Bug 31596

Summary: LDAP ACTIVE DIRECTORY with different domain suffix
Product: Koha Reporter: ciarebaha <hamsiah>
Component: AuthenticationAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: enhancement    
Priority: P1 - high CC: dcook, dpavlin, hamsiah
Version: unspecified   
Hardware: Other   
OS: Linux   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Description ciarebaha 2022-09-22 04:49:14 UTC
Koha version:	18.11.13.000
OS version ('uname -a'): Linux 3.16.0-6-amd64 #1 SMP Debian 3.16.57-2 (2018-07-14) x86_64

Hi,
I have success connecting KOHA with ACTIVE DIRECTORY for staff. However if I want to authenticate student, login is failed due to different domain suffix. This is my working ldap-activedirectory authentication. 

------------------------------------------------------------

<useldapserver>1</useldapserver>
  <ldapserver id="ldapserver" listenref="ldapserver">
  <hostname>ldap://ldaphostname:389</hostname>
  <base>OU=Staf,OU=Student,OU=User,OU=uuu,DC=dc,DC=local</base>
  <replicate>0</replicate>
  <update>0</update>
  <auth_by_bind>1</auth_by_bind>
  <anonymous_bind>0</anonymous_bind>
  <principal_name>%s@uuu.edu.my</principal_name>
  <update_password>0</update_password>
  <mapping>
      <userid       is="CN"        ></userid>
  </mapping>
  </ldapserver>

-------------------------------------------------------------

This config is already working smoothly. But since STUDENT's email has different suffix domain such as %s@student.uuu.edu.my, hence the login is failed. 

Is there a way to combine multiple principal_name to make this work? I have read other bugs that said multiple ldapserver is not developed. In this case, it's not multiple ldapserver cause it has the same hostname and details. Only the domain in principal_name is different.

-------------------------------------------------------------

The error I got when student is logged in is:
>> LDAP bind failed as kohauser MA19126: LDAP error #49: LDAP_INVALID_CREDENTIALS
>> The wrong password was supplied or the SASL credentials could not be processed
Comment 1 David Cook 2023-01-18 03:34:08 UTC
Changing the importance of this one from "critical" to "enhancement", as it would only affect some systems, and it seems like it is a request to enhance existing functionality.