From 273640af587a88b0cff5e9199867b4323ecd635a Mon Sep 17 00:00:00 2001 From: Elliott Davis Date: Tue, 17 Apr 2012 12:33:53 +0000 Subject: [PATCH 2/2] Bug 7973 \n Adds another sequence for LDAP binds --- C4/Auth_with_ldap.pm | 56 +++++++++++++++++++++++++++++++------------------ 1 files changed, 35 insertions(+), 21 deletions(-) diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm index fc1d63b..344c3f4 100644 --- a/C4/Auth_with_ldap.pm +++ b/C4/Auth_with_ldap.pm @@ -103,23 +103,24 @@ sub checkpw_ldap { my ($dbh, $userid, $password) = @_; my @hosts = split(',', $prefhost); my $db = Net::LDAP->new(\@hosts); - #$debug and $db->debug(5); + #$debug and $db->debug(5); + print STDERR "Checking Password!!"; my $userldapentry; - if ( $ldap->{auth_by_bind} ) { + if ( $ldap->{auth_by_bind} ) { my $principal_name = $ldap->{principal_name}; if ($principal_name and $principal_name =~ /\%/) { $principal_name = sprintf($principal_name,$userid); } else { $principal_name = $userid; } - my $res = $db->bind( $principal_name, password => $password ); + my $res = $db->bind( $principal_name, password => $password ); if ( $res->code ) { $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res); return 0; } - + # FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind! - + # BUG #5094 # 2010-08-04 JeremyC # a $userldapentry is only needed if either updating or replicating are enabled @@ -127,28 +128,41 @@ sub checkpw_ldap { my $search = search_method($db, $userid) or return 0; # warnings are in the sub $userldapentry = $search->shift_entry; } - - } else { - my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); - if ($res->code) { # connection refused - warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); - return 0; - } + } elsif($ldap->{bind_with_service}) { + my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); + if ($res->code) { # connection refused + warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); + return 0; + } + my $search = search_method($db, $userid) or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; + my $ldapusername = $userldapentry->get('distinguishedName'); + $res = $db->bind(@$ldapusername[0], password => $password); + if ( $res->code ) { + $debug and warn "LDAP bind failed as kohauser ". @$ldapusername[0] . " " . description($res); + return 0; + } + } else { + my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); + if ($res->code) { # connection refused + warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); + return 0; + } my $search = search_method($db, $userid) or return 0; # warnings are in the sub $userldapentry = $search->shift_entry; - my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password ); - if ($cmpmesg->code != 6) { - warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg); - return 0; - } + my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password ); + if ($cmpmesg->code != 6) { + warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg); + return 0; } - + } + # To get here, LDAP has accepted our user's login attempt. # But we still have work to do. See perldoc below for detailed breakdown. - + my (%borrower); - my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid); - + my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid); + if (( $borrowernumber and $config{update} ) or (!$borrowernumber and $config{replicate}) ) { %borrower = ldap_entry_2_hash($userldapentry,$userid); -- 1.7.2.5