[Bug 5094] New: auth_by_bind authentication can fail even if given a correct password and userid
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Summary: auth_by_bind authentication can fail even if given a correct password and userid Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: minor Priority: P5 Component: Authentication AssignedTo: gmcharlt@gmail.com ReportedBy: JeremyC@uta.edu QAContact: koha-bugs@lists.koha-community.org CC: dpavlin@rot13.org Estimated Hours: 0.0 When using <replicate>0</replicate> <!-- add new users from LDAP to Koha database --> <update>0</update> <!-- update existing users in Koha database -> <auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding instead of password comparison, e.g., to use Active Directory --> Auth_with_ldap attempts to lookup the userid in the LDAP directory to fill $userldapentry despite it being unneeded in this case. The information retrieved will be thrown away, thus there is no need to retrieve it. This can cause authentication to fail overall even if the initial bind with the user's credentials succeeded. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 --- Comment #1 from Jeremy Crabtree <JeremyC@uta.edu> --- Created attachment 2474 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=2474 Proposed fix for this bug This is a proposed fix for this bug. It skips the creation of $userldapentry if neither updating nor replicating are enabled. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Joe Atzberger <ohiocore@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ohiocore@gmail.com --- Comment #2 from Joe Atzberger <ohiocore@gmail.com> 2011-06-14 15:14:47 UTC --- Confirm bug from d114ebe80adc7b2c34d08d94c17d302b3ddda4be. search_method must NOT be called if bind has already occurred, because it will bind again and with different credentials depending on config (likely anonymously). This is important for auth_by_bind for obvious reasons, mainly that Active Directory doesn't allow you to view the same record anonymously that you would get when bound as the user. Even if it were successful (which it isn't), binding twice is logically incorrect and bad for performance. The amount of complexity in the LDAP code is seriously regrettable. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Joe Atzberger <ohiocore@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent Status|NEW |ASSIGNED --- Comment #3 from Joe Atzberger <ohiocore@gmail.com> 2011-06-15 22:51:53 UTC --- Tested OK with auth_by_bind, no replicate, no update, no static bind user/pass. Patch sent to the list. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Joe Atzberger <ohiocore@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|unspecified |master Patch Status|--- |Signed Off Severity|minor |major --- Comment #4 from Joe Atzberger <ohiocore@gmail.com> 2011-06-15 23:22:02 UTC --- Adding patch status. Increasing importance. This is actually a blocker for LDAP to Active Directory w/ a given config. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz Patch Status|Signed Off |Patch Pushed --- Comment #5 from Chris Cormack <chris@bigballofwax.co.nz> 2011-06-17 03:09:58 UTC --- Pushed to master, welcome to the Koha committer family Jeremy Dobrica, can you please run your tests against master. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #6 from Dobrica Pavlinusic <dpavlin@rot13.org> 2011-07-14 15:55:44 UTC --- Testeda against current master, it works fine, thanks. I would remove comment line with FIXME dpavlin from it, since it is unneeded left-over :-) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Melia Meggs <melia@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED CC| |melia@bywatersolutions.com Resolution|FIXED | --- Comment #7 from Melia Meggs <melia@bywatersolutions.com> 2011-09-21 18:11:07 UTC --- Reopening in hopes that we can get update/replicate to work. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Rex Wallen Tan <wallen_tan@southville.edu.ph> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wallen_tan@southville.edu.p | |h --- Comment #8 from Rex Wallen Tan <wallen_tan@southville.edu.ph> 2011-10-27 08:17:22 UTC --- Proposing Bug 7099 with a fix It deals with the Update/Replicate problem in ActiveDirectory (made a separate bug since its not related to the title) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 --- Comment #9 from Dobrica Pavlinusic <dpavlin@rot13.org> 2011-10-27 20:07:12 UTC --- *** Bug 7099 has been marked as a duplicate of this bug. *** -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #10 from Dobrica Pavlinusic <dpavlin@rot13.org> 2011-10-27 20:07:52 UTC --- (In reply to comment #7)
Reopening in hopes that we can get update/replicate to work.
-- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5094 --- Comment #11 from Dobrica Pavlinusic <dpavlin@rot13.org> 2011-10-27 20:08:25 UTC --- Current master at http://git.koha-community.org includes this fix. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org