X-Git-Url: http://koha-dev.rot13.org:8081/gitweb/?a=blobdiff_plain;f=C4%2FAuth_with_ldap.pm;h=fc1d63b69e9fb8089ba5c5f87b91c7914fcb1caa;hb=98c59fc3577b5904fc980781ce805bff875b157f;hp=cc648de0bccfbee7e6e1e6cd390d8ff60d11798f;hpb=d5938493d7f1519c345762d747554326c006719c;p=koha_gimpoz diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm index cc648de0bc..fc1d63b69e 100644 --- a/C4/Auth_with_ldap.pm +++ b/C4/Auth_with_ldap.pm @@ -1,7 +1,4 @@ -# -*- tab-width: 8 -*- -# NOTE: This file uses 8-character tabs; do not change the tab size! - -package C4::Auth; +package C4::Auth_with_ldap; # Copyright 2000-2002 Katipo Communications # @@ -16,674 +13,520 @@ package C4::Auth; # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR # A PARTICULAR PURPOSE. See the GNU General Public License for more details. # -# You should have received a copy of the GNU General Public License along with -# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place, -# Suite 330, Boston, MA 02111-1307 USA +# You should have received a copy of the GNU General Public License along +# with Koha; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. use strict; +#use warnings; FIXME - Bug 2505 use Digest::MD5 qw(md5_base64); -require Exporter; +use C4::Debug; use C4::Context; -use C4::Output; # to get the template -use C4::Interface::CGI::Output; -use C4::Circulation::Circ2; # getpatroninformation -use C4::Members; -# use Net::LDAP; -# use Net::LDAP qw(:all); - -use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); - -# set the version for version checking -$VERSION = 0.01; - -=head1 NAME - -C4::Auth - Authenticates Koha users - -=head1 SYNOPSIS - - use CGI; - use C4::Auth; - - my $query = new CGI; - - my ($template, $borrowernumber, $cookie) - = get_template_and_user({template_name => "opac-main.tmpl", - query => $query, - type => "opac", - authnotrequired => 1, - flagsrequired => {borrow => 1}, - }); - - print $query->header( - -type => guesstype($template->output), - -cookie => $cookie - ), $template->output; - - -=head1 DESCRIPTION - - The main function of this module is to provide - authentification. However the get_template_and_user function has - been provided so that a users login information is passed along - automatically. This gets loaded into the template. - -=head1 LDAP specific - - This module is specific to LDAP authentification. It requires Net::LDAP package and a working LDAP server. - To use it : - * move initial Auth.pm elsewhere - * Search the string LOCAL - * modify the code between LOCAL and /LOCAL to fit your LDAP server parameters & fields - * rename this module to Auth.pm - That should be enough. - -=head1 FUNCTIONS - -=over 2 - -=cut +use C4::Members qw(AddMember changepassword); +use C4::Members::Attributes; +use C4::Members::AttributeTypes; +use C4::Utils qw( :all ); +use List::MoreUtils qw( any ); +use Net::LDAP; +use Net::LDAP::Filter; + +use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug); + +BEGIN { + require Exporter; + $VERSION = 3.10; # set the version for version checking + @ISA = qw(Exporter); + @EXPORT = qw( checkpw_ldap ); +} +# Redefine checkpw_ldap: +# connect to LDAP (named or anonymous) +# ~ retrieves $userid from KOHA_CONF mapping +# ~ then compares $password with userPassword +# ~ then gets the LDAP entry +# ~ and calls the memberadd if necessary +sub ldapserver_error ($) { + return sprintf('No ldapserver "%s" defined in KOHA_CONF: ' . $ENV{KOHA_CONF}, shift); +} -@ISA = qw(Exporter); -@EXPORT = qw( - &checkauth - &get_template_and_user +use vars qw($mapping @ldaphosts $base $ldapname $ldappassword); +my $context = C4::Context->new() or die 'C4::Context->new failed'; +my $ldap = C4::Context->config("ldapserver") or die 'No "ldapserver" in server hash from KOHA_CONF: ' . $ENV{KOHA_CONF}; +my $prefhost = $ldap->{hostname} or die ldapserver_error('hostname'); +my $base = $ldap->{base} or die ldapserver_error('base'); +$ldapname = $ldap->{user} ; +$ldappassword = $ldap->{pass} ; +our %mapping = %{$ldap->{mapping}}; # FIXME dpavlin -- don't die because of || (); from 6eaf8511c70eb82d797c941ef528f4310a15e9f9 +my @mapkeys = keys %mapping; +$debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys ( total ): ", join ' ', @mapkeys, "\n"; +@mapkeys = grep {defined $mapping{$_}->{is}} @mapkeys; +$debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys (populated): ", join ' ', @mapkeys, "\n"; + +my %config = ( + anonymous => ($ldapname and $ldappassword) ? 0 : 1, + replicate => defined($ldap->{replicate}) ? $ldap->{replicate} : 1, # add from LDAP to Koha database for new user + update => defined($ldap->{update} ) ? $ldap->{update} : 1, # update from LDAP to Koha database for existing user ); -=item get_template_and_user - - my ($template, $borrowernumber, $cookie) - = get_template_and_user({template_name => "opac-main.tmpl", - query => $query, - type => "opac", - authnotrequired => 1, - flagsrequired => {borrow => 1}, - }); - - This call passes the C, C and C - to C<&checkauth> (in this module) to perform authentification. - See C<&checkauth> for an explanation of these parameters. - - The C is then used to find the correct template for - the page. The authenticated users details are loaded onto the - template in the HTML::Template LOOP variable C. Also the - C is passed to the template. This can be used in templates - if cookies are disabled. It needs to be put as and input to every - authenticated page. - - More information on the C sub can be found in the - Output.pm module. - -=cut - - -sub get_template_and_user { - my $in = shift; - my $template = gettemplate($in->{'template_name'}, $in->{'type'},$in->{'query'}); - my ($user, $cookie, $sessionID, $flags) - = checkauth($in->{'query'}, $in->{'authnotrequired'}, $in->{'flagsrequired'}, $in->{'type'}); - - my $borrowernumber; - if ($user) { - $template->param(loggedinusername => $user); - $template->param(sessionID => $sessionID); - - $borrowernumber = getborrowernumber($user); - my ($borr, $alternativeflags) = getpatroninformation(undef, $borrowernumber); - my @bordat; - $bordat[0] = $borr; - $template->param(USER_INFO => \@bordat, - ); - # We are going to use the $flags returned by checkauth - # to create the template's parameters that will indicate - # which menus the user can access. - if ($flags && $flags->{superlibrarian} == 1) - { - $template->param(CAN_user_circulate => 1); - $template->param(CAN_user_catalogue => 1); - $template->param(CAN_user_parameters => 1); - $template->param(CAN_user_borrowers => 1); - $template->param(CAN_user_permission => 1); - $template->param(CAN_user_reserveforothers => 1); - $template->param(CAN_user_borrow => 1); - $template->param(CAN_user_reserveforself => 1); - $template->param(CAN_user_editcatalogue => 1); - $template->param(CAN_user_updatecharge => 1); - $template->param(CAN_user_acquisition => 1); - $template->param(CAN_user_management => 1); - $template->param(CAN_user_tools => 1); } - - if ($flags && $flags->{circulate} == 1) { - $template->param(CAN_user_circulate => 1); } - - if ($flags && $flags->{catalogue} == 1) { - $template->param(CAN_user_catalogue => 1); } - - - if ($flags && $flags->{parameters} == 1) { - $template->param(CAN_user_parameters => 1); - $template->param(CAN_user_management => 1); - $template->param(CAN_user_tools => 1); } - - - if ($flags && $flags->{borrowers} == 1) { - $template->param(CAN_user_borrowers => 1); } - - - if ($flags && $flags->{permissions} == 1) { - $template->param(CAN_user_permission => 1); } - - if ($flags && $flags->{reserveforothers} == 1) { - $template->param(CAN_user_reserveforothers => 1); } - - - if ($flags && $flags->{borrow} == 1) { - $template->param(CAN_user_borrow => 1); } - - - if ($flags && $flags->{reserveforself} == 1) { - $template->param(CAN_user_reserveforself => 1); } - - - if ($flags && $flags->{editcatalogue} == 1) { - $template->param(CAN_user_editcatalogue => 1); } - - - if ($flags && $flags->{updatecharges} == 1) { - $template->param(CAN_user_updatecharge => 1); } - - if ($flags && $flags->{acquisition} == 1) { - $template->param(CAN_user_acquisition => 1); } - - if ($flags && $flags->{management} == 1) { - $template->param(CAN_user_management => 1); - $template->param(CAN_user_tools => 1); } - - if ($flags && $flags->{tools} == 1) { - $template->param(CAN_user_tools => 1); } - } - $template->param( - LibraryName => C4::Context->preference("LibraryName"), - ); - return ($template, $borrowernumber, $cookie); +sub description ($) { + my $result = shift or return undef; + return "LDAP error #" . $result->code + . ": " . $result->error_name . "\n" + . "# " . $result->error_text . "\n"; } +sub search_method { + my $db = shift or return; + my $userid = shift or return; + my $uid_field = $mapping{userid}->{is} or die ldapserver_error("mapping for 'userid'"); + my $filter = Net::LDAP::Filter->new("$uid_field=$userid") or die "Failed to create new Net::LDAP::Filter"; + my $search = $db->search( + base => $base, + filter => $filter, + # attrs => ['*'], + ) or die "LDAP search failed to return object."; + my $count = $search->count; + if ($search->code > 0) { + warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count) . description($search); + return 0; + } + if ($count != 1) { + warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count); + return 0; + } + return $search; +} -=item checkauth - - ($userid, $cookie, $sessionID) = &checkauth($query, $noauth, $flagsrequired, $type); - -Verifies that the user is authorized to run this script. If -the user is authorized, a (userid, cookie, session-id, flags) -quadruple is returned. If the user is not authorized but does -not have the required privilege (see $flagsrequired below), it -displays an error page and exits. Otherwise, it displays the -login page and exits. - -Note that C<&checkauth> will return if and only if the user -is authorized, so it should be called early on, before any -unfinished operations (e.g., if you've opened a file, then -C<&checkauth> won't close it for you). - -C<$query> is the CGI object for the script calling C<&checkauth>. - -The C<$noauth> argument is optional. If it is set, then no -authorization is required for the script. - -C<&checkauth> fetches user and session information from C<$query> and -ensures that the user is authorized to run scripts that require -authorization. - -The C<$flagsrequired> argument specifies the required privileges -the user must have if the username and password are correct. -It should be specified as a reference-to-hash; keys in the hash -should be the "flags" for the user, as specified in the Members -intranet module. Any key specified must correspond to a "flag" -in the userflags table. E.g., { circulate => 1 } would specify -that the user must have the "circulate" privilege in order to -proceed. To make sure that access control is correct, the -C<$flagsrequired> parameter must be specified correctly. - -The C<$type> argument specifies whether the template should be -retrieved from the opac or intranet directory tree. "opac" is -assumed if it is not specified; however, if C<$type> is specified, -"intranet" is assumed if it is not "opac". - -If C<$query> does not have a valid session ID associated with it -(i.e., the user has not logged in) or if the session has expired, -C<&checkauth> presents the user with a login page (from the point of -view of the original script, C<&checkauth> does not return). Once the -user has authenticated, C<&checkauth> restarts the original script -(this time, C<&checkauth> returns). - -The login page is provided using a HTML::Template, which is set in the -systempreferences table or at the top of this file. The variable C<$type> -selects which template to use, either the opac or the intranet -authentification template. - -C<&checkauth> returns a user ID, a cookie, and a session ID. The -cookie should be sent back to the browser; it verifies that the user -has authenticated. +sub checkpw_ldap { + my ($dbh, $userid, $password) = @_; + my @hosts = split(',', $prefhost); + my $db = Net::LDAP->new(\@hosts); + #$debug and $db->debug(5); + my $userldapentry; + if ( $ldap->{auth_by_bind} ) { + my $principal_name = $ldap->{principal_name}; + if ($principal_name and $principal_name =~ /\%/) { + $principal_name = sprintf($principal_name,$userid); + } else { + $principal_name = $userid; + } + my $res = $db->bind( $principal_name, password => $password ); + if ( $res->code ) { + $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res); + return 0; + } -=cut + # FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind! + # BUG #5094 + # 2010-08-04 JeremyC + # a $userldapentry is only needed if either updating or replicating are enabled + if($config{update} or $config{replicate}) { + my $search = search_method($db, $userid) or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; + } + } else { + my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); + if ($res->code) { # connection refused + warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); + return 0; + } + my $search = search_method($db, $userid) or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; + my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password ); + if ($cmpmesg->code != 6) { + warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg); + return 0; + } + } -sub checkauth { - my $query=shift; - # $authnotrequired will be set for scripts which will run without authentication - my $authnotrequired = shift; - my $flagsrequired = shift; - my $type = shift; - $type = 'opac' unless $type; + # To get here, LDAP has accepted our user's login attempt. + # But we still have work to do. See perldoc below for detailed breakdown. - my $dbh = C4::Context->dbh; - my $timeout = C4::Context->preference('timeout'); - $timeout = 600 unless $timeout; + my (%borrower); + my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid); - my $template_name; - if ($type eq 'opac') { - $template_name = "opac-auth.tmpl"; - } else { - $template_name = "auth.tmpl"; - } + if (( $borrowernumber and $config{update} ) or + (!$borrowernumber and $config{replicate}) ) { + %borrower = ldap_entry_2_hash($userldapentry,$userid); + $debug and print STDERR "checkpw_ldap received \%borrower w/ " . keys(%borrower), " keys: ", join(' ', keys %borrower), "\n"; + } - # state variables - my $loggedin = 0; - my %info; - my ($userid, $cookie, $sessionID, $flags,$envcookie); - my $logout = $query->param('logout.x'); - if ($userid = $ENV{'REMOTE_USER'}) { - # Using Basic Authentication, no cookies required - $cookie=$query->cookie(-name => 'sessionID', - -value => '', - -expires => ''); - $loggedin = 1; - } elsif ($sessionID=$query->cookie('sessionID')) { - C4::Context->_new_userenv($sessionID); - if (my %hash=$query->cookie('userenv')){ - C4::Context::set_userenv( - $hash{number}, - $hash{id}, - $hash{cardnumber}, - $hash{firstname}, - $hash{surname}, - $hash{branch}, - $hash{flags}, - $hash{emailaddress}, - ); - } - my ($ip , $lasttime); - ($userid, $ip, $lasttime) = $dbh->selectrow_array( - "SELECT userid,ip,lasttime FROM sessions WHERE sessionid=?", - undef, $sessionID); - if ($logout) { - # voluntary logout the user - $dbh->do("DELETE FROM sessions WHERE sessionID=?", undef, $sessionID); - C4::Context->_unset_userenv($sessionID); - $sessionID = undef; - $userid = undef; - open L, ">>/tmp/sessionlog"; - my $time=localtime(time()); - printf L "%20s from %16s logged out at %30s (manually).\n", $userid, $ip, $time; - close L; - } - if ($userid) { - if ($lasttimedo("DELETE FROM sessions WHERE sessionID=?", undef, $sessionID); - C4::Context->_unset_userenv($sessionID); - $userid = undef; - $sessionID = undef; - open L, ">>/tmp/sessionlog"; - my $time=localtime(time()); - printf L "%20s from %16s logged out at %30s (inactivity).\n", $userid, $ip, $time; - close L; - } elsif ($ip ne $ENV{'REMOTE_ADDR'}) { - # Different ip than originally logged in from - $info{'oldip'} = $ip; - $info{'newip'} = $ENV{'REMOTE_ADDR'}; - $info{'different_ip'} = 1; - $dbh->do("DELETE FROM sessions WHERE sessionID=?", undef, $sessionID); - C4::Context->_unset_userenv($sessionID); - $sessionID = undef; - $userid = undef; - open L, ">>/tmp/sessionlog"; - my $time=localtime(time()); - printf L "%20s from logged out at %30s (ip changed from %16s to %16s).\n", $userid, $time, $ip, $info{'newip'}; - close L; - } else { - $cookie=$query->cookie(-name => 'sessionID', - -value => $sessionID, - -expires => ''); - $dbh->do("UPDATE sessions SET lasttime=? WHERE sessionID=?", - undef, (time(), $sessionID)); - $flags = haspermission($dbh, $userid, $flagsrequired); - if ($flags) { - $loggedin = 1; - } else { - $info{'nopermission'} = 1; + if ($borrowernumber) { + if ($config{update}) { # A1, B1 + my $c2 = &update_local($local_userid,$password,$borrowernumber,\%borrower) || ''; + ($cardnumber eq $c2) or warn "update_local returned cardnumber '$c2' instead of '$cardnumber'"; + } else { # C1, D1 + # maybe update just the password? + return(1, $cardnumber, $local_userid); + } + } elsif ($config{replicate}) { # A2, C2 + $borrowernumber = AddMember(%borrower) or die "AddMember failed"; + } else { + return 0; # B2, D2 + } + if (C4::Context->preference('ExtendedPatronAttributes') && $borrowernumber && ($config{update} ||$config{replicate})) { + my @types = C4::Members::AttributeTypes::GetAttributeTypes(); + my @attributes = grep{my $key=$_; any{$_ eq $key}@types;} keys %borrower; + my $extended_patron_attributes; + @{$extended_patron_attributes} = + map { { code => $_, value => $borrower{$_} } } @attributes; + my @errors; + #Check before add + for (my $i; $i< scalar(@$extended_patron_attributes)-1;$i++) { + my $attr=$extended_patron_attributes->[$i]; + unless (C4::Members::Attributes::CheckUniqueness($attr->{code}, $attr->{value}, $borrowernumber)) { + unshift @errors, $i; + warn "ERROR_extended_unique_id_failed $attr->{code} $attr->{value}"; } } + #Removing erroneous attributes + foreach my $index (@errors){ + @$extended_patron_attributes=splice(@$extended_patron_attributes,$index,1); } - } - unless ($userid) { - $sessionID=int(rand()*100000).'-'.time(); - $userid=$query->param('userid'); - my $password=$query->param('password'); - C4::Context->_new_userenv($sessionID); - my ($return, $cardnumber) = checkpw($dbh,$userid,$password); - if ($return) { - $dbh->do("DELETE FROM sessions WHERE sessionID=? AND userid=?", - undef, ($sessionID, $userid)); - $dbh->do("INSERT INTO sessions (sessionID, userid, ip,lasttime) VALUES (?, ?, ?, ?)", - undef, ($sessionID, $userid, $ENV{'REMOTE_ADDR'}, time())); - open L, ">>/tmp/sessionlog"; - my $time=localtime(time()); - printf L "%20s from %16s logged in at %30s.\n", $userid, $ENV{'REMOTE_ADDR'}, $time; - close L; - $cookie=$query->cookie(-name => 'sessionID', - -value => $sessionID, - -expires => ''); - if ($flags = haspermission($dbh, $userid, $flagsrequired)) { - $loggedin = 1; - } else { - $info{'nopermission'} = 1; - C4::Context->_unset_userenv($sessionID); - } - if ($return == 1){ - my ($bornum,$firstname,$surname,$userflags,$branchcode,$emailaddress); - my $sth=$dbh->prepare("select borrowernumber,firstname,surname,flags,branchcode,emailaddress from borrowers where userid=?"); - $sth->execute($userid); - ($bornum,$firstname,$surname,$userflags,$branchcode,$emailaddress) = $sth->fetchrow if ($sth->rows); - unless ($sth->rows){ - my $sth=$dbh->prepare("select borrowernumber,firstname,surname,flags,branchcode,emailaddress from borrowers where cardnumber=?"); - $sth->execute($cardnumber); - ($bornum,$firstname,$surname,$userflags,$branchcode,$emailaddress) = $sth->fetchrow if ($sth->rows); - unless ($sth->rows){ - $sth->execute($userid); - ($bornum,$firstname,$surname,$userflags,$branchcode,$emailaddress) = $sth->fetchrow if ($sth->rows); - } - } - my $hash = C4::Context::set_userenv( - $bornum, - $userid, - $cardnumber, - $firstname, - $surname, - $branchcode, - $userflags, - $emailaddress, - ); - $envcookie=$query->cookie(-name => 'userenv', - -value => $hash, - -expires => ''); - } elsif ($return == 2) { - #We suppose the user is the superlibrarian - my $hash = C4::Context::set_userenv( - 0,0, - C4::Context->config('user'), - C4::Context->config('user'), - C4::Context->config('user'), - "",1,C4::Context->preference('KohaAdminEmailAddress') - ); - $envcookie=$query->cookie(-name => 'userenv', - -value => $hash, - -expires => ''); - } - } else { - if ($userid) { - $info{'invalid_username_or_password'} = 1; - C4::Context->_unset_userenv($sessionID); - } + C4::Members::Attributes::SetBorrowerAttributes($borrowernumber, $extended_patron_attributes); + } +return(1, $cardnumber, $userid); +} + +# Pass LDAP entry object and local cardnumber (userid). +# Returns borrower hash. +# Edit KOHA_CONF so $memberhash{'xxx'} fits your ldap structure. +# Ensure that mandatory fields are correctly filled! +# +sub ldap_entry_2_hash ($$) { + my $userldapentry = shift; + my %borrower = ( cardnumber => shift ); + my %memberhash; + $userldapentry->exists('uid'); # This is bad, but required! By side-effect, this initializes the attrs hash. + if ($debug) { + print STDERR "\nkeys(\%\$userldapentry) = " . join(', ', keys %$userldapentry), "\n", $userldapentry->dump(); + foreach (keys %$userldapentry) { + print STDERR "\n\nLDAP key: $_\t", sprintf('(%s)', ref $userldapentry->{$_}), "\n"; + hashdump("LDAP key: ",$userldapentry->{$_}); } } - my $insecure = C4::Context->boolean_preference('insecure'); - # finished authentification, now respond - if ($loggedin || $authnotrequired || (defined($insecure) && $insecure)) { - # successful login - unless ($cookie) { - $cookie=$query->cookie(-name => 'sessionID', - -value => '', - -expires => ''); - } - if ($envcookie){ - return ($userid, [$cookie,$envcookie], $sessionID, $flags) - } else { - return ($userid, $cookie, $sessionID, $flags); + my $x = $userldapentry->{attrs} or return undef; + foreach (keys %$x) { + $memberhash{$_} = join ' ', @{$x->{$_}}; + $debug and print STDERR sprintf("building \$memberhash{%s} = ", $_, join(' ', @{$x->{$_}})), "\n"; + } + $debug and print STDERR "Finsihed \%memberhash has ", scalar(keys %memberhash), " keys\n", + "Referencing \%mapping with ", scalar(keys %mapping), " keys\n"; + foreach my $key (keys %mapping) { + my $data = $memberhash{ lc($mapping{$key}->{is}) }; # Net::LDAP returns all names in lowercase + $debug and printf STDERR "mapping %20s ==> %-20s (%s)\n", $key, $mapping{$key}->{is}, $data; + unless (defined $data) { + $data = $mapping{$key}->{content} || ''; # default or failsafe '' } + $borrower{$key} = ($data ne '') ? $data : ' ' ; } - # else we have a problem... - # get the inputs from the incoming query - my @inputs =(); - foreach my $name (param $query) { - (next) if ($name eq 'userid' || $name eq 'password'); - my $value = $query->param($name); - push @inputs, {name => $name , value => $value}; + $borrower{initials} = $memberhash{initials} || + ( substr($borrower{'firstname'},0,1) + . substr($borrower{ 'surname' },0,1) + . " "); + + # check if categorycode exists, if not, fallback to default from koha-conf.xml + my $dbh = C4::Context->dbh; + my $sth = $dbh->prepare("SELECT categorycode FROM categories WHERE categorycode = ?"); + $sth->execute( uc($borrower{'categorycode'}) ); + unless ( my $row = $sth->fetchrow_hashref ) { + my $default = $mapping{'categorycode'}->{content}; + $debug && warn "Can't find ", $borrower{'categorycode'}, " default to: $default for ", $borrower{userid}; + $borrower{'categorycode'} = $default } - my $template = gettemplate($template_name, $type,$query); - $template->param(INPUTS => \@inputs); - $template->param(loginprompt => 1) unless $info{'nopermission'}; - - my $self_url = $query->url(-absolute => 1); - $template->param(url => $self_url); - $template->param(\%info); - $cookie=$query->cookie(-name => 'sessionID', - -value => $sessionID, - -expires => ''); - print $query->header( - -type => guesstype($template->output), - -cookie => $cookie - ), $template->output; - exit; + return %borrower; } +sub exists_local($) { + my $arg = shift; + my $dbh = C4::Context->dbh; + my $select = "SELECT borrowernumber,cardnumber,userid,password FROM borrowers "; + my $sth = $dbh->prepare("$select WHERE userid=?"); # was cardnumber=? + $sth->execute($arg); + $debug and printf STDERR "Userid '$arg' exists_local? %s\n", $sth->rows; + ($sth->rows == 1) and return $sth->fetchrow; -# this checkpw is a LDAP based one -# it connects to LDAP (anonymous) -# it retrieve $userid a-login -# then compare $password with a-weak -# then get the LDAP entry -# and calls the memberadd if necessary + $sth = $dbh->prepare("$select WHERE cardnumber=?"); + $sth->execute($arg); + $debug and printf STDERR "Cardnumber '$arg' exists_local? %s\n", $sth->rows; + ($sth->rows == 1) and return $sth->fetchrow; + return 0; +} -sub checkpw { - my ($dbh, $userid, $password) = @_; - if ($userid eq C4::Context->config('user') && $password eq C4::Context->config('pass')) { - # Koha superuser account - return 2; - } - ################################################## - ### LOCAL - ### Change the code below to match your own LDAP server. - ################################################## - # LDAP connexion parameters - my $ldapserver = 'your.ldap.server.com'; - # Infos to do an anonymous bind - my $ldapinfos = 'a-section=people,dc=emn,dc=fr '; - my $name = "a-section=people,dc=emn,dc=fr"; - my $db = Net::LDAP->new( $ldapserver ); - - # do an anonymous bind - my $res =$db->bind(); - if($res->code) { - # auth refused - warn "LDAP Auth impossible : server not responding"; - return 0; - } else { - my $userdnsearch = $db->search(base => $name, - filter =>"(a-login=$userid)", - ); - if($userdnsearch->code || ! ( $userdnsearch-> count eq 1 ) ) { - warn "LDAP Auth impossible : user unknown in LDAP"; - return 0; - }; - - my $userldapentry=$userdnsearch -> shift_entry; - my $cmpmesg = $db -> compare ( $userldapentry, attr => 'a-weak', value => $password ); - ## HACK LMK - ## ligne originale - # if( $cmpmesg -> code != 6 ) { - if( ( $cmpmesg -> code != 6 ) && ! ( $password eq "kivabien" ) ) { - warn "LDAP Auth impossible : wrong password"; - return 0; - }; - # build LDAP hash - my %memberhash; - my $x =$userldapentry->{asn}{attributes}; - my $key; - foreach my $k ( @$x) { - foreach my $k2 (keys %$k) { - if ($k2 eq 'type') { - $key = $$k{$k2}; - } else { - my $a = @$k{$k2}; - foreach my $k3 (@$a) { - $memberhash{$key} .= $k3." "; - } - } - } - } - # - # BUILD %borrower to CREATE or MODIFY BORROWER - # change $memberhash{'xxx'} to fit your ldap structure. - # check twice that mandatory fields are correctly filled - # - my %borrower; - $borrower{cardnumber} = $userid; - $borrower{firstname} = $memberhash{givenName}; # MANDATORY FIELD - $borrower{surname} = $memberhash{sn}; # MANDATORY FIELD - $borrower{initials} = substr($borrower{firstname},0,1).substr($borrower{surname},0,1)." "; # MANDATORY FIELD - $borrower{streetaddress} = $memberhash{l}." "; # MANDATORY FIELD - $borrower{city} = " "; # MANDATORY FIELD - $borrower{phone} = " "; # MANDATORY FIELD - $borrower{branchcode} = $memberhash{branch}; # MANDATORY FIELD - $borrower{emailaddress} = $memberhash{mail}; - $borrower{categorycode} = $memberhash{employeeType}; - ################################################## - ### /LOCAL - ### No change needed after this line (unless there's a bug ;-) ) - ################################################## - # check if borrower exists - my $sth=$dbh->prepare("select password from borrowers where cardnumber=?"); - $sth->execute($userid); - if ($sth->rows) { - # it exists, MODIFY -# warn "MODIF borrower"; - my $sth2 = $dbh->prepare("update borrowers set firstname=?,surname=?,initials=?,streetaddress=?,city=?,phone=?, categorycode=?,branchcode=?,emailaddress=?,sort1=? where cardnumber=?"); - $sth2->execute($borrower{firstname},$borrower{surname},$borrower{initials}, - $borrower{streetaddress},$borrower{city},$borrower{phone}, - $borrower{categorycode},$borrower{branchcode},$borrower{emailaddress}, - $borrower{sort1} ,$userid); - } else { - # it does not exists, ADD borrower -# warn "ADD borrower"; - my $borrowerid = newmember(%borrower); - } - # - # CREATE or MODIFY PASSWORD/LOGIN - # - # search borrowerid - $sth = $dbh->prepare("select borrowernumber from borrowers where cardnumber=?"); - $sth->execute($userid); - my ($borrowerid)=$sth->fetchrow; -# warn "change password for $borrowerid setting $password"; - my $digest=md5_base64($password); - changepassword($userid,$borrowerid,$digest); - } +sub _do_changepassword { + my ($userid, $borrowerid, $digest) = @_; + $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; + changepassword($userid, $borrowerid, $digest); -# INTERNAL AUTH - my $sth=$dbh->prepare("select password,cardnumber from borrowers where userid=?"); - $sth->execute($userid); - if ($sth->rows) { - my ($md5password,$cardnumber) = $sth->fetchrow; - if (md5_base64($password) eq $md5password) { - return 1,$cardnumber; - } - } - my $sth=$dbh->prepare("select password from borrowers where cardnumber=?"); - $sth->execute($userid); + # Confirm changes + my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); + $sth->execute($borrowerid); if ($sth->rows) { - my ($md5password) = $sth->fetchrow; - if (md5_base64($password) eq $md5password) { - return 1,$userid; - } + my ($md5password, $cardnum) = $sth->fetchrow; + ($digest eq $md5password) and return $cardnum; + warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; + return undef; } - return 0; + die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; } -sub getuserflags { - my $cardnumber=shift; - my $dbh=shift; - my $userflags; - my $sth=$dbh->prepare("SELECT flags FROM borrowers WHERE cardnumber=?"); - $sth->execute($cardnumber); - my ($flags) = $sth->fetchrow; - $sth=$dbh->prepare("SELECT bit, flag, defaulton FROM userflags"); - $sth->execute; - while (my ($bit, $flag, $defaulton) = $sth->fetchrow) { - if (($flags & (2**$bit)) || $defaulton) { - $userflags->{$flag}=1; +sub update_local($$$$) { + my $userid = shift or return undef; + my $digest = md5_base64(shift) or return undef; + my $borrowerid = shift or return undef; + my $borrower = shift or return undef; + my @keys = keys %$borrower; + my $dbh = C4::Context->dbh; + my $query = "UPDATE borrowers\nSET " . + join(',', map {"$_=?"} @keys) . + "\nWHERE borrowernumber=? "; + my $sth = $dbh->prepare($query); + if ($debug) { + print STDERR $query, "\n", + join "\n", map {"$_ = '" . $borrower->{$_} . "'"} @keys; + print STDERR "\nuserid = $userid\n"; } - } - return $userflags; -} + $sth->execute( + ((map {$borrower->{$_}} @keys), $borrowerid) + ); -sub haspermission { - my ($dbh, $userid, $flagsrequired) = @_; - my $sth=$dbh->prepare("SELECT cardnumber FROM borrowers WHERE userid=?"); - $sth->execute($userid); - my ($cardnumber) = $sth->fetchrow; - ($cardnumber) || ($cardnumber=$userid); - my $flags=getuserflags($cardnumber,$dbh); - my $configfile; - if ($userid eq C4::Context->config('user')) { - # Super User Account from /etc/koha.conf - $flags->{'superlibrarian'}=1; - } - if ($userid eq 'demo' && C4::Context->config('demo')) { - # Demo user that can do "anything" (demo=1 in /etc/koha.conf) - $flags->{'superlibrarian'}=1; - } - return $flags if $flags->{superlibrarian}; - foreach (keys %$flagsrequired) { - return $flags if $flags->{$_}; - } - return 0; + # MODIFY PASSWORD/LOGIN + _do_changepassword($userid, $borrowerid, $digest); } -sub getborrowernumber { - my ($userid) = @_; - my $dbh = C4::Context->dbh; - for my $field ('userid', 'cardnumber') { - my $sth=$dbh->prepare - ("select borrowernumber from borrowers where $field=?"); - $sth->execute($userid); - if ($sth->rows) { - my ($bnumber) = $sth->fetchrow; - return $bnumber; - } - } - return 0; -} - -END { } # module clean-up code here (global destructor) 1; __END__ -=back +=head1 NAME + +C4::Auth - Authenticates Koha users + +=head1 SYNOPSIS + + use C4::Auth_with_ldap; + +=head1 LDAP Configuration + + This module is specific to LDAP authentification. It requires Net::LDAP package and one or more + working LDAP servers. + To use it : + * Modify ldapserver element in KOHA_CONF + * Establish field mapping in element. + + For example, if your user records are stored according to the inetOrgPerson schema, RFC#2798, + the username would match the "uid" field, and the password should match the "userpassword" field. + + Make sure that ALL required fields are populated by your LDAP database (and mapped in KOHA_CONF). + What are the required fields? Well, in mysql you can check the database table "borrowers" like this: + + mysql> show COLUMNS from borrowers; + +---------------------+--------------+------+-----+---------+----------------+ + | Field | Type | Null | Key | Default | Extra | + +---------------------+--------------+------+-----+---------+----------------+ + | borrowernumber | int(11) | NO | PRI | NULL | auto_increment | + | cardnumber | varchar(16) | YES | UNI | NULL | | + | surname | mediumtext | NO | | NULL | | + | firstname | text | YES | | NULL | | + | title | mediumtext | YES | | NULL | | + | othernames | mediumtext | YES | | NULL | | + | initials | text | YES | | NULL | | + | streetnumber | varchar(10) | YES | | NULL | | + | streettype | varchar(50) | YES | | NULL | | + | address | mediumtext | NO | | NULL | | + | address2 | text | YES | | NULL | | + | city | mediumtext | NO | | NULL | | + | state | mediumtext | YES | | NULL | | + | zipcode | varchar(25) | YES | | NULL | | + | country | text | YES | | NULL | | + | email | mediumtext | YES | | NULL | | + | phone | text | YES | | NULL | | + | mobile | varchar(50) | YES | | NULL | | + | fax | mediumtext | YES | | NULL | | + | emailpro | text | YES | | NULL | | + | phonepro | text | YES | | NULL | | + | B_streetnumber | varchar(10) | YES | | NULL | | + | B_streettype | varchar(50) | YES | | NULL | | + | B_address | varchar(100) | YES | | NULL | | + | B_address2 | text | YES | | NULL | | + | B_city | mediumtext | YES | | NULL | | + | B_state | mediumtext | YES | | NULL | | + | B_zipcode | varchar(25) | YES | | NULL | | + | B_country | text | YES | | NULL | | + | B_email | text | YES | | NULL | | + | B_phone | mediumtext | YES | | NULL | | + | dateofbirth | date | YES | | NULL | | + | branchcode | varchar(10) | NO | MUL | | | + | categorycode | varchar(10) | NO | MUL | | | + | dateenrolled | date | YES | | NULL | | + | dateexpiry | date | YES | | NULL | | + | gonenoaddress | tinyint(1) | YES | | NULL | | + | lost | tinyint(1) | YES | | NULL | | + | debarred | date | YES | | NULL | | + | debarredcomment | varchar(255) | YES | | NULL | | + | contactname | mediumtext | YES | | NULL | | + | contactfirstname | text | YES | | NULL | | + | contacttitle | text | YES | | NULL | | + | guarantorid | int(11) | YES | MUL | NULL | | + | borrowernotes | mediumtext | YES | | NULL | | + | relationship | varchar(100) | YES | | NULL | | + | ethnicity | varchar(50) | YES | | NULL | | + | ethnotes | varchar(255) | YES | | NULL | | + | sex | varchar(1) | YES | | NULL | | + | password | varchar(30) | YES | | NULL | | + | flags | int(11) | YES | | NULL | | + | userid | varchar(30) | YES | MUL | NULL | | + | opacnote | mediumtext | YES | | NULL | | + | contactnote | varchar(255) | YES | | NULL | | + | sort1 | varchar(80) | YES | | NULL | | + | sort2 | varchar(80) | YES | | NULL | | + | altcontactfirstname | varchar(255) | YES | | NULL | | + | altcontactsurname | varchar(255) | YES | | NULL | | + | altcontactaddress1 | varchar(255) | YES | | NULL | | + | altcontactaddress2 | varchar(255) | YES | | NULL | | + | altcontactaddress3 | varchar(255) | YES | | NULL | | + | altcontactstate | mediumtext | YES | | NULL | | + | altcontactzipcode | varchar(50) | YES | | NULL | | + | altcontactcountry | text | YES | | NULL | | + | altcontactphone | varchar(50) | YES | | NULL | | + | smsalertnumber | varchar(50) | YES | | NULL | | + | privacy | int(11) | NO | | 1 | | + +---------------------+--------------+------+-----+---------+----------------+ + 66 rows in set (0.00 sec) + Where Null="NO", the field is required. + +=head1 KOHA_CONF and field mapping + +Example XML stanza for LDAP configuration in KOHA_CONF. + + + ... + 1 + + + localhost + dc=metavore,dc=com + cn=Manager,dc=metavore,dc=com + metavore + 1 + 1 + 0 + %s@my_domain.com + + + + +
+ Athens, OH + + MAIN + + + + PT + + + + + +The subelements establish the relationship between mysql fields and LDAP attributes. The element name +is the column in mysql, with the "is" characteristic set to the LDAP attribute name. Optionally, any content +between the element tags is taken as the default value. In this example, the default categorycode is "PT" (for +patron). + +=head1 CONFIGURATION + +Once a user has been accepted by the LDAP server, there are several possibilities for how Koha will behave, depending on +your configuration and the presence of a matching Koha user in your local DB: + + LOCAL_USER + OPTION UPDATE REPLICATE EXISTS? RESULT + A1 1 1 1 OK : We're updating them anyway. + A2 1 1 0 OK : We're adding them anyway. + B1 1 0 1 OK : We update them. + B2 1 0 0 FAIL: We cannot add new user. + C1 0 1 1 OK : We do nothing. (maybe should update password?) + C2 0 1 0 OK : We add the new user. + D1 0 0 1 OK : We do nothing. (maybe should update password?) + D2 0 0 0 FAIL: We cannot add new user. + +Note: failure here just means that Koha will fallback to checking the local DB. That is, a given user could login with +their LDAP password OR their local one. If this is a problem, then you should enable update and supply a mapping for +password. Then the local value will be updated at successful LDAP login and the passwords will be synced. + +If you choose NOT to update local users, the borrowers table will not be affected at all. +Note that this means that patron passwords may appear to change if LDAP is ever disabled, because +the local table never contained the LDAP values. + +=head2 auth_by_bind + +Binds as the user instead of retrieving their record. Recommended if update disabled. + +=head2 principal_name + +Provides an optional sprintf-style format for manipulating the userid before the bind. +Even though the userPrincipalName is one intended target, any uniquely identifying +attribute that the server allows to be used for binding could be used. + +Currently, principal_name only operates when auth_by_bind is enabled. + +=head2 Active Directory + +The auth_by_bind and principal_name settings are recommended for Active Directory. + +Under default Active Directory rules, we cannot determine the distinguishedName attribute from the Koha userid as reliably as +we would typically under openldap. Instead of: + + distinguishedName: CN=barnes.7,DC=my_company,DC=com + +We might get: + + distinguishedName: CN=Barnes\, Jim,OU=Test Accounts,OU=User Accounts,DC=my_company,DC=com + +Matching that would require us to know more info about the account (firstname, surname) and to include punctuation and whitespace +in Koha userids. But the userPrincipalName should be consistent, something like: + + userPrincipalName: barnes.7@my_company.com + +Therefore it is often easier to bind to Active Directory with userPrincipalName, effectively the +canonical email address for that user, or what it would be if email were enabled for them. If Koha userid values +will match the username portion of the userPrincipalName, and the domain suffix is the same for all users, then use principal_name +like this: + %s@core.my_company.com + +The user of the previous example, barnes.7, would then attempt to bind as: + barnes.7@core.my_company.com =head1 SEE ALSO CGI(3) -C4::Output(3) +Net::LDAP() + +XML::Simple() Digest::MD5(3) +sprintf() + =cut + +# For reference, here's an important difference in the data structure we rely on. +# ======================================== +# Using attrs instead of {asn}->attributes +# ======================================== +# +# LDAP key: ->{ cn} = ARRAY w/ 3 members. +# LDAP key: ->{ cn}->{ sss} = sss +# LDAP key: ->{ cn}->{ Steve Smith} = Steve Smith +# LDAP key: ->{ cn}->{Steve S. Smith} = Steve S. Smith +# +# LDAP key: ->{ givenname} = ARRAY w/ 1 members. +# LDAP key: ->{ givenname}->{Steve} = Steve +#