View | Details | Raw Unified | Return to bug 18947
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-5 / +4 lines)
Lines 60-66 my $prefhost = $ldap->{hostname} or die ldapserver_error('hostname'); Link Here
60
my $base      = $ldap->{base}		or die ldapserver_error('base');
60
my $base      = $ldap->{base}		or die ldapserver_error('base');
61
$ldapname     = $ldap->{user}		;
61
$ldapname     = $ldap->{user}		;
62
$ldappassword = $ldap->{pass}		;
62
$ldappassword = $ldap->{pass}		;
63
$ldap->{anonymous_bind} = 1 unless $ldapname && $ldappassword;
64
our %mapping  = %{$ldap->{mapping}}; # FIXME dpavlin -- don't die because of || (); from 6eaf8511c70eb82d797c941ef528f4310a15e9f9
63
our %mapping  = %{$ldap->{mapping}}; # FIXME dpavlin -- don't die because of || (); from 6eaf8511c70eb82d797c941ef528f4310a15e9f9
65
my @mapkeys = keys %mapping;
64
my @mapkeys = keys %mapping;
66
$debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys (  total  ): ", join ' ', @mapkeys, "\n";
65
$debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys (  total  ): ", join ' ', @mapkeys, "\n";
Lines 77-83 if(defined $ldap->{categorycode_mapping}) { Link Here
77
}
76
}
78
77
79
my %config = (
78
my %config = (
80
	anonymous => ($ldapname and $ldappassword) ? 0 : 1,
79
	anonymous => defined ($ldap->{anonymous_bind}) ? $ldap->{anonymous_bind} : 1,
81
    replicate => defined($ldap->{replicate}) ? $ldap->{replicate} : 1,  #    add from LDAP to Koha database for new user
80
    replicate => defined($ldap->{replicate}) ? $ldap->{replicate} : 1,  #    add from LDAP to Koha database for new user
82
       update => defined($ldap->{update}   ) ? $ldap->{update}    : 1,  # update from LDAP to Koha database for existing user
81
       update => defined($ldap->{update}   ) ? $ldap->{update}    : 1,  # update from LDAP to Koha database for existing user
83
);
82
);
Lines 128-134 sub checkpw_ldap { Link Here
128
    # first, LDAP authentication
127
    # first, LDAP authentication
129
    if ( $ldap->{auth_by_bind} ) {
128
    if ( $ldap->{auth_by_bind} ) {
130
        my $principal_name;
129
        my $principal_name;
131
        if ( $ldap->{anonymous_bind} ) {
130
        if ( $config{anonymous} ) {
132
131
133
            # Perform an anonymous bind
132
            # Perform an anonymous bind
134
            my $res = $db->bind;
133
            my $res = $db->bind;
Lines 156-162 sub checkpw_ldap { Link Here
156
        # Perform a LDAP bind for the given username using the matched DN
155
        # Perform a LDAP bind for the given username using the matched DN
157
        my $res = $db->bind( $principal_name, password => $password );
156
        my $res = $db->bind( $principal_name, password => $password );
158
        if ( $res->code ) {
157
        if ( $res->code ) {
159
            if ( $ldap->{anonymous_bind} ) {
158
            if ( $config{anonymous} ) {
160
                # With anonymous_bind approach we can be sure we have found the correct user
159
                # With anonymous_bind approach we can be sure we have found the correct user
161
                # and that any 'code' response indicates a 'bad' user (be that blocked, banned
160
                # and that any 'code' response indicates a 'bad' user (be that blocked, banned
162
                # or password changed). We should not fall back to local accounts in this case.
161
                # or password changed). We should not fall back to local accounts in this case.
Lines 177-183 sub checkpw_ldap { Link Here
177
            $userldapentry = $search->shift_entry;
176
            $userldapentry = $search->shift_entry;
178
        }
177
        }
179
    } else {
178
    } else {
180
		my $res = ($ldap->{anonymous_bind}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
179
		my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
181
		if ($res->code) {		# connection refused
180
		if ($res->code) {		# connection refused
182
			warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
181
			warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
183
			return 0;
182
			return 0;
(-)a/t/db_dependent/Auth_with_ldap.t (-5 / +21 lines)
Lines 41-46 my $update = 0; Link Here
41
my $replicate      = 0;
41
my $replicate      = 0;
42
my $auth_by_bind   = 1;
42
my $auth_by_bind   = 1;
43
my $anonymous_bind = 1;
43
my $anonymous_bind = 1;
44
my $user           = 'cn=Manager,dc=metavore,dc=com';
45
my $pass           = 'metavore';
44
46
45
# Variables controlling LDAP behaviour
47
# Variables controlling LDAP behaviour
46
my $desired_authentication_result = 'success';
48
my $desired_authentication_result = 'success';
Lines 143-149 subtest 'checkpw_ldap tests' => sub { Link Here
143
145
144
    subtest 'auth_by_bind = 1 tests' => sub {
146
    subtest 'auth_by_bind = 1 tests' => sub {
145
147
146
        plan tests => 9;
148
        plan tests => 11;
147
149
148
        $auth_by_bind = 1;
150
        $auth_by_bind = 1;
149
151
Lines 161-166 subtest 'checkpw_ldap tests' => sub { Link Here
161
          'checkpw_ldap prints correct warning if LDAP anonymous bind fails';
163
          'checkpw_ldap prints correct warning if LDAP anonymous bind fails';
162
        is( $ret, 0, 'checkpw_ldap returns 0 if LDAP anonymous bind fails' );
164
        is( $ret, 0, 'checkpw_ldap returns 0 if LDAP anonymous bind fails' );
163
165
166
        $anonymous_bind = 0;
167
        $user = undef;
168
        $pass = undef;
169
        reload_ldap_module();
170
171
        warning_like {
172
            $ret = C4::Auth_with_ldap::checkpw_ldap( $dbh, 'hola',
173
                password => 'hey' );
174
        }
175
        qr/LDAP bind failed as kohauser hola: LDAP error #1: error_name/,
176
          'checkpw_ldap prints correct warning if LDAP bind_by_auth fails';
177
        is( $ret, 0, 'checkpw_ldap returns 0 if LDAP bind_by_auth fails' );
178
164
        $desired_authentication_result = 'success';
179
        $desired_authentication_result = 'success';
165
        $anonymous_bind                = 1;
180
        $anonymous_bind                = 1;
166
        $desired_admin_bind_result   = 'success';
181
        $desired_admin_bind_result   = 'success';
Lines 251-258 subtest 'checkpw_ldap tests' => sub { Link Here
251
266
252
        # Anonymous bind
267
        # Anonymous bind
253
        $anonymous_bind            = 1;
268
        $anonymous_bind            = 1;
269
        $user                      = 'cn=Manager,dc=metavore,dc=com';
270
        $pass                      = 'metavore';
254
        $desired_admin_bind_result = 'error';
271
        $desired_admin_bind_result = 'error';
255
        $desired_bind_result = 'error';
272
        $desired_bind_result       = 'error';
256
        reload_ldap_module();
273
        reload_ldap_module();
257
274
258
        warning_like {
275
        warning_like {
Lines 361-371 sub mockedC4Config { Link Here
361
            base           => 'dc=metavore,dc=com',
378
            base           => 'dc=metavore,dc=com',
362
            hostname       => 'localhost',
379
            hostname       => 'localhost',
363
            mapping        => \%ldap_mapping,
380
            mapping        => \%ldap_mapping,
364
            pass           => 'metavore',
381
            pass           => $pass,
365
            principal_name => '%s@my_domain.com',
382
            principal_name => '%s@my_domain.com',
366
            replicate      => $replicate,
383
            replicate      => $replicate,
367
            update         => $update,
384
            update         => $update,
368
            user           => 'cn=Manager,dc=metavore,dc=com',
385
            user           => $user,
369
        );
386
        );
370
        return \%ldap_config;
387
        return \%ldap_config;
371
    }
388
    }
372
- 

Return to bug 18947