From fca06ceef1eeb4b338e3c6c2e9cacc29bc7405e5 Mon Sep 17 00:00:00 2001
From: Dobrica Pavlinusic <dpavlin@rot13.org>
Date: Wed, 12 Mar 2014 10:45:09 +0100
Subject: [PATCH] [SIGNED OFF] Bug 8148 - LDAP auth_by_bind doesn't fallback
 to local auth

This patch covers LDAP auth_by_bind configuration so that wrong
LDAP password will return -1 to C4::Auth so we can abort local auth
and prevent users logging in with stale database passwords.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
---
 C4/Auth.pm           |    2 +-
 C4/Auth_with_ldap.pm |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/C4/Auth.pm b/C4/Auth.pm
index 5ad8722..78a1745 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1524,7 +1524,7 @@ sub checkpw {
     if ($ldap) {
         $debug and print STDERR "## checkpw - checking LDAP\n";
         my ($retval,$retcard,$retuserid) = checkpw_ldap(@_);    # EXTERNAL AUTH
-        return 0 if $retval == -1;
+        return 0 if $retval == -1; # Incorrect password for LDAP login attempt
         ($retval) and return ($retval,$retcard,$retuserid);
     }
 
diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm
index fa688cc..e085120 100644
--- a/C4/Auth_with_ldap.pm
+++ b/C4/Auth_with_ldap.pm
@@ -145,7 +145,7 @@ sub checkpw_ldap {
         my $res = $db->bind( $principal_name, password => $password );
         if ( $res->code ) {
             warn "LDAP bind failed as kohauser $userid: " . description($res);
-            return 0;
+            return -1;
         }
         if ( !defined($userldapentry)
             && ( $config{update} or $config{replicate} ) )
-- 
1.7.10.4