View | Details | Raw Unified | Return to bug 6979
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-13 / +19 lines)
Lines 105-110 sub checkpw_ldap { Link Here
105
    my $db = Net::LDAP->new(\@hosts);
105
    my $db = Net::LDAP->new(\@hosts);
106
	#$debug and $db->debug(5);
106
	#$debug and $db->debug(5);
107
    my $userldapentry;
107
    my $userldapentry;
108
109
	# first, LDAP authentication
108
	if ( $ldap->{auth_by_bind} ) {
110
	if ( $ldap->{auth_by_bind} ) {
109
        my $principal_name = $ldap->{principal_name};
111
        my $principal_name = $ldap->{principal_name};
110
        if ($principal_name and $principal_name =~ /\%/) {
112
        if ($principal_name and $principal_name =~ /\%/) {
Lines 118-132 sub checkpw_ldap { Link Here
118
            return 0;
120
            return 0;
119
        }
121
        }
120
122
121
	# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!
123
		# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!
122
124
123
	# BUG #5094
125
		# BUG #5094
124
	# 2010-08-04 JeremyC
126
		# 2010-08-04 JeremyC
125
	# a $userldapentry is only needed if either updating or replicating are enabled
127
		# a $userldapentry is only needed if either updating or replicating are enabled
126
	if($config{update} or $config{replicate}) {
128
		if($config{update} or $config{replicate}) {
127
	    my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
129
		    my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
128
	    $userldapentry = $search->shift_entry;
130
		    $userldapentry = $search->shift_entry;
129
	}
131
		}
130
132
131
	} else {
133
	} else {
132
		my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
134
		my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
Lines 136-145 sub checkpw_ldap { Link Here
136
		}
138
		}
137
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
139
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
138
        $userldapentry = $search->shift_entry;
140
        $userldapentry = $search->shift_entry;
139
		my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password );
141
140
		if ($cmpmesg->code != 6) {
142
		# BUG 6979
141
			warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg);
143
		# 2011-09-29 Robert Fox (rfox2@nd.edu)
142
			return 0;
144
		# Fix for password comparison bug
145
		my $dn = $userldapentry->dn;
146
		my $user_ldap_bind_ret = $db->bind($dn, password => $password);	
147
		if ($user_ldap_bind_ret->code) {
148
			warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($user_ldap_bind_ret);
149
			 return 0;
143
		}
150
		}
144
	}
151
	}
145
152
146
- 

Return to bug 6979