[Koha] LDAP authentication

mourik jan c heupink heupink at intech.unu.edu
Fri Dec 16 01:01:27 NZDT 2005


Hi all,

I DO see the problem now...

Cheered too early...

Mourik Jan

mourik jan heupink wrote:
> Dear Kent and list,
>
> I'm not sure if this last mail was only meant to go to me 
> personally... (as you say: Can ANYONE shed some light on this)
>
> Anyway, I have tried your code, and it works beautyfully.
>
> Could you indicate the required steps to generate the errors you talk 
> about? (I've clicked my way through various menu's, and no errors so 
> far..)
>
> Kind regards,
> Mourik Jan
>
> KL Nasveschuk wrote:
>> This works but fixed one problem and created another problem. Modifying
>> "Auth.pm" for LDAP has caused some of the scripts fail with the error:
>>
>> [Wed Dec 14 14:37:45 2005] [error] [client 172.16.56.200] Can't use
>> string ("0")  as a HASH ref while "strict refs" in use
>> at /usr/local/koha/intranet/modules/C4 /Auth.pm line 143., referer:
>> http://172.16.60.186:8000/cgi-bin/koha/opac-main.pl
>>
>> So if I go to opac-main.pl and comment out "use strict;" the script
>> runs.
>>
>> Can anyone shed some light on this? I've been up and down Auth.pm and I
>> think I only changed what was between ##LOCAL /LOCAL## to get LDAP to
>> work.
>>
>>
>>
>> Kent N
>>
>> On Wed, 2005-12-14 at 19:54 +0100, mourik jan c heupink wrote:
>>  
>>> I will try it tomorrow, and give feedback to the list.
>>>
>>> This solution looks better to me, because also as far I understand 
>>> things, the old solution will not work when your slapd.conf contains:
>>>
>>> access to attrs=userPassword,sambaLMPassword,sambaNTPassword
>>>       by self write
>>>       by anonymous auth
>>>       by * none
>>> access to *
>>>       by * read
>>>
>>> Anyway, kind regards!
>>>
>>> Mourik Jan
>>>
>>>  KL Nasveschuk wrote:
>>>    
>>>> Hi,
>>>>
>>>> I believe I have a solution that will make this work. An anonymous 
>>>> bind
>>>> to LDAP requires us to compare passwords by retrieving the password 
>>>> then
>>>> comparing to what the user has supplied. If passwords stored in 
>>>> LDAP are
>>>> hashed using different mechanisms, the burden of determining what
>>>> mechanism is used is on the the Koha application. I changed the 
>>>> code in
>>>> Auth.pm a little so that bind() uses the persons DN and password. The
>>>> burden of what password hash is used is on LDAP and not Koha.
>>>>
>>>> Between local in Auth.pm 
>>>>     ##################################################
>>>>     ### LOCAL
>>>>     ### Change the code below to match your own LDAP server.
>>>>     ##################################################
>>>>     # LDAP connexion parameters
>>>>
>>>>     # LDAP server
>>>>     my $ldapserver = '172.16.0.24';
>>>>
>>>>     # Base DN for users
>>>>     my $name  = "ou=users,dc=tow,dc=net";
>>>>
>>>>     # Bind uses the users full DN, if uid doesn't work try "cn"
>>>> #    my $binddn = "cn=$userid,$name";
>>>>     my $binddn = "uid=$userid,$name";
>>>>
>>>>     my $db = Net::LDAP->new( $ldapserver );
>>>>     
>>>>     # do bind
>>>>     my $res =$db->bind(
>>>>             dn    =>$binddn,
>>>>             password =>$password);
>>>>     
>>>>     # check connexion, anything other code than LDAP_SUCCESS (0)
>>>>     # is a problem
>>>>     if($res->code != 0 ) {
>>>>         # auth refused
>>>>         warn "LDAP Auth failed server not responding or wrong user 
>>>> password
>>>> combination";
>>>>         return 0;
>>>>     # search user
>>>>     }else {
>>>>     
>>>>         my $userdnsearch = $db->search(base => "$name",
>>>>                 filter =>"(cn=$userid)",
>>>>                 );
>>>>         my $userldapentry=$userdnsearch -> shift_entry;
>>>>        
>>>>         # build LDAP hash
>>>>         my %memberhash;
>>>>         my $x =$userldapentry->{asn}{attributes};
>>>>         my $key;
>>>>         foreach my $k ( @$x) {
>>>>             foreach my $k2 (keys %$k) {
>>>>                 if ($k2 eq 'type') {
>>>>                     $key = $$k{$k2};
>>>>                 } else {
>>>>                     my $a = @$k{$k2};
>>>>                     foreach my $k3 (@$a) {
>>>>                         $memberhash{$key} .= $k3." ";
>>>>                     }
>>>>                 }
>>>>             }
>>>>         }
>>>>         #
>>>>         # BUILD %borrower to CREATE or MODIFY BORROWER
>>>>         # change $memberhash{'xxx'} to fit your ldap structure.
>>>>         # check twice that mandatory fields are correctly filled
>>>>         #
>>>>         my %borrower;
>>>>         $borrower{cardnumber} = $userid;
>>>>         $borrower{firstname} = $memberhash{givenName}; # MANDATORY 
>>>> FIELD
>>>>         $borrower{surname} = $memberhash{sn}; # MANDATORY FIELD
>>>>         $borrower{initials} =
>>>> substr($borrower{firstname},0,1).substr($borrower{surname},0,1)."  
>>>> "; #
>>>> MANDATORY FIELD
>>>>         $borrower{streetaddress} = $memberhash{homePostalAddress}." 
>>>> "; #
>>>> MANDATORY FIELD
>>>>         $borrower{city} = $memberhash{l}." "; # MANDATORY FIELD
>>>>         $borrower{phone} = $memberhash{homePhone}." "; # MANDATORY 
>>>> FIELD
>>>>         $borrower{branchcode} = $memberhash{businessCategory}; # 
>>>> MANDATORY
>>>> FIELD
>>>>         $borrower{emailaddress} = $memberhash{mail};
>>>>         $borrower{categorycode} = $memberhash{employeeType};
>>>>     ##################################################
>>>>     ### /LOCAL
>>>>     ### No change needed after this line (unless there's a bug ;-) )
>>>>     ##################################################
>>>>
>>>> This works for passwords stored in LDAP that use MD5 or SMD5. I 
>>>> imagine
>>>> it will work for other hashing mechanisms also.
>>>>
>>>> Kent N
>>>>   On Tue, 2005-12-13 at 17:22 +0100, Paul POULAIN wrote:
>>>>        
>>>>> mourik jan c heupink a écrit :
>>>>>            
>>>>>> Dear Kent and list,
>>>>>>
>>>>>>                
>>>>>>> I'm using OpenLDAP 2.2.29 on Fedora Core 4.
>>>>>>>  
>>>>>>>
>>>>>>>                     
>>>>>> I'm on SuSE Linux Enterprise server 9, with OpenLDAP 2.2.24
>>>>>>
>>>>>>                
>>>>>>>> And a question to Paul Poulain: which ldap server are you 
>>>>>>>> using? I'm on openldap, and things don't work... Koha says the 
>>>>>>>> users's password is wrong, where I am pretty sure that it *IS* 
>>>>>>>> the right password.
>>>>>>>>
>>>>>>>>   
>>>>>>>>                         
>>>>>>> Password encryption is where I think Auth.pm falls down. This entry
>>>>>>>
>>>>>>> These are all the same password. The SMD5,MD5 doesn't work in 
>>>>>>> Koha the
>>>>>>> bottom one does. The bottom password was uploaded to LDAP using
>>>>>>> ldapmodify, as clear text. OpenLDAP must have a default method for
>>>>>>> encryption.
>>>>>>>
>>>>>>> I, (we) have to figure a way for the code to try other methods. 
>>>>>>> I'm not
>>>>>>> very well versed in Perl and will have to seek help to get this to
>>>>>>> work.                     
>>>>> I'm quite good in Perl, but a dummy in LDAP.
>>>>> I just can say that Auth_with_ldap.pm works for sure in Ecole des 
>>>>> Mines de Nantes, as i've set it up with the code I've commited.
>>>>> I think, but am not sure, that it's LDAP too, on Solaris.
>>>>>
>>>>> I don't know the structure of the directory, I just used the query 
>>>>> the system admin gave me.
>>>>>
>>>>> Sorry, but you'll have to investigate...
>>>>>             
>>>> _______________________________________________
>>>> Koha mailing list
>>>> Koha at lists.katipo.co.nz
>>>> http://lists.katipo.co.nz/mailman/listinfo/koha
>>>>         
>>> _______________________________________________
>>> Koha mailing list
>>> Koha at lists.katipo.co.nz
>>> http://lists.katipo.co.nz/mailman/listinfo/koha
>>>
>>>     
>>
>>   
> _______________________________________________
> Koha mailing list
> Koha at lists.katipo.co.nz
> http://lists.katipo.co.nz/mailman/listinfo/koha


More information about the Koha mailing list