This is related to Bug 7379 where Elliott Davis describes a new authentication method as follows: For some ldap setups there is a different sequence for authentication that koha doesn't account for. The steps are: 1) Bind with a service account 2) Search for user entered 3) Bind as user if found The final patch that went in allowed for a method as follows: 1) Bind with an Anonymous user 2) Search for user entered 3) Bind as user if found. This is close to what Elliott described but not exact. My patch enclosed adds the original method into the accepted and pushed patch such that the initial bind can take place upon a specified service user OR and an anonymous user.
Created attachment 20879 [details] [review] Allow auth_by_bind with search by service account
Thx Martin! :)
I Suppose I should probably put in a test plan, now I've got my head around it myself! If you've found this bug, then most likely you've found that your LDAP Server requires the setup as explained in the first post, or your just grabbing at straws? To enable this method you'll need to enable auth_by_bind and also include a user and password in your ldap configuration xml for koha as in the below example. <useldapserver>1</useldapserver> <!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id="ldapserver"> <hostname>ldap://yourldapserver.com:389</hostname> <!-- LDAP Server hostname --> <base>DC=yourldapserver,DC=com</base> <!-- LDAP Server Base --> <user>CN=kohabindaccount</user> <!-- DN, if not anonymous --> <pass>gobbledegoop</pass> <!-- password, if not anonymous --> <replicate>0</replicate> <!-- add new users from LDAP to Koha database --> <update>0</update> <!-- update existing users in Koha database --> <auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding instead of password comparison, e.g., to use Active Directory --> <mapping> <!-- match koha SQL field names to your LDAP record field names --> <firstname is="givenName"> </firstname> <surname is="sn"> </surname> --> <address is=""> </address> --> <city is=""> </city> --> <userid is="samAccountName"></userid> <password is="" ></password> <categorycode is="" >TEMP</categorycode> --> <email is=""></email> --> <dateenrolled is="">2011-07-12</dateenrolled> --> <dateexpiry is="">2012-07-12</dateexpiry> --> </mapping> </ldapserver> If it didn't authenticate before, but does now then the patch has fixed your issue ;)
Patch applied cleanly, go forth and signoff
Applying: Bug 10842: Fixed bug in Auth_with_ldap Using index info to reconstruct a base tree... M C4/Auth_with_ldap.pm Falling back to patching base and 3-way merge... Auto-merging C4/Auth_with_ldap.pm CONFLICT (content): Merge conflict in C4/Auth_with_ldap.pm Patch failed at 0001 Bug 10842: Fixed bug in Auth_with_ldap The copy of the patch that failed is found in: /home/christopher/git/koha/.git/rebase-apply/patch When you have resolved this problem, run "git am --continue". If you prefer to skip this patch, run "git am --skip" instead. To restore the original branch and stop patching, run "git am --abort".
I'm not actually sure if this is required anymore? If someone has a requirement for searching thier LDAP using a service account before doing a koha user bind, let me know and I'll rebase the patch. But I have a feeling that this is now null and void as Robin re-implemented direct binding in bug 10908
(In reply to Martin Renvoize from comment #6) > I have a feeling that this is now null and void as Robin re-implemented > direct binding in bug 10908 Just from eyeballing the code, I think your feeling is correct. I'm going to mark this as a resolved duplicate. *** This bug has been marked as a duplicate of bug 10908 ***