[Bug 7099] New: ActiveDirectory authentication thru LDAP doesn't work when principal_name is used with update or replicate
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7099 Bug #: 7099 Summary: ActiveDirectory authentication thru LDAP doesn't work when principal_name is used with update or replicate Classification: Unclassified Change sponsored?: --- Product: Koha Version: unspecified Platform: All OS/Version: All Status: NEW Severity: blocker Priority: P5 Component: Authentication AssignedTo: gmcharlt@gmail.com ReportedBy: wallen_tan@southville.edu.ph QAContact: koha-bugs@lists.koha-community.org CC: dpavlin@rot13.org Using Koha 4.02, Ubuntu 10.10 Intel(R) Xeon(R) CPU E5620 @ 2.40GHz, 1 cores (VMware) Apache version 2.2.16 When authenticating to ActiveDirectory with an account that does not yet exist on Koha - there is an error returned. However when the account is already created - authentication works properly Error: Can't call method "exists" on an undefined value at /usr/share/koha/lib/C4/Auth_with_ldap.pm line 168, <DATA> line 522. koha-conf.xml <useldapserver>1</useldapserver> <!-- LDAP SERVER (optional) --> <ldapserver id="ldapserver"> <hostname>sisc-blank.sville.edu.ph</hostname> <base>-BLANK-</base> <user>-BLANK-</user> <!-- DN, if not anonymous --> <pass>-BLANK-</pass> <!-- password, if not anonymous --> <replicate>1</replicate> <!-- add new users from LDAP to Koha database --> <update>1</update> <!-- update existing users in Koha database --> <auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding instead of password comparison, e.g., to use Active Directory --> <principal_name>%s@sville.edu.ph</principal_name> <!-- optional, for auth_by_bind: a printf format to make userPrincipalName from koha userid --> <mapping> <!-- match koha SQL field names to your LDAP record field names --> <firstname is="givenname" ></firstname> <surname is="sn" ></surname> <address is="postaladdress" ></address> <city is="l" >Las Pinas</city> <zipcode is="postalcode" ></zipcode> <branchcode is="branch" >SISC-01</branchcode> <userid is="sAMAccountName" ></userid> <password is="userpassword" ></password> <email is="mail" ></email> <categorycode is="employeetype" >PT</categorycode> <phone is="telephonenumber"></phone> </mapping> </ldapserver> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7099 --- Comment #1 from wallen_tan@southville.edu.ph 2011-10-27 07:39:45 UTC --- Cause: $userldapentry remains unset when authenticating by bind if ( $ldap->{auth_by_bind} ) { my $principal_name = $ldap->{principal_name}; if ($principal_name and $principal_name =~ /\%/) { $principal_name = sprintf($principal_name,$userid); } else { $principal_name = $userid; } my $res = $db->bind( $principal_name, password => $password ); if ( $res->code ) { $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res); return 0; } } this is called in sub ldap_entry_2_hash ($$) and will cause the code to fail. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7099 --- Comment #2 from wallen_tan@southville.edu.ph 2011-10-27 07:40:12 UTC --- Proposed solution: --- Auth_with_ldap.pm.old 2011-10-27 15:30:52.808209008 +0800 +++ Auth_with_ldap.pm 2011-10-27 15:23:00.788208927 +0800 @@ -55,7 +55,7 @@ my $base = $ldap->{base} or die ldapserver_error('base'); $ldapname = $ldap->{user} ; $ldappassword = $ldap->{pass} ; -our %mapping = %{$ldap->{mapping}} || (); # or die ldapserver_error('mapping'); +our %mapping = %{$ldap->{mapping}}; # or die ldapserver_error('mapping'); my @mapkeys = keys %mapping; $debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys ( total ): ", join ' ', @mapkeys, "\n"; @mapkeys = grep {defined $mapping{$_}->{is}} @mapkeys; @@ -119,6 +119,10 @@ $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res); return 0; } + + #Create an entry for userldapentry even during principal name auth + my $search = search_method($db, $userid) or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; } else { my $search = search_method($db, $userid) or return 0; # warnings are in the sub $userldapentry = $search->shift_entry; -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=7099 Dobrica Pavlinusic <dpavlin@rot13.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |DUPLICATE --- Comment #3 from Dobrica Pavlinusic <dpavlin@rot13.org> 2011-10-27 20:07:12 UTC --- current master includes fix from bug 5094.
From your Koha version (4.02), I assume that you are not using koha from http://git.koha-community.org ?
*** This bug has been marked as a duplicate of bug 5094 *** -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org