View | Details | Raw Unified | Return to bug 9165
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-2 / +31 lines)
Lines 282-290 sub exists_local { Link Here
282
	return 0;
282
	return 0;
283
}
283
}
284
284
285
# This function performs a password update, given the userid, borrowerid,
286
# and digested password. It will verify that things are correct and return the
287
# borrowers cardnumber. The idea is that it is used to keep the local
288
# passwords in sync with the LDAP passwords.
289
#
290
#   $cardnum = _do_changepassword($userid, $borrowerid, $digest)
291
#
292
# Note: if the LDAP config has the update_password tag set to a false value,
293
# then this will not update the password, it will simply return the cardnumber.
285
sub _do_changepassword {
294
sub _do_changepassword {
286
    my ($userid, $borrowerid, $password) = @_;
295
    my ($userid, $borrowerid, $password) = @_;
287
296
297
    if ( exists( $ldap->{update_password} ) && !$ldap->{update_password} ) {
298
299
        # We don't store the password in the database
300
        my $sth = C4::Context->dbh->prepare(
301
            'SELECT cardnumber FROM borrowers WHERE borrowernumber=?');
302
        $sth->execute($borrowerid);
303
        die
304
"Unable to access borrowernumber with userid=$userid, borrowernumber=$borrowerid"
305
          if !$sth->rows;
306
        my ($cardnum) = $sth->fetchrow;
307
        return $cardnum;
308
    }
288
    my $digest = hash_password($password);
309
    my $digest = hash_password($password);
289
310
290
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
311
    $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n";
Lines 444-450 Example XML stanza for LDAP configuration in KOHA_CONF. Link Here
444
    <principal_name>%s@my_domain.com</principal_name>
465
    <principal_name>%s@my_domain.com</principal_name>
445
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid.
466
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid.
446
                                        Not used with anonymous_bind. -->
467
                                        Not used with anonymous_bind. -->
447
468
    <update_password>1</update_password> <!-- set to 0 if you don't want LDAP passwords
469
                                              synced to the local database -->
448
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
470
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
449
      <firstname    is="givenname"      ></firstname>
471
      <firstname    is="givenname"      ></firstname>
450
      <surname      is="sn"             ></surname>
472
      <surname      is="sn"             ></surname>
Lines 502-507 attribute that the server allows to be used for binding could be used. Link Here
502
524
503
Currently, principal_name only operates when auth_by_bind is enabled.
525
Currently, principal_name only operates when auth_by_bind is enabled.
504
526
527
=head2 update_password
528
529
If this tag is left out or set to a true value, then the user's LDAP password
530
will be stored (hashed) in the local Koha database. If you don't want this
531
to happen, then set the value of this to '0'. Note that if passwords are not
532
stored locally, and the connection to the LDAP system fails, then the users
533
will not be able to log in at all.
534
505
=head2 Active Directory 
535
=head2 Active Directory 
506
536
507
The auth_by_bind and principal_name settings are recommended for Active Directory.
537
The auth_by_bind and principal_name settings are recommended for Active Directory.
508
- 

Return to bug 9165