If ldap enabled fallback to internal in C4::Auth::checkpw is dependent on the return value from checkpw_ldap In C4::Auth_with_ldap the situation seems to be: IF auth_by_bind IF anonymous_bind look up principalname ELSE construct via config Now we have principal name Attempt to bind IF fail IF anonymous_bind return -1 NO FALLBACK ELSE return 0 FALLBACK ELSE Lookup user with bind account If user not found, return 0 FALLBACK If user found and pwd not match return -1 NO FALLBACK The difference I see is: When doing bind by auth without anonymous bind we fallback on existing ldapuser with no matching password When using bind user we do not fallback on existing ldapuser with no matching password In one case you can login with either LDAP or Koha password In other you can only use LDAP password Maybe this is expected, but it seems odd.
Bumping severity here, this broke our ldap config after upgrade to 17.05, will try to provide patch next week
Is this related to bug 18880?
(In reply to Jonathan Druart from comment #2) > Is this related to bug 18880? I commented on wrong bug, meant for 18947
(In reply to Jonathan Druart from comment #2) > Is this related to bug 18880? And no, I think this exists separate from the work there - the decision is whether we should fallback if the user exists in ldap but password is wrong ( I think we should)