Lines 258-278
sub exists_local {
Link Here
|
258 |
return 0; |
258 |
return 0; |
259 |
} |
259 |
} |
260 |
|
260 |
|
|
|
261 |
# This function performs a password update, given the userid, borrowerid, |
262 |
# and digested password. It will verify that things are correct and return the |
263 |
# borrowers cardnumber. The idea is that it is used to keep the local |
264 |
# passwords in sync with the LDAP passwords. |
265 |
# |
266 |
# $cardnum = _do_changepassword($userid, $borrowerid, $digest) |
267 |
# |
268 |
# Note: if the LDAP config has the update_password tag set to a false value, |
269 |
# then this will not update the password, it will simply return the cardnumber. |
261 |
sub _do_changepassword { |
270 |
sub _do_changepassword { |
262 |
my ($userid, $borrowerid, $digest) = @_; |
271 |
my ( $userid, $borrowerid, $digest ) = @_; |
263 |
$debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; |
272 |
|
264 |
changepassword($userid, $borrowerid, $digest); |
273 |
if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) { |
265 |
|
274 |
|
266 |
# Confirm changes |
275 |
# This path doesn't update the password, just returns the |
267 |
my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); |
276 |
# card number |
268 |
$sth->execute($borrowerid); |
277 |
my $sth = C4::Context->dbh->prepare( |
269 |
if ($sth->rows) { |
278 |
'SELECT cardnumber FROM borrowers WHERE borrowernumber=?' ); |
270 |
my ($md5password, $cardnum) = $sth->fetchrow; |
279 |
$sth->execute($borrowerid); |
271 |
($digest eq $md5password) and return $cardnum; |
280 |
die |
272 |
warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; |
281 |
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid" |
273 |
return; |
282 |
if !$sth->rows; |
274 |
} |
283 |
my ($cardnum) = $sth->fetchrow; |
275 |
die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; |
284 |
return $cardnum; |
|
|
285 |
} |
286 |
else { |
287 |
|
288 |
# This path updates the password in the database |
289 |
print STDERR |
290 |
"changing local password for borrowernumber=$borrowerid to '$digest'\n" |
291 |
if $debug; |
292 |
changepassword( $userid, $borrowerid, $digest ); |
293 |
|
294 |
# Confirm changes |
295 |
my $sth = C4::Context->dbh->prepare( |
296 |
"SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? " |
297 |
); |
298 |
$sth->execute($borrowerid); |
299 |
if ( $sth->rows ) { |
300 |
my ( $md5password, $cardnum ) = $sth->fetchrow; |
301 |
( $digest eq $md5password ) and return $cardnum; |
302 |
warn |
303 |
"Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; |
304 |
return; |
305 |
} |
306 |
die |
307 |
"Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; |
308 |
} |
276 |
} |
309 |
} |
277 |
|
310 |
|
278 |
sub update_local { |
311 |
sub update_local { |
Lines 416-421
Example XML stanza for LDAP configuration in KOHA_CONF.
Link Here
|
416 |
<update>1</update> <!-- update existing users in Koha database --> |
449 |
<update>1</update> <!-- update existing users in Koha database --> |
417 |
<auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of |
450 |
<auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of |
418 |
password comparison, e.g., to use Active Directory --> |
451 |
password comparison, e.g., to use Active Directory --> |
|
|
452 |
<principal_name>%s@my_domain.com</principal_name> |
453 |
<!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid --> |
454 |
<update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords |
455 |
synced to the local database --> |
419 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
456 |
<mapping> <!-- match koha SQL field names to your LDAP record field names --> |
420 |
<firstname is="givenname" ></firstname> |
457 |
<firstname is="givenname" ></firstname> |
421 |
<surname is="sn" ></surname> |
458 |
<surname is="sn" ></surname> |
Lines 473-478
attribute that the server allows to be used for binding could be used.
Link Here
|
473 |
|
510 |
|
474 |
Currently, principal_name only operates when auth_by_bind is enabled. |
511 |
Currently, principal_name only operates when auth_by_bind is enabled. |
475 |
|
512 |
|
|
|
513 |
=head2 update_password |
514 |
|
515 |
If this tag is left out or set to a true value, then the user's LDAP password |
516 |
will be stored (hashed) in the local Koha database. If you don't want this |
517 |
to happen, then set the value of this to '0'. Note that if passwords are not |
518 |
stored locally, and the connection to the LDAP system fails, then the users |
519 |
will not be able to log in at all. |
520 |
|
476 |
=head2 Active Directory |
521 |
=head2 Active Directory |
477 |
|
522 |
|
478 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
523 |
The auth_by_bind and principal_name settings are recommended for Active Directory. |
479 |
- |
|
|