Bug 10908

Summary: Fix broken auth_by_bind LDAP mode
Product: Koha Reporter: Robin Sheat <robin>
Component: AuthenticationAssignee: Robin Sheat <robin>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: blocker    
Priority: P1 - high CC: brendan, chris, derrynj, dpavlin, gmcharlt, katrin.fischer, martin.renvoize, mtompset, ulrich.kleiber
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 10908 - fix broken LDAP
Bug 10908 - restore docs on principal_name
Bug 10908 - fix broken LDAP
Bug 10908 - restore docs on principal_name
[PASSED-QA] Bug 10908 - fix broken LDAP
[PASSED-QA] Bug 10908 - restore docs on principal_name
[PASSED-QA] Bug 10908 - fix broken LDAP
[PASSED-QA] Bug 10908 - restore docs on principal_name

Description Robin Sheat 2013-09-18 05:14:53 UTC
Bug 7973 breaks LDAP for many users, particularly those using active directory by removing the normal auth_by_bind behaviour and requiring that there is an anonymous user to search LDAP with.
Comment 1 Robin Sheat 2013-09-18 05:24:38 UTC
These are the sort of errors you'll see in the logs:

[Wed Sep 18 15:39:10 2013] opac-user.pl: LDAP Auth rejected : (cn=testuser) gets 0 hits
[Wed Sep 18 15:39:10 2013] opac-user.pl: LDAP error #1: LDAP_OPERATIONS_ERROR
[Wed Sep 18 15:39:10 2013] opac-user.pl: # Server encountered an internal error
Comment 2 Robin Sheat 2013-09-18 05:28:09 UTC Comment hidden (obsolete)
Comment 3 Robin Sheat 2013-09-18 05:32:49 UTC Comment hidden (obsolete)
Comment 4 Martin Renvoize 2013-09-18 10:34:30 UTC
So, going back to the ldap methods described in bug 7973 and bug 10842, the new set of methods including your patch would be?

Method 1:
1) Bind with a service account
2) Search for user entered
3) Bind as user if found

Method 2:
1) Bind with an Anonymous user
2) Search for user entered
3) Bind as user if found.

Method 3 (The original):
1) Bind directly to the user, no search takes place.


Just trying to clarify for myself and others. Is that correct Robin?
Comment 5 Robin Sheat 2013-09-18 11:36:03 UTC
That's how I understand it, though method three actually does do a search in that it searches for itself in order to fetch the whole record from LDAP. However, in essence you're correct as far as I can tell.
Comment 6 Ulrich Kleiber 2013-09-30 09:21:04 UTC Comment hidden (obsolete)
Comment 7 Ulrich Kleiber 2013-09-30 09:22:14 UTC Comment hidden (obsolete)
Comment 8 Robin Sheat 2013-09-30 21:17:01 UTC
Thanks Uli! :)
Comment 9 Katrin Fischer 2013-10-06 22:14:47 UTC
This is a blocker - as Uli from BSZ has signed off I shouldn't do QA and I honestly can't because I don't know how to set up a test environment for LDAP. Is there someone else who can on the QA team?
Comment 10 Mark Tompsett 2013-10-07 06:59:49 UTC
sudo apt-get install ldap-server

Make sure to remember the password you use to set this up!
Next, we'll figure out the connection string.

sudo slapcat

The second entries 'dn' line will be important in setting up LDAP authentication

sudo apt-get install phpldapadmin

Now you should be able to web browse to http.../phpldapadmin and actually log in with the information you got from slapcat.

cn=admin;dc=<from slapcat>
<password set while installing ldap-server>

Congratulations, you have an LDAP server with just the admin user set up on your machine. Feel free to "sudo apt-get remove phpldapadmin". That was just to prove the set up was working.

Then you'll need to tweak your koha-conf.xml

hostname should be the nice name you'd use for the machine.
base I matched to be "dc=<slapcat mess>"
same with user.
and of course principle_name.
in the mapping section, the branchcode and patron code better be in your system already.


<useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on -->
<ldapserver id='ldapserver'  listenref='ldapserver'>
<hostname>demo.library.kohasystem.ca</hostname>
<base>dc=nodomain</base>
<user>CN=admin,OU=Special,OU=Accounts,DC=nodomain</user>
<pass>ldap123</pass>
<replicate>1</replicate>
<update>1</update>
<auth_by_bind>1</auth_by_bind>
<principal_name>CN=%s,DC=nodomain</principal_name>
<mapping>
<firstname    is='givenname'></firstname>
<surname      is='sn'> </surname>
<address      is='postaladdress'>3900 University Blvd</address>
<city         is='l'>Tyler, TX</city>
<zipcode      is='postalcode'>75799</zipcode>
<branchcode   is=''>MNL</branchcode>
<userid       is='cn'></userid>
<password     is=''></password>
<cardnumber   is='extensionattribute2'></cardnumber>
<email        is='userprincipalname'></email>
<categorycode is=''>PT</categorycode>
<phone        is='telephonenumber'>903-566-7343</phone>
<dateenrolled is=''>2011-03-27</dateenrolled>
<dateexpiry   is=''>2011-05-13</dateexpiry>
</mapping>
</ldapserver>

Hope this helps, KF.
Comment 11 Katrin Fischer 2013-10-07 07:19:50 UTC
Thx Mark. I am not sure when I have time for this - if anyone wants to have a go on this I would appreciate it.
Comment 12 Brendan Gallagher 2013-10-20 22:01:01 UTC Comment hidden (obsolete)
Comment 13 Brendan Gallagher 2013-10-20 22:19:12 UTC Comment hidden (obsolete)
Comment 14 Brendan Gallagher 2013-10-20 23:36:27 UTC
Created attachment 22137 [details] [review]
[PASSED-QA] Bug 10908 - fix broken LDAP

Recent changes to LDAP broke auth_by_bind in many situations. This bug
resets the behaviour to what it used to be, however also allows the new
behaviour by adding the 'anonymous_bind' parameter to the LDAP config.

Testing:
    1) Find an LDAP configuration that was broken recently that uses
       auth_by_bind
    2) Apply this patch
    3) See if it works again.
Additionally, testing the original path in the case of 'anonymous_bind'
being set should probably be done too, but I have no idea about the LDAP
server config for that.

Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 15 Brendan Gallagher 2013-10-20 23:36:37 UTC
Created attachment 22138 [details] [review]
[PASSED-QA] Bug 10908 - restore docs on principal_name

Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 16 Galen Charlton 2013-10-21 15:30:09 UTC
Pushed to master.  Thanks, Robin!
Comment 17 Katrin Fischer 2014-01-24 15:57:13 UTC
I see that we use those patches locally on 3.12.7 and wonder why I marked it resolved fixed. Resetting to pushed to stable to get it checked for backporting.
Comment 18 Mark Tompsett 2014-04-11 15:30:18 UTC
*** Bug 10842 has been marked as a duplicate of this bug. ***