View | Details | Raw Unified | Return to bug 12831
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-3 / +13 lines)
Lines 145-152 sub checkpw_ldap { Link Here
145
        # Perform a LDAP bind for the given username using the matched DN
145
        # Perform a LDAP bind for the given username using the matched DN
146
        my $res = $db->bind( $principal_name, password => $password );
146
        my $res = $db->bind( $principal_name, password => $password );
147
        if ( $res->code ) {
147
        if ( $res->code ) {
148
            warn "LDAP bind failed as kohauser $userid: " . description($res);
148
            if ( $ldap->{anonymous_bind} ) {
149
            return -1;
149
                # With anonymous_bind approach we can be sure we have found the correct user
150
                # and that any 'code' response indicates a 'bad' user (be that blocked, banned
151
                # or password changed). We should not fall back to local accounts in this case.
152
                warn "LDAP bind failed as kohauser $userid: " . description($res);
153
                return -1;
154
            } else {
155
                # Without a anonymous_bind, we cannot be sure we are looking at a valid ldap user
156
                # at all, and thus we should fall back to local logins to restore previous behaviour
157
                # see bug 12831
158
                warn "LDAP bind failed as kohauser $userid: " . description($res);
159
                return 0;
160
            }
150
        }
161
        }
151
        if ( !defined($userldapentry)
162
        if ( !defined($userldapentry)
152
            && ( $config{update} or $config{replicate} ) )
163
            && ( $config{update} or $config{replicate} ) )
153
- 

Return to bug 12831