patron; } $passwd_ok = $retval; } -- 2.30.2