View | Details | Raw Unified | Return to bug 6979
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-10 / +19 lines)
Lines 96-105 sub search_method { Link Here
96
		warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count) . description($search);
96
		warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count) . description($search);
97
		return 0;
97
		return 0;
98
	}
98
	}
99
	if ($count != 1) {
99
    if ($count == 0) {
100
		warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count);
100
        warn sprintf("LDAP Auth rejected : search with filter '%s' returns no hit\n", $filter->as_string);
101
		return 0;
101
        return 0;
102
	}
102
    }
103
    return $search;
103
    return $search;
104
}
104
}
105
105
Lines 173-187 sub checkpw_ldap { Link Here
173
			return 0;
173
			return 0;
174
		}
174
		}
175
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
175
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
176
        $userldapentry = $search->shift_entry;
176
        # Handle multiple branches. Same login exists several times in different branches.
177
        my $dn = $userldapentry->dn;
177
        my $bind_ok = 0;
178
        my $user_ldap_bind_ret = $db->bind($dn, password => $password);
178
        while (my $entry = $search->shift_entry) {
179
        if ($user_ldap_bind_ret->code) {
179
            my $user_ldap_bind_ret = $db->bind($entry->dn, password => $password);
180
            warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($user_ldap_bind_ret);
180
            unless ($user_ldap_bind_ret->code) {
181
                $userldapentry = $entry;
182
                $bind_ok = 1;
183
                last;
184
            }
185
        }
186
187
        unless ($bind_ok) {
188
            warn "LDAP Auth rejected : invalid password for user '$userid'.";
181
            return -1;
189
            return -1;
182
        }
190
        }
183
191
184
	}
192
193
    }
185
194
186
    # To get here, LDAP has accepted our user's login attempt.
195
    # To get here, LDAP has accepted our user's login attempt.
187
    # But we still have work to do.  See perldoc below for detailed breakdown.
196
    # But we still have work to do.  See perldoc below for detailed breakdown.
(-)a/t/db_dependent/Auth_with_ldap.t (-14 / +15 lines)
Lines 38-47 my $anonymous_bind = 1; Link Here
38
my $desired_authentication_result = 'success';
38
my $desired_authentication_result = 'success';
39
my $desired_connection_result     = 'error';
39
my $desired_connection_result     = 'error';
40
my $desired_admin_bind_result     = 'error';
40
my $desired_admin_bind_result     = 'error';
41
my $desired_compare_result        = 'error';
42
my $desired_search_result         = 'error';
41
my $desired_search_result         = 'error';
43
my $desired_count_result          = 1;
42
my $desired_count_result          = 1;
44
my $desired_bind_result           = 'error';
43
my $desired_bind_result           = 'error';
44
my $remaining_entry = 1;
45
my $ret;
45
my $ret;
46
46
47
# Mock the context module
47
# Mock the context module
Lines 158-168 subtest "checkpw_ldap tests" => sub { Link Here
158
        $anonymous_bind            = 1;
158
        $anonymous_bind            = 1;
159
        $desired_admin_bind_result = 'success';
159
        $desired_admin_bind_result = 'success';
160
        $desired_bind_result = 'error';
160
        $desired_bind_result = 'error';
161
        $desired_search_result = 'success';
162
        $desired_count_result = 1;
161
        reload_ldap_module();
163
        reload_ldap_module();
162
164
163
        warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
165
        warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
164
                               $dbh, 'hola', password => 'hey' ) }
166
                               $dbh, 'hola', password => 'hey' ) }
165
                    qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/,
167
                    qr/LDAP Auth rejected : invalid password for user 'hola'./,
166
                    "checkpw_ldap prints correct warning if LDAP bind fails";
168
                    "checkpw_ldap prints correct warning if LDAP bind fails";
167
        is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)");
169
        is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)");
168
170
Lines 185-191 subtest "checkpw_ldap tests" => sub { Link Here
185
187
186
        warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
188
        warning_like { $ret = C4::Auth_with_ldap::checkpw_ldap(
187
                               $dbh, 'hola', password => 'hey' ) }
189
                               $dbh, 'hola', password => 'hey' ) }
188
                    qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/,
190
                    qr/LDAP Auth rejected : invalid password for user 'hola'./,
189
                    "checkpw_ldap prints correct warning if LDAP bind fails";
191
                    "checkpw_ldap prints correct warning if LDAP bind fails";
190
        is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)");
192
        is ( $ret, -1, "checkpw_ldap returns -1 if bind fails (Bug 8148)");
191
193
Lines 194-200 subtest "checkpw_ldap tests" => sub { Link Here
194
196
195
subtest "search_method tests" => sub {
197
subtest "search_method tests" => sub {
196
198
197
    plan tests => 5;
199
    plan tests => 3;
198
200
199
    my $ldap = mock_net_ldap();
201
    my $ldap = mock_net_ldap();
200
202
Lines 211-224 subtest "search_method tests" => sub { Link Here
211
    like( $@, qr/LDAP search failed to return object : 1/,
213
    like( $@, qr/LDAP search failed to return object : 1/,
212
        "search_method prints correct warning when db->search returns error code");
214
        "search_method prints correct warning when db->search returns error code");
213
215
214
    $desired_search_result = 'success';
215
    $desired_count_result  = 2;
216
    reload_ldap_module();
217
    warning_like { $ret = C4::Auth_with_ldap::search_method( $ldap, '123') }
218
                   qr/^LDAP Auth rejected \: \(uid\=123\) gets 2 hits/,
219
                   "search_method prints correct warning when hits count is not 1";
220
    is( $ret, 0, "search_method returns 0 when hits count is not 1" );
221
222
};
216
};
223
217
224
# Function that mocks the call to C4::Context->config(param)
218
# Function that mocks the call to C4::Context->config(param)
Lines 279-284 sub mock_net_ldap { Link Here
279
273
280
    $mocked_ldap->mock( 'search', sub {
274
    $mocked_ldap->mock( 'search', sub {
281
275
276
        $remaining_entry = 1;
277
282
        return mock_net_ldap_search(
278
        return mock_net_ldap_search(
283
            ( $desired_count_result )             # count
279
            ( $desired_count_result )             # count
284
                ? $desired_count_result
280
                ? $desired_count_result
Lines 313-319 sub mock_net_ldap_search { Link Here
313
    $mocked_search->mock( 'error',       sub { return $error; } );
309
    $mocked_search->mock( 'error',       sub { return $error; } );
314
    $mocked_search->mock( 'error_name',  sub { return $error_name; } );
310
    $mocked_search->mock( 'error_name',  sub { return $error_name; } );
315
    $mocked_search->mock( 'error_text',  sub { return $error_text; } );
311
    $mocked_search->mock( 'error_text',  sub { return $error_text; } );
316
    $mocked_search->mock( 'shift_entry', sub { return $shift_entry; } );
312
    $mocked_search->mock( 'shift_entry', sub {
313
        if ($remaining_entry) {
314
            $remaining_entry--;
315
            return $shift_entry;
316
        }
317
        return '';
318
    });
317
319
318
    return $mocked_search;
320
    return $mocked_search;
319
}
321
}
320
- 

Return to bug 6979