[Koha] Koha Digest, Vol 40, Issue 35
Library Guy
library.guy.zero at gmail.com
Tue Jul 14 09:03:04 NZST 2009
James, I'm running Koha 3.00.02 which includes the new
<auth_by_bind>1</auth_by_bind> for Active Directory, but I still cannot
authenticate against our M$ LDAP. The Koha OPAC reports "Error: Invalid
Username or Password. Specifically I'm unsure what to do with the
<password></password> tag because our Microsoft AD LDAP schema has no
exposed "userpassword". Do I simply use <password = ""></password>? I
wish to create and update Koha user records when they login to Koha, so I
have:
<ldapserver id="ldapserver" listenref="ldapserver">
<hostname>ldap://ldap.example.com:389</hostname>
<base>dc=example,dc=com</base>
<user>CN=KOHA_LDAP_USER</user> <!-- DN, if not anonymous -->
<pass>secretpasswd</pass> <!-- password, if not anonymous -->
<replicate>1</replicate> <!-- add new users from LDAP to Koha
database -->
<update>1</update> <!-- update existing users in Koha database
-->
<auth_by_bind>1</auth_by_bind> <!-- set to 1 to authenticate by binding
instead of
password comparison, e.g., to use
Active Directory -->
<mapping> <!-- match koha SQL field names to your LDAP record
field names -->
<firstname is="givenName" ></firstname>
<surname is="sn" ></surname>
<address is="streetAddress" ></address>
<city is="l" ></city>
<zipcode is="postalCode" ></zipcode>
<userid is="sAMAccountName" ></userid>
<password is="" ></password>
<email is="mail" ></email>
<phone is="telephoneNumber"></phone>
</mapping>
</ldapserver>
After a failed login attempt, /var/log/koha/koha-error_log :
[Mon Jul 13 15:56:11 2009] [error] [client] [Mon Jul 13 15:56:11 2009]
mainpage.pl: LDAP Auth rejected : invalid password for user 'johndoe'. LDAP
error #16: LDAP_NO_SUCH_ATTRIBUTE, referer:
http://koha.example.com:8080/cgi-bin/koha/mainpage.pl
[Mon Jul 13 15:56:11 2009] [error] [client] [Mon Jul 13 15:56:11 2009]
mainpage.pl: # The request referenced an attribute that does not exist,
referer: http://koha.example.com:8080/cgi-bin/koha/mainpage.pl
[Mon Jul 13 15:56:11 2009] [error] [client] [Mon Jul 13 15:56:11 2009]
mainpage.pl: , referer:
http://koha.example.com:8080/cgi-bin/koha/mainpage.pl
thank you!
> 1. Re: FW: Koha 3.0 LDAP Question? (Winter, James)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 13 Feb 2009 09:52:45 -0500
> From: "Winter, James" <WinterJ at arcadia.edu>
> Subject: Re: [Koha] FW: Koha 3.0 LDAP Question?
> To: "Barry Cannon" <bc at interleaf.ie>
> Cc: koha at lists.katipo.co.nz
> Message-ID:
> <195366CE4CF91245936298EEA68FEA980AE3C41E at BISHOP.arcadia.edu>
> Content-Type: text/plain; charset="us-ascii"
>
> Did you comment out the two lines in Auth_with_ldap.pm? If so, it won't
> update or replicate the data. If you didn't, I would make sure you have
> the property names correct. I would start with the required fields
> (surname, address, city, branchcode, categorycode).
>
>
>
> Try using default values by setting is="" for those properties and put
> text between the tags. <address is="">123 Test Street</address> for
> example. If a person is created successfully with default values then
> it's a property name problem. If not, it's a Koha problem.
>
>
>
> James Winter
>
> 215.517.2588
>
>
>
> From: Barry Cannon [mailto:bc at interleaf.ie]
> Sent: Friday, February 13, 2009 7:31 AM
> To: Winter, James
> Cc: koha at lists.katipo.co.nz
> Subject: RE: [Koha] FW: Koha 3.0 LDAP Question?
>
>
>
> James,
>
> Thanks for this info...I can now authenticate against my
> LDAP server with no problems. However, when I start enabling <replicate>
> and <update> to try and add the AD users into Koha the replication
> doesn't occur. The authentication still works but the users information,
> as per mappings, doesn't come across into Koha. There are no errors
> either?
>
>
>
> Does anyone have any suggestions?
>
>
>
> Thanks
>
> Bar
>
>
>
> From: Winter, James [mailto:WinterJ at arcadia.edu]
> Sent: 12 February 2009 17:35
> To: Barry Cannon
> Cc: koha at lists.katipo.co.nz
> Subject: RE: [Koha] FW: Koha 3.0 LDAP Question?
>
>
>
> Sure, it took me a while to get it working, but we have it working now.
>
>
>
> In our koha-conf.xml, we have this section in the config section
> (between <config> and </config> near the end of the file):
>
>
>
> <useldapserver>1</useldapserver>
>
> <ldapserver id="ldapserver">
>
> <hostname>LDAPSERVERNAMEHERE:389</hostname>
>
> <base>dc=DOMAIN,dc=COM</base>
>
> <user> CN=[USER THAT CAN BROWSE ACTIVE DIRECTORY],OU=[OU OF USER
> (MULTIPLE ENTRIES IF NESTED OU)],DC=DOMAIN,DC=COM </user> <!-- DN, if
> not anonymous -->
>
> <pass>[PASSWORD OF USER]</pass><!-- password, if not anonymous -->
>
> <replicate>0</replicate> <!-- add new users from LDAP to Koha
> database -->
>
> <update>0</update> <!-- update existing users in Koha
> database -->
>
> <mapping> <!-- match koha SQL field names to your
> LDAP record field names -->
>
> <!--<cardnumber is="" ></cardnumber>-->
>
> <!--<firstname is="givenname" ></firstname>-->
>
> <!--<surname is="sn" ></surname>-->
>
> <!--<address is="" > </address>-->
>
> <!--<city is="" >
> </city>-->
>
> <!--<zipcode is="" ></zipcode>-->
>
> <!--<branchcode is ="">MAIN</branchcode>-->
>
> <userid is="samAccountName" ></userid>
>
> <password is="" ></password>
>
> <!--<email is="mail" ></email>-->
>
> <!--<categorycode is="employeetype" > </categorycode>-->
>
> <!--<phone is=""></phone>-->
>
> </mapping>
>
> </ldapserver>
>
>
>
> Most of the attributes are commented out because we populate our users
> in Koha from a different system and they only log in using their AD
> password. We don't want to add new users or update existing users.
>
>
>
> Then in Auth_with_ldap.pm at line 102 (thanks to this thread
> http://lists.koha.org/pipermail/koha-devel/2008-September/008355.html)
>
>
>
> Change these lines:
>
>
>
> my $userldapentry = $search->shift_entry;
>
> my $cmpmesg = $db->compare( $userldapentry,
> attr=>'userpassword', value => $password );
>
> if ($cmpmesg->code != 6) {
>
> warn "LDAP Auth rejected : invalid password for user
> '$userid'. " . description($cmpmesg);
>
> return 0;
>
> }
>
>
>
> To this:
>
>
>
> my $userldapentry = $search->shift_entry;
>
>
>
> my $dbuser = Net::LDAP->new( [$prefhost] );
>
> $res = $dbuser->bind( $userldapentry, password => $password );
>
> unless ( $db && ! $res->code ) {
>
> warn "LDAP Auth rejected : invalid password for user
> '$userid'";
>
> return 0;
>
> }
>
>
>
> We had an additional problem with the Auth_with_ldap.pm automatically
> updating the card number with the user's login. We have existing cards
> with specific numbers that we're importing, so I had to disable a couple
> of other lines (lines 116 and 117 in Auth_with_ldap.pm, before the first
> edit.)
>
>
>
> #($config{update} ) and my $c2 =
> &update_local($userid,$password,$borrowernumber,\%borrower) || '';
>
> #($cardnumber eq $c2) or warn "update_local returned
> cardnumber '$c2' instead of '$cardnumber'";
>
>
>
> Hopefully this helps.
>
>
>
> James Winter
>
> 215.517.2588
>
>
>
> From: Barry Cannon [mailto:bc at interleaf.ie]
> Sent: Thursday, February 12, 2009 12:06 PM
> To: Winter, James
> Subject: RE: [Koha] FW: Koha 3.0 LDAP Question?
>
>
>
> Yes, I am using Active Directory. Do you have any tips?
>
>
>
> From: Winter, James [mailto:WinterJ at arcadia.edu]
> Sent: 12 February 2009 17:06
> To: Barry Cannon
> Subject: RE: [Koha] FW: Koha 3.0 LDAP Question?
>
>
>
> Are you using Active Directory?
>
>
>
> James Winter
>
> 215.517.2588
>
>
>
> From: koha-bounces at lists.katipo.co.nz
> [mailto:koha-bounces at lists.katipo.co.nz] On Behalf Of Barry Cannon
> Sent: Thursday, February 12, 2009 9:17 AM
> To: koha at lists.katipo.co.nz
> Subject: [Koha] FW: Koha 3.0 LDAP Question?
>
>
>
> I have been trying to configure LDAP and have a couple of questions:
>
>
>
> The Wiki says: There are two parts of the KOHA_CONF file (default
> location: /etc/koha.xml) relevant to LDAP authentication: the
> configuration stanza itself, and the "switch" line that enables or
> disables LDAP. The switch appears in the main <config> section, 0 for
> "off" and 1 for "on",....
>
>
>
> Should I take this to mean the koha-conf.xml file? There is no koha.xml
> file on our installed server? If it is this file, do I simply add the
> LDAP server options in the config file.
>
>
>
> I have assumed that is what is needed but I can't figure out where to go
> from there? Is there an Admin tool to configure/test the LPAD
> authentication?
>
>
>
> Thanks
>
> Barry
>
>
>
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://lists.katipo.co.nz/pipermail/koha/attachments/20090213/87c6d6cd/attachment.htm
>
> ------------------------------
>
> _______________________________________________
> Koha mailing list
> Koha at lists.katipo.co.nz
> http://lists.katipo.co.nz/mailman/listinfo/koha
>
>
> End of Koha Digest, Vol 40, Issue 35
> ************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.katipo.co.nz/pipermail/koha/attachments/20090713/74845ea7/attachment-0001.htm
More information about the Koha
mailing list