Bug 17113

Summary: Unable to search multi-domain Active Directory forest due LDAP required base
Product: Koha Reporter: Sven Coenye <helpdesk>
Component: AuthenticationAssignee: Galen Charlton <gmcharlt>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: dpavlin, katrin.fischer
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Sven Coenye 2016-08-11 19:24:39 UTC
Auth_with_ldap currently prevents the use of an empty base due to the presence of

my $base = $ldap->{base} or die ldapserver_error('base');

An AD Global Catalog search will automatically query all domains in a forest if a blank base is specified, but otherwise limits the search to the domain matching the base. Not being able to specify an empty base makes things difficult if the forest contains disjoint domains that cannot be combined into a single search base.

(Uncertain how this interacts with the work on bug 8993, but being able to use the forest wide Global Catalog searches removes a lot of the contortions needed to direct requests to the correct host responsible for a domain.)