View | Details | Raw Unified | Return to bug 7973
Collapse All | Expand All

(-)a/C4/Auth_with_ldap.pm (-22 / +35 lines)
Lines 103-125 sub checkpw_ldap { Link Here
103
    my ($dbh, $userid, $password) = @_;
103
    my ($dbh, $userid, $password) = @_;
104
    my @hosts = split(',', $prefhost);
104
    my @hosts = split(',', $prefhost);
105
    my $db = Net::LDAP->new(\@hosts);
105
    my $db = Net::LDAP->new(\@hosts);
106
	#$debug and $db->debug(5);
106
    #$debug and $db->debug(5);
107
    print STDERR "Checking Password!!";
107
    my $userldapentry;
108
    my $userldapentry;
108
	if ( $ldap->{auth_by_bind} ) {
109
    if ( $ldap->{auth_by_bind} ) {
109
        my $principal_name = $ldap->{principal_name};
110
        my $principal_name = $ldap->{principal_name};
110
        if ($principal_name and $principal_name =~ /\%/) {
111
        if ($principal_name and $principal_name =~ /\%/) {
111
            $principal_name = sprintf($principal_name,$userid);
112
            $principal_name = sprintf($principal_name,$userid);
112
        } else {
113
        } else {
113
            $principal_name = $userid;
114
            $principal_name = $userid;
114
        }
115
        }
115
		my $res = $db->bind( $principal_name, password => $password );
116
	my $res = $db->bind( $principal_name, password => $password );
116
        if ( $res->code ) {
117
        if ( $res->code ) {
117
            $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);
118
            $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);
118
            return 0;
119
            return 0;
119
        }
120
        }
120
121
	
121
	# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!
122
	# FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind!
122
123
	
123
	# BUG #5094
124
	# BUG #5094
124
	# 2010-08-04 JeremyC
125
	# 2010-08-04 JeremyC
125
	# a $userldapentry is only needed if either updating or replicating are enabled
126
	# a $userldapentry is only needed if either updating or replicating are enabled
Lines 127-154 sub checkpw_ldap { Link Here
127
	    my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
128
	    my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
128
	    $userldapentry = $search->shift_entry;
129
	    $userldapentry = $search->shift_entry;
129
	}
130
	}
130
131
    } elsif($ldap->{bind_with_service}) {
131
	} else {
132
        my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
132
		my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
133
	if ($res->code) {               # connection refused                                                                                                                                                                                                                                                                
133
		if ($res->code) {		# connection refused
134
            warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
134
			warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
135
            return 0;
135
			return 0;
136
        }
136
		}
137
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub                                                                                                                                                                                                                                    
138
        $userldapentry = $search->shift_entry;
139
        my $ldapusername = $userldapentry->get('distinguishedName');
140
        $res = $db->bind(@$ldapusername[0], password => $password);
141
        if ( $res->code ) {
142
            $debug and warn "LDAP bind failed as kohauser ". @$ldapusername[0] . " " . description($res);
143
            return 0;
144
        }
145
    } else {
146
	my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword);
147
	if ($res->code) {		# connection refused
148
	    warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res);
149
	    return 0;
150
	}
137
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
151
        my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
138
        $userldapentry = $search->shift_entry;
152
        $userldapentry = $search->shift_entry;
139
		my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password );
153
	my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password );
140
		if ($cmpmesg->code != 6) {
154
	if ($cmpmesg->code != 6) {
141
			warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg);
155
	    warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg);
142
			return 0;
156
	    return 0;
143
		}
144
	}
157
	}
145
158
    }
159
    
146
    # To get here, LDAP has accepted our user's login attempt.
160
    # To get here, LDAP has accepted our user's login attempt.
147
    # But we still have work to do.  See perldoc below for detailed breakdown.
161
    # But we still have work to do.  See perldoc below for detailed breakdown.
148
162
    
149
    my (%borrower);
163
    my (%borrower);
150
	my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid);
164
    my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid);
151
165
    
152
    if (( $borrowernumber and $config{update}   ) or
166
    if (( $borrowernumber and $config{update}   ) or
153
        (!$borrowernumber and $config{replicate})   ) {
167
        (!$borrowernumber and $config{replicate})   ) {
154
        %borrower = ldap_entry_2_hash($userldapentry,$userid);
168
        %borrower = ldap_entry_2_hash($userldapentry,$userid);
155
- 

Return to bug 7973