From a1943f811f926226da0b82beb5e0a99df0b55111 Mon Sep 17 00:00:00 2001 From: Kyle M Hall Date: Wed, 22 May 2024 10:43:03 -0400 Subject: [PATCH] Bug 36928: Patron authentication / password validation will fail with 500 error for local users if external auth (LDAP/CAS/Shibboleth) is enabled If external auth ( such as LDAP ) is enabled, and use of /api/v1/auth/password/validation will fail with a 500 internal server error like: Can't call method "cardnumber" on an undefined value at /usr/share/koha/lib/Koha/REST/V1/Auth/Password.pm line 83, line 1490. This is because the valid patron object is being overwritten with an undefined value if there is no LDAP patron returned. Since a failed LDAP query falls back to local user auth, we try to use the now undefined patron object thus generating an error. Test Plan: 1) Set up and enable LDAP https://wiki.koha-community.org/wiki/Ldap_testing (restart plack) 2) POST JSON to /api/v1/auth/password/validation like: { "userid": "koha", "password": "koha" } Or run: prove t/db_dependent/api/v1/password_validation.t 3) Note the 500 error(s) 4) Apply this patch 5) Restart all the things! 6) POST the data again or run the tests 7) It works! Signed-off-by: Victor Grousset/tuxayo --- C4/Auth.pm | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index bc1f2c945e..08db5204ef 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -1999,9 +1999,10 @@ sub checkpw { # Nothing to check, account is locked } elsif ( $ldap && defined($password) ) { - my ( $retval, $retcard, $retuserid ); - ( $retval, $retcard, $retuserid, $patron ) = checkpw_ldap(@_); # EXTERNAL AUTH + my ( $retval, $retcard, $retuserid, $ldap_patron ); + ( $retval, $retcard, $retuserid, $ldap_patron ) = checkpw_ldap(@_); # EXTERNAL AUTH if ( $retval == 1 ) { + $patron = $ldap_patron if $ldap_patron; @return = ( $retval, $retcard, $retuserid, $patron ); $passwd_ok = 1; } @@ -2012,9 +2013,10 @@ sub checkpw { # In case of a CAS authentication, we use the ticket instead of the password my $ticket = $query->param('ticket'); $query->delete('ticket'); # remove ticket to come back to original URL - my ( $retval, $retcard, $retuserid, $cas_ticket, $patron ) = + my ( $retval, $retcard, $retuserid, $cas_ticket, $cas_patron ) = checkpw_cas( $ticket, $query, $type ); # EXTERNAL AUTH if ($retval) { + $patron = $cas_patron if $cas_patron; @return = ( $retval, $retcard, $retuserid, $patron, $cas_ticket ); } else { @return = (0); @@ -2033,9 +2035,10 @@ sub checkpw { # Then, we check if it matches a valid koha user if ($shib_login) { - my ( $retval, $retcard, $retuserid, $patron ) = + my ( $retval, $retcard, $retuserid, $shib_patron ) = C4::Auth_with_shibboleth::checkpw_shib($shib_login); # EXTERNAL AUTH if ($retval) { + $patron = $shib_patron if $shib_patron; @return = ( $retval, $retcard, $retuserid, $patron ); } $passwd_ok = $retval; -- 2.45.1