Bug 28780 - Auth_with_ldap only searches tree with anon_bind
Summary: Auth_with_ldap only searches tree with anon_bind
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: 21.05
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-07-29 13:14 UTC by Jerry Marceau
Modified: 2021-07-29 13:14 UTC (History)
1 user (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Auth_with_ldap patch to add tree searching wtih service account (2.12 KB, patch)
2021-07-29 13:14 UTC, Jerry Marceau
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jerry Marceau 2021-07-29 13:14:38 UTC
Created attachment 123282 [details] [review]
Auth_with_ldap patch to add tree searching wtih service account

If auth_by_bind is set, anonymous_bind is not set, and a 'service' account is provided (<user> and <pass>), Auth_with_ldap.pm will not use the service account to search the tree and determine the principal name.  Instead it requires the principal name to be provided in the XML.  

This is a problem when users are in multiple OUs - there is no way to provide a principal name that works for everyone.  It is a relatively easy fix - just adding an elsif to check if a service account is provided, then search the tree with that.  

We have multiple OUs, so I've modified the code and I've provided a patch as a suggestion.  This may not be the ideal fix and it may cause unintended issues for users who aren't doing auth_by_bind.  Would love to see something like this incorporated into the koha code since I have to re-enable these each time we update.