View | Details | Raw Unified | Return to bug 9165
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-15 / +59 lines)
Lines 258-278 sub exists_local { Link Here
258
	return 0;
258
	return 0;
259
}
259
}
260
260
261
# This function performs a password update, given the userid, borrowerid,
262
# and digested password. It will verify that things are correct and return the
263
# borrowers cardnumber. The idea is that it is used to keep the local
264
# passwords in sync with the LDAP passwords.
265
#
266
#   $cardnum = _do_changepassword($userid, $borrowerid, $digest)
267
#
268
# Note: if the LDAP config has the update_password tag set to a false value,
269
# then this will not update the password, it will simply return the cardnumber.
261
sub _do_changepassword {
270
sub _do_changepassword {
262
    my ($userid, $borrowerid, $digest) = @_;
271
    my ( $userid, $borrowerid, $digest ) = @_;
263
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
272
264
    changepassword($userid, $borrowerid, $digest);
273
    if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) {
265
274
266
	# Confirm changes
275
        # This path doesn't update the password, just returns the
267
	my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? ");
276
        # card number
268
	$sth->execute($borrowerid);
277
        my $sth = C4::Context->dbh->prepare(
269
	if ($sth->rows) {
278
            'SELECT cardnumber FROM borrowers WHERE borrowernumber=?' );
270
		my ($md5password, $cardnum) = $sth->fetchrow;
279
        $sth->execute($borrowerid);
271
        ($digest eq $md5password) and return $cardnum;
280
        die
272
		warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)";
281
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid"
273
		return;
282
          if !$sth->rows;
274
	}
283
        my ($cardnum) = $sth->fetchrow;
275
	die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid.";
284
        return $cardnum;
285
    }
286
    else {
287
288
        # This path updates the password in the database
289
        print STDERR
290
"changing local password for borrowernumber=$borrowerid to '$digest'\n"
291
          if $debug;
292
        changepassword( $userid, $borrowerid, $digest );
293
294
        # Confirm changes
295
        my $sth = C4::Context->dbh->prepare(
296
            "SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "
297
        );
298
        $sth->execute($borrowerid);
299
        if ( $sth->rows ) {
300
            my ( $md5password, $cardnum ) = $sth->fetchrow;
301
            ( $digest eq $md5password ) and return $cardnum;
302
            warn
303
"Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)";
304
            return;
305
        }
306
        die
307
"Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid.";
308
    }
276
}
309
}
277
310
278
sub update_local {
311
sub update_local {
Lines 416-421 Example XML stanza for LDAP configuration in KOHA_CONF. Link Here
416
    <update>1</update>             <!-- update existing users in Koha database -->
449
    <update>1</update>             <!-- update existing users in Koha database -->
417
    <auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of
450
    <auth_by_bind>0</auth_by_bind> <!-- set to 1 to authenticate by binding instead of
418
                                        password comparison, e.g., to use Active Directory -->
451
                                        password comparison, e.g., to use Active Directory -->
452
    <principal_name>%s@my_domain.com</principal_name>
453
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid -->
454
    <update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords
455
                                              synced to the local database -->
419
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
456
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
420
      <firstname    is="givenname"      ></firstname>
457
      <firstname    is="givenname"      ></firstname>
421
      <surname      is="sn"             ></surname>
458
      <surname      is="sn"             ></surname>
Lines 473-478 attribute that the server allows to be used for binding could be used. Link Here
473
510
474
Currently, principal_name only operates when auth_by_bind is enabled.
511
Currently, principal_name only operates when auth_by_bind is enabled.
475
512
513
=head2 update_password
514
515
If this tag is left out or set to a true value, then the user's LDAP password
516
will be stored (hashed) in the local Koha database. If you don't want this
517
to happen, then set the value of this to '0'. Note that if passwords are not
518
stored locally, and the connection to the LDAP system fails, then the users
519
will not be able to log in at all.
520
476
=head2 Active Directory 
521
=head2 Active Directory 
477
522
478
The auth_by_bind and principal_name settings are recommended for Active Directory.
523
The auth_by_bind and principal_name settings are recommended for Active Directory.
479
- 

Return to bug 9165