[Bug 10908] New: Fix broken auth_by_bind LDAP mode
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Bug ID: 10908 Summary: Fix broken auth_by_bind LDAP mode Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: blocker Priority: P5 - low Component: Authentication Assignee: gmcharlt@gmail.com Reporter: robin@catalyst.net.nz QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org Bug 7973 breaks LDAP for many users, particularly those using active directory by removing the normal auth_by_bind behaviour and requiring that there is an anonymous user to search LDAP with. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Robin Sheat <robin@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P1 - high Assignee|gmcharlt@gmail.com |robin@catalyst.net.nz -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #1 from Robin Sheat <robin@catalyst.net.nz> --- These are the sort of errors you'll see in the logs: [Wed Sep 18 15:39:10 2013] opac-user.pl: LDAP Auth rejected : (cn=testuser) gets 0 hits [Wed Sep 18 15:39:10 2013] opac-user.pl: LDAP error #1: LDAP_OPERATIONS_ERROR [Wed Sep 18 15:39:10 2013] opac-user.pl: # Server encountered an internal error -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #2 from Robin Sheat <robin@catalyst.net.nz> --- Created attachment 21154 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=21154&action=edit Bug 10908 - fix broken LDAP Recent changes to LDAP broke auth_by_bind in many situations. This bug resets the behaviour to what it used to be, however also allows the new behaviour by adding the 'anonymous_bind' parameter to the LDAP config. Testing: 1) Find an LDAP configuration that was broken recently that uses auth_by_bind 2) Apply this patch 3) See if it works again. Additionally, testing the original path in the case of 'anonymous_bind' being set should probably be done too, but I have no idea about the LDAP server config for that. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Robin Sheat <robin@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #3 from Robin Sheat <robin@catalyst.net.nz> --- Created attachment 21155 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=21155&action=edit Bug 10908 - restore docs on principal_name -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #4 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- So, going back to the ldap methods described in bug 7973 and bug 10842, the new set of methods including your patch would be? Method 1: 1) Bind with a service account 2) Search for user entered 3) Bind as user if found Method 2: 1) Bind with an Anonymous user 2) Search for user entered 3) Bind as user if found. Method 3 (The original): 1) Bind directly to the user, no search takes place. Just trying to clarify for myself and others. Is that correct Robin? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #5 from Robin Sheat <robin@catalyst.net.nz> --- That's how I understand it, though method three actually does do a search in that it searches for itself in order to fetch the whole record from LDAP. However, in essence you're correct as far as I can tell. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz Bot Control|--- |Ignore this bug -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Bot Control|Ignore this bug |--- -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- When did the bot| |2013-09-24 last check this| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Derryn <derrynj@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |derrynj@gmail.com -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Robin Sheat <robin@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|master |3.12 -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ulrich.kleiber@bsz-bw.de --- Comment #6 from Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> --- Created attachment 21652 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=21652&action=edit Bug 10908 - fix broken LDAP tested with OpenLDAP in front of AD -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #7 from Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> --- Created attachment 21653 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=21653&action=edit Bug 10908 - restore docs on principal_name -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #21155|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #21154|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #8 from Robin Sheat <robin@catalyst.net.nz> --- Thanks Uli! :) -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de Version|3.12 |master -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #9 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- This is a blocker - as Uli from BSZ has signed off I shouldn't do QA and I honestly can't because I don't know how to set up a test environment for LDAP. Is there someone else who can on the QA team? -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 M. Tompsett <mtompset@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mtompset@hotmail.com --- Comment #10 from M. Tompsett <mtompset@hotmail.com> --- sudo apt-get install ldap-server Make sure to remember the password you use to set this up! Next, we'll figure out the connection string. sudo slapcat The second entries 'dn' line will be important in setting up LDAP authentication sudo apt-get install phpldapadmin Now you should be able to web browse to http.../phpldapadmin and actually log in with the information you got from slapcat. cn=admin;dc=<from slapcat> <password set while installing ldap-server> Congratulations, you have an LDAP server with just the admin user set up on your machine. Feel free to "sudo apt-get remove phpldapadmin". That was just to prove the set up was working. Then you'll need to tweak your koha-conf.xml hostname should be the nice name you'd use for the machine. base I matched to be "dc=<slapcat mess>" same with user. and of course principle_name. in the mapping section, the branchcode and patron code better be in your system already. <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id='ldapserver' listenref='ldapserver'> <hostname>demo.library.kohasystem.ca</hostname> <base>dc=nodomain</base> <user>CN=admin,OU=Special,OU=Accounts,DC=nodomain</user> <pass>ldap123</pass> <replicate>1</replicate> <update>1</update> <auth_by_bind>1</auth_by_bind> <principal_name>CN=%s,DC=nodomain</principal_name> <mapping> <firstname is='givenname'></firstname> <surname is='sn'> </surname> <address is='postaladdress'>3900 University Blvd</address> <city is='l'>Tyler, TX</city> <zipcode is='postalcode'>75799</zipcode> <branchcode is=''>MNL</branchcode> <userid is='cn'></userid> <password is=''></password> <cardnumber is='extensionattribute2'></cardnumber> <email is='userprincipalname'></email> <categorycode is=''>PT</categorycode> <phone is='telephonenumber'>903-566-7343</phone> <dateenrolled is=''>2011-03-27</dateenrolled> <dateexpiry is=''>2011-05-13</dateexpiry> </mapping> </ldapserver> Hope this helps, KF. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #11 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- Thx Mark. I am not sure when I have time for this - if anyone wants to have a go on this I would appreciate it. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #12 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 22119 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22119&action=edit [PASSED-QA] Bug 10908 - fix broken LDAP Recent changes to LDAP broke auth_by_bind in many situations. This bug resets the behaviour to what it used to be, however also allows the new behaviour by adding the 'anonymous_bind' parameter to the LDAP config. Testing: 1) Find an LDAP configuration that was broken recently that uses auth_by_bind 2) Apply this patch 3) See if it works again. Additionally, testing the original path in the case of 'anonymous_bind' being set should probably be done too, but I have no idea about the LDAP server config for that. Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #21652|1 |0 is patch| | Attachment #21652|0 |1 is obsolete| | CC| |brendan@bywatersolutions.co | |m -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #21653|0 |1 is obsolete| | --- Comment #13 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 22121 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22121&action=edit [PASSED-QA] Bug 10908 - restore docs on principal_name Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #21652|0 |1 is patch| | Attachment #21652|1 |0 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #22119|1 |0 is patch| | Attachment #22119|0 |1 is obsolete| | -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Brendan Gallagher <brendan@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #21652|0 |1 is obsolete| | Attachment #22121|0 |1 is obsolete| | --- Comment #14 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 22137 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22137&action=edit [PASSED-QA] Bug 10908 - fix broken LDAP Recent changes to LDAP broke auth_by_bind in many situations. This bug resets the behaviour to what it used to be, however also allows the new behaviour by adding the 'anonymous_bind' parameter to the LDAP config. Testing: 1) Find an LDAP configuration that was broken recently that uses auth_by_bind 2) Apply this patch 3) See if it works again. Additionally, testing the original path in the case of 'anonymous_bind' being set should probably be done too, but I have no idea about the LDAP server config for that. Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #15 from Brendan Gallagher <brendan@bywatersolutions.com> --- Created attachment 22138 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=22138&action=edit [PASSED-QA] Bug 10908 - restore docs on principal_name Signed-off-by: Ulrich Kleiber <ulrich.kleiber@bsz-bw.de> Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Galen Charlton <gmcharlt@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master CC| |gmcharlt@gmail.com --- Comment #16 from Galen Charlton <gmcharlt@gmail.com> --- Pushed to master. Thanks, Robin! -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- --- Comment #17 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I see that we use those patches locally on 3.12.7 and wonder why I marked it resolved fixed. Resetting to pushed to stable to get it checked for backporting. -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master -- You are receiving this mail because: You are watching all bug changes.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10908 --- Comment #18 from M. Tompsett <mtompset@hotmail.com> --- *** Bug 10842 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org