View | Details | Raw Unified | Return to bug 9165
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-2 / +31 lines)
Lines 293-301 sub exists_local { Link Here
293
	return 0;
293
	return 0;
294
}
294
}
295
295
296
# This function performs a password update, given the userid, borrowerid,
297
# and digested password. It will verify that things are correct and return the
298
# borrowers cardnumber. The idea is that it is used to keep the local
299
# passwords in sync with the LDAP passwords.
300
#
301
#   $cardnum = _do_changepassword($userid, $borrowerid, $digest)
302
#
303
# Note: if the LDAP config has the update_password tag set to a false value,
304
# then this will not update the password, it will simply return the cardnumber.
296
sub _do_changepassword {
305
sub _do_changepassword {
297
    my ($userid, $borrowerid, $password) = @_;
306
    my ($userid, $borrowerid, $password) = @_;
298
307
308
    if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) {
309
310
        # We don't store the password in the database
311
        my $sth = C4::Context->dbh->prepare(
312
            'SELECT cardnumber FROM borrowers WHERE borrowernumber=?');
313
        $sth->execute($borrowerid);
314
        die
315
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid"
316
          if !$sth->rows;
317
        my ($cardnum) = $sth->fetchrow;
318
        return $cardnum;
319
    }
299
    my $digest = hash_password($password);
320
    my $digest = hash_password($password);
300
321
301
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
322
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
Lines 455-461 Example XML stanza for LDAP configuration in KOHA_CONF. Link Here
455
    <principal_name>%s@my_domain.com</principal_name>
476
    <principal_name>%s@my_domain.com</principal_name>
456
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid.
477
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid.
457
                                        Not used with anonymous_bind. -->
478
                                        Not used with anonymous_bind. -->
458
479
    <update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords
480
                                              synced to the local database -->
459
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
481
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
460
      <firstname    is="givenname"      ></firstname>
482
      <firstname    is="givenname"      ></firstname>
461
      <surname      is="sn"             ></surname>
483
      <surname      is="sn"             ></surname>
Lines 513-518 attribute that the server allows to be used for binding could be used. Link Here
513
535
514
Currently, principal_name only operates when auth_by_bind is enabled.
536
Currently, principal_name only operates when auth_by_bind is enabled.
515
537
538
=head2 update_password
539
540
If this tag is left out or set to a true value, then the user's LDAP password
541
will be stored (hashed) in the local Koha database. If you don't want this
542
to happen, then set the value of this to '0'. Note that if passwords are not
543
stored locally, and the connection to the LDAP system fails, then the users
544
will not be able to log in at all.
545
516
=head2 Active Directory 
546
=head2 Active Directory 
517
547
518
The auth_by_bind and principal_name settings are recommended for Active Directory.
548
The auth_by_bind and principal_name settings are recommended for Active Directory.
519
- 

Return to bug 9165