Bug 18992 - LDAP fallback behaviour not consistent
Summary: LDAP fallback behaviour not consistent
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal
Assignee: Nick Clemens (kidclamp)
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-27 15:52 UTC by Nick Clemens (kidclamp)
Modified: 2021-02-04 12:59 UTC (History)
5 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2017-07-27 15:52:38 UTC
If ldap enabled fallback to internal in C4::Auth::checkpw is dependent on the return value from checkpw_ldap

In C4::Auth_with_ldap the situation seems to be:

IF auth_by_bind
    IF anonymous_bind look up principalname
    ELSE construct via config
    Now we have principal name
    Attempt to bind
    IF fail
        IF anonymous_bind return -1 NO FALLBACK
        ELSE return 0 FALLBACK
ELSE
    Lookup user with bind account
    If user not found, return 0 FALLBACK
    If user found and pwd not match return -1 NO FALLBACK


The difference I see is:
When doing bind by auth without anonymous bind we fallback on existing ldapuser with no matching password
When using bind user we do not fallback on existing ldapuser with no matching password


In one case you can login with either LDAP or Koha password
In other you can only use LDAP password

Maybe this is expected, but it seems odd.
Comment 1 Nick Clemens (kidclamp) 2017-11-05 15:43:00 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2017-11-06 13:59:27 UTC
Is this related to bug 18880?
Comment 3 Nick Clemens (kidclamp) 2017-11-06 14:32:59 UTC
(In reply to Jonathan Druart from comment #2)
> Is this related to bug 18880?

I commented on wrong bug, meant for 18947
Comment 4 Nick Clemens (kidclamp) 2017-11-06 14:40:21 UTC
(In reply to Jonathan Druart from comment #2)
> Is this related to bug 18880?

And no, I think this exists separate from the work there - the decision is whether we should fallback if the user exists in ldap but password is wrong (  I think we should)