View | Details | Raw Unified | Return to bug 9165
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-2 / +31 lines)
Lines 278-286 sub exists_local { Link Here
278
	return 0;
278
	return 0;
279
}
279
}
280
280
281
# This function performs a password update, given the userid, borrowerid,
282
# and digested password. It will verify that things are correct and return the
283
# borrowers cardnumber. The idea is that it is used to keep the local
284
# passwords in sync with the LDAP passwords.
285
#
286
#   $cardnum = _do_changepassword($userid, $borrowerid, $digest)
287
#
288
# Note: if the LDAP config has the update_password tag set to a false value,
289
# then this will not update the password, it will simply return the cardnumber.
281
sub _do_changepassword {
290
sub _do_changepassword {
282
    my ($userid, $borrowerid, $password) = @_;
291
    my ($userid, $borrowerid, $password) = @_;
283
292
293
    if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) {
294
295
        # We don't store the password in the database
296
        my $sth = C4::Context->dbh->prepare(
297
            'SELECT cardnumber FROM borrowers WHERE borrowernumber=?');
298
        $sth->execute($borrowerid);
299
        die
300
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid"
301
          if !$sth->rows;
302
        my ($cardnum) = $sth->fetchrow;
303
        return $cardnum;
304
    }
284
    my $digest = hash_password($password);
305
    my $digest = hash_password($password);
285
306
286
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
307
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
Lines 440-446 Example XML stanza for LDAP configuration in KOHA_CONF. Link Here
440
    <principal_name>%s@my_domain.com</principal_name>
461
    <principal_name>%s@my_domain.com</principal_name>
441
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid.
462
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid.
442
                                        Not used with anonymous_bind. -->
463
                                        Not used with anonymous_bind. -->
443
464
    <update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords
465
                                              synced to the local database -->
444
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
466
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
445
      <firstname    is="givenname"      ></firstname>
467
      <firstname    is="givenname"      ></firstname>
446
      <surname      is="sn"             ></surname>
468
      <surname      is="sn"             ></surname>
Lines 498-503 attribute that the server allows to be used for binding could be used. Link Here
498
520
499
Currently, principal_name only operates when auth_by_bind is enabled.
521
Currently, principal_name only operates when auth_by_bind is enabled.
500
522
523
=head2 update_password
524
525
If this tag is left out or set to a true value, then the user's LDAP password
526
will be stored (hashed) in the local Koha database. If you don't want this
527
to happen, then set the value of this to '0'. Note that if passwords are not
528
stored locally, and the connection to the LDAP system fails, then the users
529
will not be able to log in at all.
530
501
=head2 Active Directory 
531
=head2 Active Directory 
502
532
503
The auth_by_bind and principal_name settings are recommended for Active Directory.
533
The auth_by_bind and principal_name settings are recommended for Active Directory.
504
- 

Return to bug 9165