Bug 5094 - auth_by_bind authentication can fail even if given a correct password and userid
Summary: auth_by_bind authentication can fail even if given a correct password and userid
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: PATCH-Sent (DO NOT USE) major (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
: 7099 (view as bug list)
Depends on:
Reported: 2010-08-05 14:22 UTC by Jeremy Crabtree
Modified: 2012-10-25 23:10 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Text to go in the release notes:
Version(s) released in:

Proposed fix for this bug (816 bytes, patch)
2010-08-05 14:32 UTC, Jeremy Crabtree
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jeremy Crabtree 2010-08-05 14:22:14 UTC
When using

<replicate>0</replicate> <!-- add new users from LDAP to Koha database -->
<update>0</update> <!-- update existing users in Koha database ->
<auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding instead of password comparison, e.g., to use Active Directory -->

Auth_with_ldap attempts to lookup the userid in the LDAP directory to fill $userldapentry despite it being unneeded in this case.  The information retrieved will be thrown away, thus there is no need to retrieve it.  This can cause authentication to fail overall even if the initial bind with the user's credentials succeeded.
Comment 1 Jeremy Crabtree 2010-08-05 14:32:37 UTC
Created attachment 2474 [details] [review]
Proposed fix for this bug

This is a proposed fix for this bug.  It skips the creation of $userldapentry if neither updating nor replicating are enabled.
Comment 2 Joe Atzberger 2011-06-14 15:14:47 UTC
Confirm bug from d114ebe80adc7b2c34d08d94c17d302b3ddda4be.  search_method must NOT be called if bind has already occurred, because it will bind again and with different credentials depending on config (likely anonymously).  This is important for auth_by_bind for obvious reasons, mainly that Active Directory doesn't allow you to view the same record anonymously that you would get when bound as the user.  

Even if it were successful (which it isn't), binding twice is logically incorrect and bad for performance.

The amount of complexity in the LDAP code is seriously regrettable.
Comment 3 Joe Atzberger 2011-06-15 22:51:53 UTC
Tested OK with auth_by_bind, no replicate, no update, no static bind user/pass.  Patch sent to the list.
Comment 4 Joe Atzberger 2011-06-15 23:22:02 UTC
Adding patch status.  Increasing importance.  This is actually a blocker for LDAP to Active Directory w/ a given config.
Comment 5 Chris Cormack 2011-06-17 03:09:58 UTC
Pushed to master, welcome to the Koha committer family Jeremy

Dobrica, can you please run your tests against master.
Comment 6 Dobrica Pavlinusic 2011-07-14 15:55:44 UTC
Testeda against current master, it works fine, thanks.

I would remove comment line with FIXME dpavlin from it, since it is unneeded left-over :-)
Comment 7 Melia Meggs 2011-09-21 18:11:07 UTC
Reopening in hopes that we can get update/replicate to work.
Comment 8 Rex Wallen Tan 2011-10-27 08:17:22 UTC
Proposing Bug 7099 with a fix

It deals with the Update/Replicate problem in ActiveDirectory (made a separate bug since its not related to the title)
Comment 9 Dobrica Pavlinusic 2011-10-27 20:07:12 UTC
*** Bug 7099 has been marked as a duplicate of this bug. ***
Comment 10 Dobrica Pavlinusic 2011-10-27 20:07:52 UTC
(In reply to comment #7)
> Reopening in hopes that we can get update/replicate to work.
Comment 11 Dobrica Pavlinusic 2011-10-27 20:08:25 UTC
Current master at http://git.koha-community.org includes this fix.