Hi guys .. am running koha 3.16 (using debian 7 packages) however I am unable to get ldap authentication working I have setup the ldap paremeters in /etc/koha/site/opac/koha-conf.xml <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id="ldapserver" listenref="ldapserver"> <hostname>localhost</hostname> <base>ou=People,dc=example,dc=edu,dc=ng</base> <replicate>0</replicate> <update>1</update> <auth_by_bind>1</auth_by_bind> <mapping> <userid is="uid"></userid> <firstname is="givenname"></firstname> <surname is="sn"></surname> <email is="mail"></email> <phone is="telephoneNumber"></phone> <password is="userPassword"></password> </mapping> </ldapserver> however when I do a perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt I get this error perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
Greetings,
however when I do a: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=edu,dc=ng</base>
You need to modify this line according to your LDAP configuration. GPML, Mark Tompsett _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Which is weird. That is the right base dn for users.. same DN works with dspace on same ldap server and authentication works on that smoothly. Is there a way I can see logs on how koha tries to bind with ldap? i.e the entries it sends to bind with the ldap server.. maybe that might be a good start. On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
One thing which is not quite clear from the documentations am reading is where the location for the /koha-conf.xml file should be.. most docs say it should be in /etc/koha .. however when I checked my debian koha install the file is located at /etc/koha/sites/library/ (which is where I inputted the ldap configurations) I am suppose to create a file at /etc/koha/koha-conf.xml ? could this be the problem? I have tripped checked ldap dn config and other parameters I can not see where the problem is. same parameter works with dspace without issues :( On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Is you're ldap server allowing anonymous bind and search? You don't have a <user> or <pass> in the <ldapserver> config, so Koha will try to do an anonymous bind and search to find the user by their uid. I expect you're ldap server isn't allowing anonymous bind and search, since I would never allow that on my server if I didn't have to. Do you provide something like a rootdn and password to dspace for it to work? On Thu, Feb 19, 2015 at 8:08 AM, Bobby <bigbrovar2@gmail.com> wrote:
One thing which is not quite clear from the documentations am reading is where the location for the /koha-conf.xml file should be.. most docs say it should be in /etc/koha .. however when I checked my debian koha install the file is located at /etc/koha/sites/library/ (which is where I inputted the ldap configurations)
I am suppose to create a file at /etc/koha/koha-conf.xml ? could this be the problem?
I have tripped checked ldap dn config and other parameters I can not see where the problem is. same parameter works with dspace without issues :(
On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a:
perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
I have tried but admin user bind and anonymous user bind.. non seem to work. .. now with admin user bind here is the error I get LDAP Auth rejected : invalid password for user 'foo'. LDAP error #5: LDAP_COMPARE_FALSE # This code is returned when a compare request completes and the attribute value given is not in the entry specified Use of uninitialized value in concatenation (.) or string at /usr/share/koha/lib/C4/Auth.pm line 409, <DATA> line 595. Use of uninitialized value in string eq at /usr/share/koha/lib/C4/Auth.pm line 409, <DATA> line 595. Use of uninitialized value $ENV{"SERVER_PORT"} in concatenation (.) or string at /usr/share/koha/lib/C4/Auth.pm line 409, <DATA> line 595. <useldapserver>1</useldapserver><!-- see C4::Auth_with_ldap for extra configs you must add if you want to turn this on --> <ldapserver id="ldapserver" listenref="ldapserver"> <hostname>127.0.0.1</hostname> <base>ou=People,dc=example,dc=edu,dc=ng</base> <user>cn=admin,dc=example,dc=edu,dc=ng</user> <pass>pass</pass> <replicate>0</replicate> <update>1</update> <auth_by_bind>0</auth_by_bind> <mapping> <userid is="uid"></userid> <firstname is="givenname"></firstname> <surname is="sn"></surname> <email is="mail"></email> <phone is="telephoneNumber"></phone> <password is="userPassword"></password> </mapping> </ldapserver> On 19/02/2015 18:29, Michael Hafen wrote:
Is you're ldap server allowing anonymous bind and search? You don't have a <user> or <pass> in the <ldapserver> config, so Koha will try to do an anonymous bind and search to find the user by their uid. I expect you're ldap server isn't allowing anonymous bind and search, since I would never allow that on my server if I didn't have to. Do you provide something like a rootdn and password to dspace for it to work?
On Thu, Feb 19, 2015 at 8:08 AM, Bobby <bigbrovar2@gmail.com <mailto:bigbrovar2@gmail.com>> wrote:
One thing which is not quite clear from the documentations am reading is where the location for the /koha-conf.xml file should be.. most docs say it should be in /etc/koha .. however when I checked my debian koha install the file is located at /etc/koha/sites/library/ (which is where I inputted the ldap configurations)
I am suppose to create a file at /etc/koha/koha-conf.xml ? could this be the problem?
I have tripped checked ldap dn config and other parameters I can not see where the problem is. same parameter works with dspace without issues :(
On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
What ldap server are you using? We have always authenticated using auth_by_bind and never by comparing a password. Both in our openldap days, and now in our samba4 AD days. In fact... I'd be surprised if many people actually use the 'compare password' way. Perhaps you could try that? MJ On 02/19/2015 06:29 PM, Michael Hafen wrote:
Is you're ldap server allowing anonymous bind and search? You don't have a <user> or <pass> in the <ldapserver> config, so Koha will try to do an anonymous bind and search to find the user by their uid. I expect you're ldap server isn't allowing anonymous bind and search, since I would never allow that on my server if I didn't have to. Do you provide something like a rootdn and password to dspace for it to work?
On Thu, Feb 19, 2015 at 8:08 AM, Bobby <bigbrovar2@gmail.com <mailto:bigbrovar2@gmail.com>> wrote:
One thing which is not quite clear from the documentations am reading is where the location for the /koha-conf.xml file should be.. most docs say it should be in /etc/koha .. however when I checked my debian koha install the file is located at /etc/koha/sites/library/ (which is where I inputted the ldap configurations)
I am suppose to create a file at /etc/koha/koha-conf.xml ? could this be the problem?
I have tripped checked ldap dn config and other parameters I can not see where the problem is. same parameter works with dspace without issues :(
On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=__edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _________________________________________________ Koha-devel mailing list Koha-devel@lists.koha-__community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.__org/cgi-bin/mailman/listinfo/__koha-devel <http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel> website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.__org/ <http://bugs.koha-community.org/>
_________________________________________________ Koha-devel mailing list Koha-devel@lists.koha-__community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.__org/cgi-bin/mailman/listinfo/__koha-devel <http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel> website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.__org/ <http://bugs.koha-community.org/>
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
-- Mourik Jan C. Heupink
Thanks MJ, I have tried both auth by bind and by comparing password.. non of them work. Interestingly the older ldap 3.8 works and authenticate against the same ldap using the same ldap configuration as 3.16 and works without problem.. am starting to think this might have been a bug which affects the version of ldap am running because nothing else makes sense On 19/02/2015 21:40, mourik jan heupink - merit wrote:
What ldap server are you using? We have always authenticated using auth_by_bind and never by comparing a password. Both in our openldap days, and now in our samba4 AD days.
In fact... I'd be surprised if many people actually use the 'compare password' way.
Perhaps you could try that?
MJ
On 02/19/2015 06:29 PM, Michael Hafen wrote:
Is you're ldap server allowing anonymous bind and search? You don't have a <user> or <pass> in the <ldapserver> config, so Koha will try to do an anonymous bind and search to find the user by their uid. I expect you're ldap server isn't allowing anonymous bind and search, since I would never allow that on my server if I didn't have to. Do you provide something like a rootdn and password to dspace for it to work?
On Thu, Feb 19, 2015 at 8:08 AM, Bobby <bigbrovar2@gmail.com <mailto:bigbrovar2@gmail.com>> wrote:
One thing which is not quite clear from the documentations am reading is where the location for the /koha-conf.xml file should be.. most docs say it should be in /etc/koha .. however when I checked my debian koha install the file is located at /etc/koha/sites/library/ (which is where I inputted the ldap configurations)
I am suppose to create a file at /etc/koha/koha-conf.xml ? could this be the problem?
I have tripped checked ldap dn config and other parameters I can not see where the problem is. same parameter works with dspace without issues :(
On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=__edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _________________________________________________ Koha-devel mailing list Koha-devel@lists.koha-__community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.__org/cgi-bin/mailman/listinfo/__koha-devel <http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel> website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.__org/ <http://bugs.koha-community.org/>
_________________________________________________ Koha-devel mailing list Koha-devel@lists.koha-__community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.__org/cgi-bin/mailman/listinfo/__koha-devel <http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel> website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.__org/ <http://bugs.koha-community.org/>
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Turns out I was missing this in my koha ldap configuration <principal_name>uid=%s,ou=users,dc=xx,dc=yy</principal_name> Ldap authentication now works On 19/02/2015 21:40, mourik jan heupink - merit wrote:
What ldap server are you using? We have always authenticated using auth_by_bind and never by comparing a password. Both in our openldap days, and now in our samba4 AD days.
In fact... I'd be surprised if many people actually use the 'compare password' way.
Perhaps you could try that?
MJ
On 02/19/2015 06:29 PM, Michael Hafen wrote:
Is you're ldap server allowing anonymous bind and search? You don't have a <user> or <pass> in the <ldapserver> config, so Koha will try to do an anonymous bind and search to find the user by their uid. I expect you're ldap server isn't allowing anonymous bind and search, since I would never allow that on my server if I didn't have to. Do you provide something like a rootdn and password to dspace for it to work?
On Thu, Feb 19, 2015 at 8:08 AM, Bobby <bigbrovar2@gmail.com <mailto:bigbrovar2@gmail.com>> wrote:
One thing which is not quite clear from the documentations am reading is where the location for the /koha-conf.xml file should be.. most docs say it should be in /etc/koha .. however when I checked my debian koha install the file is located at /etc/koha/sites/library/ (which is where I inputted the ldap configurations)
I am suppose to create a file at /etc/koha/koha-conf.xml ? could this be the problem?
I have tripped checked ldap dn config and other parameters I can not see where the problem is. same parameter works with dspace without issues :(
On 19/02/2015 14:41, Mark Tompsett wrote:
Greetings,
however when I do a: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt I get this error: perl opac-user.pl <http://opac-user.pl> userid=foo password=passwd > /tmp/junk.txt LDAP bind failed as kohauser foo: LDAP error #34: LDAP_INVALID_DN_SYNTAX # The request contained an invalid DN
<base>ou=People,dc=example,dc=__edu,dc=ng</base>
You need to modify this line according to your LDAP configuration.
GPML, Mark Tompsett _________________________________________________ Koha-devel mailing list Koha-devel@lists.koha-__community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.__org/cgi-bin/mailman/listinfo/__koha-devel <http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel> website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.__org/ <http://bugs.koha-community.org/>
_________________________________________________ Koha-devel mailing list Koha-devel@lists.koha-__community.org <mailto:Koha-devel@lists.koha-community.org> http://lists.koha-community.__org/cgi-bin/mailman/listinfo/__koha-devel <http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel> website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.__org/ <http://bugs.koha-community.org/>
_______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
participants (4)
-
Bobby -
Mark Tompsett -
Michael Hafen -
mourik jan heupink - merit