Bug 10842 - Allow for new type of LDAP authentication - Further Enhancement
Summary: Allow for new type of LDAP authentication - Further Enhancement
Status: RESOLVED DUPLICATE of bug 10908
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Martin Renvoize (ashimema)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-08 11:47 UTC by Martin Renvoize (ashimema)
Modified: 2014-04-11 15:30 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Allow auth_by_bind with search by service account (1.64 KB, patch)
2013-09-08 11:52 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Renvoize (ashimema) 2013-09-08 11:47:12 UTC
This is related to Bug 7379 where Elliott Davis describes a new authentication method as follows:

For some ldap setups there is a different sequence for authentication that koha doesn't account for.  The steps are:

1) Bind with a service account
2) Search for user entered
3) Bind as user if found

The final patch that went in allowed for a method as follows:

1) Bind with an Anonymous user
2) Search for user entered
3) Bind as user if found.

This is close to what Elliott described but not exact.  My patch enclosed adds the original method into the accepted and pushed patch such that the initial bind can take place upon a specified service user OR and an anonymous user.
Comment 1 Martin Renvoize (ashimema) 2013-09-08 11:52:59 UTC
Created attachment 20879 [details] [review]
Allow auth_by_bind with search by service account
Comment 2 Katrin Fischer 2013-09-08 12:04:16 UTC
Thx Martin! :)
Comment 3 Martin Renvoize (ashimema) 2013-09-09 14:30:19 UTC
I Suppose I should probably put in a test plan, now I've got my head around it myself!

If you've found this bug, then most likely you've found that your LDAP Server requires the setup as explained in the first post, or your just grabbing at straws?

To enable this method you'll need to enable auth_by_bind and also include a user and password in your ldap configuration xml for koha as in the below example.

 <useldapserver>1</useldapserver>                                       <!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on -->
 <ldapserver id="ldapserver">                                           
    <hostname>ldap://yourldapserver.com:389</hostname>                  <!-- LDAP Server hostname -->
    <base>DC=yourldapserver,DC=com</base>                               <!-- LDAP Server Base     -->
    <user>CN=kohabindaccount</user>                                     <!-- DN, if not anonymous -->
    <pass>gobbledegoop</pass>                                           <!-- password, if not anonymous -->
    <replicate>0</replicate>                                            <!-- add new users from LDAP to Koha database -->
    <update>0</update>                                                  <!-- update existing users in Koha database -->
    <auth_by_bind>1</auth_by_bind>                                      <!-- set to 1 to authenticate by binding instead of password comparison, e.g., to use Active Directory -->
    <mapping>                                                           <!-- match koha SQL field names to your LDAP record field names -->
        <firstname is="givenName"> </firstname>
        <surname is="sn"> </surname> -->
        <address is=""> </address> -->
        <city is=""> </city> -->
        <userid is="samAccountName"></userid>
        <password is=""           ></password>
        <categorycode is=""   >TEMP</categorycode> -->
        <email is=""></email> -->
        <dateenrolled is="">2011-07-12</dateenrolled> -->
        <dateexpiry is="">2012-07-12</dateexpiry> -->
    </mapping>
 </ldapserver>

If it didn't authenticate before, but does now then the patch has fixed your issue ;)
Comment 4 I'm just a bot 2013-09-24 05:32:02 UTC
Patch applied cleanly, go forth and signoff
Comment 5 I'm just a bot 2013-10-24 19:30:52 UTC
Applying: Bug 10842: Fixed bug in Auth_with_ldap
Using index info to reconstruct a base tree...
M	C4/Auth_with_ldap.pm
Falling back to patching base and 3-way merge...
Auto-merging C4/Auth_with_ldap.pm
CONFLICT (content): Merge conflict in C4/Auth_with_ldap.pm
Patch failed at 0001 Bug 10842: Fixed bug in Auth_with_ldap
The copy of the patch that failed is found in:
   /home/christopher/git/koha/.git/rebase-apply/patch
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".
Comment 6 Martin Renvoize (ashimema) 2013-10-30 14:01:15 UTC
I'm not actually sure if this is required anymore?

If someone has a requirement for searching thier LDAP using a service account before doing a koha user bind, let me know and I'll rebase the patch.

But I have a feeling that this is now null and void as Robin re-implemented direct binding in bug 10908
Comment 7 Mark Tompsett 2014-04-11 15:30:18 UTC
(In reply to Martin Renvoize from comment #6)
> I have a feeling that this is now null and void as Robin re-implemented
> direct binding in bug 10908

Just from eyeballing the code, I think your feeling is correct. I'm going to mark this as a resolved duplicate.

*** This bug has been marked as a duplicate of bug 10908 ***