View | Details | Raw Unified | Return to bug 6979
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-10 / +19 lines)
Lines 106-115 sub search_method { Link Here
106
		warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count) . description($search);
106
		warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count) . description($search);
107
		return 0;
107
		return 0;
108
	}
108
	}
109
	if ($count != 1) {
109
    if ($count == 0) {
110
		warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count);
110
        warn sprintf("LDAP Auth rejected : search with filter '%s' returns no hit\n", $filter->as_string);
111
		return 0;
111
        return 0;
112
	}
112
    }
113
    return $search;
113
    return $search;
114
}
114
}
115
115
Lines 183-197 sub checkpw_ldap { Link Here
183
			return 0;
183
			return 0;
184
		}
184
		}
185
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
185
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
186
        $userldapentry = $search->shift_entry;
186
        # Handle multiple branches. Same login exists several times in different branches.
187
        my $dn = $userldapentry->dn;
187
        my $bind_ok = 0;
188
        my $user_ldap_bind_ret = $db->bind($dn, password => $password);
188
        while (my $entry = $search->shift_entry) {
189
        if ($user_ldap_bind_ret->code) {
189
            my $user_ldap_bind_ret = $db->bind($entry->dn, password => $password);
190
            warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($user_ldap_bind_ret);
190
            unless ($user_ldap_bind_ret->code) {
191
                $userldapentry = $entry;
192
                $bind_ok = 1;
193
                last;
194
            }
195
        }
196
197
        unless ($bind_ok) {
198
            warn "LDAP Auth rejected : invalid password for user '$userid'.";
191
            return -1;
199
            return -1;
192
        }
200
        }
193
201
194
	}
202
203
    }
195
204
196
    # To get here, LDAP has accepted our user's login attempt.
205
    # To get here, LDAP has accepted our user's login attempt.
197
    # But we still have work to do.  See perldoc below for detailed breakdown.
206
    # But we still have work to do.  See perldoc below for detailed breakdown.
(-)a/t/db_dependent/Auth_with_ldap.t (-15 / +15 lines)
Lines 45-54 my $anonymous_bind = 1; Link Here
45
my $desired_authentication_result = 'success';
45
my $desired_authentication_result = 'success';
46
my $desired_connection_result     = 'error';
46
my $desired_connection_result     = 'error';
47
my $desired_admin_bind_result     = 'error';
47
my $desired_admin_bind_result     = 'error';
48
my $desired_compare_result        = 'error';
49
my $desired_search_result         = 'error';
48
my $desired_search_result         = 'error';
50
my $desired_count_result          = 1;
49
my $desired_count_result          = 1;
51
my $desired_bind_result           = 'error';
50
my $desired_bind_result           = 'error';
51
my $remaining_entry = 1;
52
my $ret;
52
my $ret;
53
53
54
# Mock the context module
54
# Mock the context module
Lines 244-256 qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: er Link Here
244
        $anonymous_bind            = 1;
244
        $anonymous_bind            = 1;
245
        $desired_admin_bind_result = 'success';
245
        $desired_admin_bind_result = 'success';
246
        $desired_bind_result = 'error';
246
        $desired_bind_result = 'error';
247
        $desired_search_result = 'success';
248
        $desired_count_result = 1;
247
        reload_ldap_module();
249
        reload_ldap_module();
248
250
249
        warning_like {
251
        warning_like {
250
            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
252
            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
251
                password => 'hey' );
253
                password => 'hey' );
252
        }
254
        }
253
qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/,
255
qr/LDAP Auth rejected : invalid password for user 'hola'./,
254
          'checkpw_ldap prints correct warning if LDAP bind fails';
256
          'checkpw_ldap prints correct warning if LDAP bind fails';
255
        is( $ret, -1, 'checkpw_ldap returns -1 if bind fails (Bug 8148)' );
257
        is( $ret, -1, 'checkpw_ldap returns -1 if bind fails (Bug 8148)' );
256
258
Lines 277-283 qr/LDAP bind failed as ldapuser cn=Manager,dc=metavore,dc=com: LDAP error #1: er Link Here
277
            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
279
            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
278
                password => 'hey' );
280
                password => 'hey' );
279
        }
281
        }
280
qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_name/,
282
qr/LDAP Auth rejected : invalid password for user 'hola'./,
281
          'checkpw_ldap prints correct warning if LDAP bind fails';
283
          'checkpw_ldap prints correct warning if LDAP bind fails';
282
        is( $ret, -1, 'checkpw_ldap returns -1 if bind fails (Bug 8148)' );
284
        is( $ret, -1, 'checkpw_ldap returns -1 if bind fails (Bug 8148)' );
283
285
Lines 286-292 qr/LDAP Auth rejected : invalid password for user 'hola'. LDAP error #1: error_n Link Here
286
288
287
subtest 'search_method tests' => sub {
289
subtest 'search_method tests' => sub {
288
290
289
    plan tests => 5;
291
    plan tests => 3;
290
292
291
    my $ldap = mock_net_ldap();
293
    my $ldap = mock_net_ldap();
292
294
Lines 306-320 subtest 'search_method tests' => sub { Link Here
306
        qr/LDAP search failed to return object : 1/,
308
        qr/LDAP search failed to return object : 1/,
307
'search_method prints correct warning when db->search returns error code'
309
'search_method prints correct warning when db->search returns error code'
308
    );
310
    );
309
310
    $desired_search_result = 'success';
311
    $desired_count_result  = 2;
312
    reload_ldap_module();
313
    warning_like { $ret = C4::Auth_with_ldap::search_method( $ldap, '123' ) }
314
    qr/^LDAP Auth rejected \: \(uid\=123\) gets 2 hits/,
315
      'search_method prints correct warning when hits count is not 1';
316
    is( $ret, 0, 'search_method returns 0 when hits count is not 1' );
317
318
};
311
};
319
312
320
# Function that mocks the call to C4::Context->config(param)
313
# Function that mocks the call to C4::Context->config(param)
Lines 389-394 sub mock_net_ldap { Link Here
389
        'search',
382
        'search',
390
        sub {
383
        sub {
391
384
385
            $remaining_entry = 1
386
392
            return mock_net_ldap_search(
387
            return mock_net_ldap_search(
393
                {
388
                {
394
                    count => ($desired_count_result)
389
                    count => ($desired_count_result)
Lines 431-437 sub mock_net_ldap_search { Link Here
431
    $mocked_search->mock( 'error',       sub { return $error; } );
426
    $mocked_search->mock( 'error',       sub { return $error; } );
432
    $mocked_search->mock( 'error_name',  sub { return $error_name; } );
427
    $mocked_search->mock( 'error_name',  sub { return $error_name; } );
433
    $mocked_search->mock( 'error_text',  sub { return $error_text; } );
428
    $mocked_search->mock( 'error_text',  sub { return $error_text; } );
434
    $mocked_search->mock( 'shift_entry', sub { return $shift_entry; } );
429
    $mocked_search->mock( 'shift_entry', sub {
430
        if ($remaining_entry) {
431
            $remaining_entry--;
432
            return $shift_entry;
433
        }
434
        return '';
435
    });
435
436
436
    return $mocked_search;
437
    return $mocked_search;
437
}
438
}
438
- 

Return to bug 6979