Summary: | ILS-DI AuthenticatePatron broken when LDAP enabled and auth falls back to internal connection | ||
---|---|---|---|
Product: | Koha | Reporter: | Nick Clemens (kidclamp) <nick> |
Component: | Authentication | Assignee: | Kyle M Hall (khall) <kyle> |
Status: | RESOLVED FIXED | QA Contact: | Martin Renvoize (ashimema) <martin.renvoize> |
Severity: | critical | ||
Priority: | P5 - low | CC: | dcook, dpavlin, kyle, magnus |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: |
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36575 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36928 |
||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 34893, 36575 | ||
Bug Blocks: | |||
Attachments: |
Bug 36161: Fix ISLDI AuthenticatePatron when LDAP enabled
Bug 36161: Fix ISLDI AuthenticatePatron when LDAP enabled |
Description
Nick Clemens (kidclamp)
2024-02-23 19:54:55 UTC
To recreate: 1 - Enable ILSDI: http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=web_services#web_services_ILS-DI 2 - Enable ldap (not for real) by adding/editing to koha-conf: <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id="ldapserver"> <hostname>ldaps://nha.dog</hostname> <base>belong.to.us</base> <mapping> <userid is="SAMAccountname"></userid> </mapping> </ldapserver> 3 - Try to authenticate a patron (generate your correct credentials: http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=edna&password=acosta 4 - Can't call method "update_lastseen" on an undefined value at /kohadevbox/koha/C4/ILSDI/Services.pm line 400 Created attachment 162458 [details] [review] Bug 36161: Fix ISLDI AuthenticatePatron when LDAP enabled Test Plan: 1) Enable ILSDI: http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=web_services#web_services_ILS-DI 2) Enable ldap (not for real) by adding/editing to koha-conf: <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id="ldapserver"> <hostname>ldaps://nha.dog</hostname> <base>belong.to.us</base> <mapping> <userid is="SAMAccountname"></userid> </mapping> </ldapserver> 3) Try to authenticate a patron (generate your correct credentials: http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=edna&password=acosta 4) Can't call method "update_lastseen" on an undefined value at /kohadevbox/koha/C4/ILSDI/Services.pm line 400 5) Apply this patch 6) Restart all the things! 7) Repeat step 3 8) No errors! 9) Set to a valid ldap server 10) Verify LDAP authentication still functions as usual Created attachment 162460 [details] [review] Bug 36161: Fix ISLDI AuthenticatePatron when LDAP enabled Test Plan: 1) Enable ILSDI: http://localhost:8081/cgi-bin/koha/admin/preferences.pl?tab=web_services#web_services_ILS-DI 2) Enable ldap (not for real) by adding/editing to koha-conf: <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id="ldapserver"> <hostname>ldaps://nha.dog</hostname> <base>belong.to.us</base> <mapping> <userid is="SAMAccountname"></userid> </mapping> </ldapserver> 3) Try to authenticate a patron (generate your correct credentials: http://localhost:8080/cgi-bin/koha/ilsdi.pl?service=AuthenticatePatron&username=edna&password=acosta 4) Can't call method "update_lastseen" on an undefined value at /kohadevbox/koha/C4/ILSDI/Services.pm line 400 5) Apply this patch 6) Restart all the things! 7) Repeat step 3 8) No errors! 9) Set to a valid ldap server 10) Verify LDAP authentication still functions as usual I'm afraid t/db_dependent/Auth.t is failing with this patch... could you check it out? Currently the checkpw_internal gets patron by userid and check the password if a patron is found, then it gets patron by cardnumber and checks password. This patch reduces that to a single check, get patron by either field, then check password - it's going to muddy the case where a username/cardnumber is shared bug 14323 aims to disallow, but I think we need to reconcile this one and 36575 - can you compare them Kyle? We believe bug 36575 may take care of this. Let's revisit it after that's been pushed. Little prompt to ask if this is still valid or can perhaps now be closed instead? (In reply to Martin Renvoize from comment #7) > Little prompt to ask if this is still valid or can perhaps now be closed > instead? ILS-DI is completely broken right now I believe (CSRF related), so not sure if this can be tested. (In reply to Katrin Fischer from comment #8) > (In reply to Martin Renvoize from comment #7) > > Little prompt to ask if this is still valid or can perhaps now be closed > > instead? > > ILS-DI is completely broken right now I believe (CSRF related), so not sure > if this can be tested. We think bug 36575 has resolved this issue! We can always reopen if we find that is not the case. |