Bug 7099 - ActiveDirectory authentication thru LDAP doesn't work when principal_name is used with update or replicate
Summary: ActiveDirectory authentication thru LDAP doesn't work when principal_name is ...
Status: CLOSED DUPLICATE of bug 5094
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low blocker (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-10-27 07:37 UTC by Rex Wallen Tan
Modified: 2019-06-27 09:24 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Rex Wallen Tan 2011-10-27 07:37:51 UTC
Using Koha 4.02, Ubuntu 10.10
Intel(R) Xeon(R) CPU E5620 @ 2.40GHz, 1 cores (VMware)
Apache version 2.2.16


When authenticating to ActiveDirectory with an account that does not yet exist on Koha - there is an error returned.

However when the account is already created - authentication works properly

Error:

Can't call method "exists" on an undefined value at /usr/share/koha/lib/C4/Auth_with_ldap.pm line 168, <DATA> line 522.


koha-conf.xml


  <useldapserver>1</useldapserver>
  <!-- LDAP SERVER (optional) -->
  <ldapserver id="ldapserver">
    <hostname>sisc-blank.sville.edu.ph</hostname>
    <base>-BLANK-</base>
    <user>-BLANK-</user>             <!-- DN, if not anonymous -->
    <pass>-BLANK-</pass>          <!-- password, if not anonymous -->
    <replicate>1</replicate>       <!-- add new users from LDAP to Koha database -->
    <update>1</update>             <!-- update existing users in Koha database -->
    <auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding instead of
                                        password comparison, e.g., to use Active Directory -->
    <principal_name>%s@sville.edu.ph</principal_name>
                                   <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid -->
    <mapping>                  <!-- match koha SQL field names to your LDAP record field names -->
      <firstname    is="givenname"      ></firstname>
      <surname      is="sn"             ></surname>
      <address      is="postaladdress"  ></address>
      <city         is="l"              >Las Pinas</city>
      <zipcode      is="postalcode"     ></zipcode>
      <branchcode   is="branch"         >SISC-01</branchcode>
      <userid       is="sAMAccountName"            ></userid>
      <password     is="userpassword"   ></password>
      <email        is="mail"           ></email>
      <categorycode is="employeetype"   >PT</categorycode>
      <phone        is="telephonenumber"></phone>
    </mapping>
</ldapserver>
Comment 1 Rex Wallen Tan 2011-10-27 07:39:45 UTC
Cause:

$userldapentry remains unset when authenticating by bind

	if ( $ldap->{auth_by_bind} ) {
        my $principal_name = $ldap->{principal_name};
        if ($principal_name and $principal_name =~ /\%/) {
            $principal_name = sprintf($principal_name,$userid);
        } else {
            $principal_name = $userid;
        }
		my $res = $db->bind( $principal_name, password => $password );
        if ( $res->code ) {
            $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);
            return 0;
        }
}

this is called in sub ldap_entry_2_hash ($$) and will cause the code to fail.
Comment 2 Rex Wallen Tan 2011-10-27 07:40:12 UTC
Proposed solution:

--- Auth_with_ldap.pm.old       2011-10-27 15:30:52.808209008 +0800
+++ Auth_with_ldap.pm   2011-10-27 15:23:00.788208927 +0800
@@ -55,7 +55,7 @@
 my $base      = $ldap->{base}          or die ldapserver_error('base');
 $ldapname     = $ldap->{user}          ;
 $ldappassword = $ldap->{pass}          ;
-our %mapping  = %{$ldap->{mapping}} || (); #   or die ldapserver_error('mapping');
+our %mapping  = %{$ldap->{mapping}}; # or die ldapserver_error('mapping');
 my @mapkeys = keys %mapping;
 $debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys (  total  ): ", join ' ', @mapkeys, "\n";
 @mapkeys = grep {defined $mapping{$_}->{is}} @mapkeys;
@@ -119,6 +119,10 @@
             $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res);
             return 0;
         }
+
+               #Create an entry for userldapentry even during principal name auth
+               my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
+        $userldapentry = $search->shift_entry;
        } else {
         my $search = search_method($db, $userid) or return 0;   # warnings are in the sub
         $userldapentry = $search->shift_entry;
Comment 3 Dobrica Pavlinusic 2011-10-27 20:07:12 UTC
current master includes fix from bug 5094.

From your Koha version (4.02), I assume that you are not using koha from http://git.koha-community.org ?

*** This bug has been marked as a duplicate of bug 5094 ***