X-Git-Url: http://koha-dev.rot13.org:8081/gitweb/?a=blobdiff_plain;f=C4%2FAuth_with_ldap.pm;h=fc1d63b69e9fb8089ba5c5f87b91c7914fcb1caa;hb=adb3777e2e4940a842e0d33a22121b1db762aeba;hp=a9fb2f267ca3f81f14cec34f614ac2327f951f28;hpb=cd230c2a72b128335c0b76224b78bd7299d0bb6c;p=koha_gimpoz diff --git a/C4/Auth_with_ldap.pm b/C4/Auth_with_ldap.pm index a9fb2f267c..fc1d63b69e 100644 --- a/C4/Auth_with_ldap.pm +++ b/C4/Auth_with_ldap.pm @@ -13,17 +13,21 @@ package C4::Auth_with_ldap; # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR # A PARTICULAR PURPOSE. See the GNU General Public License for more details. # -# You should have received a copy of the GNU General Public License along with -# Koha; if not, write to the Free Software Foundation, Inc., 59 Temple Place, -# Suite 330, Boston, MA 02111-1307 USA +# You should have received a copy of the GNU General Public License along +# with Koha; if not, write to the Free Software Foundation, Inc., +# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. use strict; +#use warnings; FIXME - Bug 2505 use Digest::MD5 qw(md5_base64); use C4::Debug; use C4::Context; use C4::Members qw(AddMember changepassword); +use C4::Members::Attributes; +use C4::Members::AttributeTypes; use C4::Utils qw( :all ); +use List::MoreUtils qw( any ); use Net::LDAP; use Net::LDAP::Filter; @@ -31,7 +35,7 @@ use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $debug); BEGIN { require Exporter; - $VERSION = 3.03; # set the version for version checking + $VERSION = 3.10; # set the version for version checking @ISA = qw(Exporter); @EXPORT = qw( checkpw_ldap ); } @@ -54,7 +58,7 @@ my $prefhost = $ldap->{hostname} or die ldapserver_error('hostname'); my $base = $ldap->{base} or die ldapserver_error('base'); $ldapname = $ldap->{user} ; $ldappassword = $ldap->{pass} ; -our %mapping = %{$ldap->{mapping}} or die ldapserver_error('mapping'); +our %mapping = %{$ldap->{mapping}}; # FIXME dpavlin -- don't die because of || (); from 6eaf8511c70eb82d797c941ef528f4310a15e9f9 my @mapkeys = keys %mapping; $debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys ( total ): ", join ' ', @mapkeys, "\n"; @mapkeys = grep {defined $mapping{$_}->{is}} @mapkeys; @@ -62,8 +66,8 @@ $debug and print STDERR "Got ", scalar(@mapkeys), " ldap mapkeys (populated): ", my %config = ( anonymous => ($ldapname and $ldappassword) ? 0 : 1, - replicate => $ldap->{replicate} || 1, # add from LDAP to Koha database for new user - update => $ldap->{update} || 1, # update from LDAP to Koha database for existing user + replicate => defined($ldap->{replicate}) ? $ldap->{replicate} : 1, # add from LDAP to Koha database for new user + update => defined($ldap->{update} ) ? $ldap->{update} : 1, # update from LDAP to Koha database for existing user ); sub description ($) { @@ -73,17 +77,11 @@ sub description ($) { . "# " . $result->error_text . "\n"; } -sub checkpw_ldap { - my ($dbh, $userid, $password) = @_; - my $db = Net::LDAP->new([$prefhost]); - #$debug and $db->debug(5); +sub search_method { + my $db = shift or return; + my $userid = shift or return; my $uid_field = $mapping{userid}->{is} or die ldapserver_error("mapping for 'userid'"); my $filter = Net::LDAP::Filter->new("$uid_field=$userid") or die "Failed to create new Net::LDAP::Filter"; - my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); - if ($res->code) { # connection refused - warn "LDAP bind failed as $ldapname: " . description($res); - return 0; - } my $search = $db->search( base => $base, filter => $filter, @@ -98,27 +96,100 @@ sub checkpw_ldap { warn sprintf("LDAP Auth rejected : %s gets %d hits\n", $filter->as_string, $count); return 0; } + return $search; +} - my $userldapentry = $search->shift_entry; - my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password ); - if ($cmpmesg->code != 6) { - warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg); - return 0; - } - unless ($config{update} or $config{replicate}) { - return 1; +sub checkpw_ldap { + my ($dbh, $userid, $password) = @_; + my @hosts = split(',', $prefhost); + my $db = Net::LDAP->new(\@hosts); + #$debug and $db->debug(5); + my $userldapentry; + if ( $ldap->{auth_by_bind} ) { + my $principal_name = $ldap->{principal_name}; + if ($principal_name and $principal_name =~ /\%/) { + $principal_name = sprintf($principal_name,$userid); + } else { + $principal_name = $userid; + } + my $res = $db->bind( $principal_name, password => $password ); + if ( $res->code ) { + $debug and warn "LDAP bind failed as kohauser $principal_name: ". description($res); + return 0; + } + + # FIXME dpavlin -- we really need $userldapentry leater on even if using auth_by_bind! + + # BUG #5094 + # 2010-08-04 JeremyC + # a $userldapentry is only needed if either updating or replicating are enabled + if($config{update} or $config{replicate}) { + my $search = search_method($db, $userid) or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; } - my %borrower = ldap_entry_2_hash($userldapentry,$userid); - $debug and print STDERR "checkpw_ldap received \%borrower w/ " . keys(%borrower), " keys: ", join(' ', keys %borrower), "\n"; - my ($borrowernumber,$cardnumber,$savedpw); - ($borrowernumber,$cardnumber,$userid,$savedpw) = exists_local($userid); - if ($borrowernumber) { - ($config{update} ) and my $c2 = &update_local($userid,$password,$borrowernumber,\%borrower) || ''; - ($cardnumber eq $c2) or warn "update_local returned cardnumber '$c2' instead of '$cardnumber'"; + } else { - ($config{replicate}) and $borrowernumber = AddMember(%borrower); + my $res = ($config{anonymous}) ? $db->bind : $db->bind($ldapname, password=>$ldappassword); + if ($res->code) { # connection refused + warn "LDAP bind failed as ldapuser " . ($ldapname || '[ANONYMOUS]') . ": " . description($res); + return 0; + } + my $search = search_method($db, $userid) or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; + my $cmpmesg = $db->compare( $userldapentry, attr=>'userpassword', value => $password ); + if ($cmpmesg->code != 6) { + warn "LDAP Auth rejected : invalid password for user '$userid'. " . description($cmpmesg); + return 0; + } } - return(1, $cardnumber); + + # To get here, LDAP has accepted our user's login attempt. + # But we still have work to do. See perldoc below for detailed breakdown. + + my (%borrower); + my ($borrowernumber,$cardnumber,$local_userid,$savedpw) = exists_local($userid); + + if (( $borrowernumber and $config{update} ) or + (!$borrowernumber and $config{replicate}) ) { + %borrower = ldap_entry_2_hash($userldapentry,$userid); + $debug and print STDERR "checkpw_ldap received \%borrower w/ " . keys(%borrower), " keys: ", join(' ', keys %borrower), "\n"; + } + + if ($borrowernumber) { + if ($config{update}) { # A1, B1 + my $c2 = &update_local($local_userid,$password,$borrowernumber,\%borrower) || ''; + ($cardnumber eq $c2) or warn "update_local returned cardnumber '$c2' instead of '$cardnumber'"; + } else { # C1, D1 + # maybe update just the password? + return(1, $cardnumber, $local_userid); + } + } elsif ($config{replicate}) { # A2, C2 + $borrowernumber = AddMember(%borrower) or die "AddMember failed"; + } else { + return 0; # B2, D2 + } + if (C4::Context->preference('ExtendedPatronAttributes') && $borrowernumber && ($config{update} ||$config{replicate})) { + my @types = C4::Members::AttributeTypes::GetAttributeTypes(); + my @attributes = grep{my $key=$_; any{$_ eq $key}@types;} keys %borrower; + my $extended_patron_attributes; + @{$extended_patron_attributes} = + map { { code => $_, value => $borrower{$_} } } @attributes; + my @errors; + #Check before add + for (my $i; $i< scalar(@$extended_patron_attributes)-1;$i++) { + my $attr=$extended_patron_attributes->[$i]; + unless (C4::Members::Attributes::CheckUniqueness($attr->{code}, $attr->{value}, $borrowernumber)) { + unshift @errors, $i; + warn "ERROR_extended_unique_id_failed $attr->{code} $attr->{value}"; + } + } + #Removing erroneous attributes + foreach my $index (@errors){ + @$extended_patron_attributes=splice(@$extended_patron_attributes,$index,1); + } + C4::Members::Attributes::SetBorrowerAttributes($borrowernumber, $extended_patron_attributes); + } +return(1, $cardnumber, $userid); } # Pass LDAP entry object and local cardnumber (userid). @@ -139,7 +210,6 @@ sub ldap_entry_2_hash ($$) { } } my $x = $userldapentry->{attrs} or return undef; - my $key; foreach (keys %$x) { $memberhash{$_} = join ' ', @{$x->{$_}}; $debug and print STDERR sprintf("building \$memberhash{%s} = ", $_, join(' ', @{$x->{$_}})), "\n"; @@ -147,8 +217,8 @@ sub ldap_entry_2_hash ($$) { $debug and print STDERR "Finsihed \%memberhash has ", scalar(keys %memberhash), " keys\n", "Referencing \%mapping with ", scalar(keys %mapping), " keys\n"; foreach my $key (keys %mapping) { - my $data = $memberhash{$mapping{$key}->{is}}; - $debug and print STDERR printf "mapping %20s ==> %-20s (%s)\n", $key, $mapping{$key}->{is}, $data; + my $data = $memberhash{ lc($mapping{$key}->{is}) }; # Net::LDAP returns all names in lowercase + $debug and printf STDERR "mapping %20s ==> %-20s (%s)\n", $key, $mapping{$key}->{is}, $data; unless (defined $data) { $data = $mapping{$key}->{content} || ''; # default or failsafe '' } @@ -158,6 +228,17 @@ sub ldap_entry_2_hash ($$) { ( substr($borrower{'firstname'},0,1) . substr($borrower{ 'surname' },0,1) . " "); + + # check if categorycode exists, if not, fallback to default from koha-conf.xml + my $dbh = C4::Context->dbh; + my $sth = $dbh->prepare("SELECT categorycode FROM categories WHERE categorycode = ?"); + $sth->execute( uc($borrower{'categorycode'}) ); + unless ( my $row = $sth->fetchrow_hashref ) { + my $default = $mapping{'categorycode'}->{content}; + $debug && warn "Can't find ", $borrower{'categorycode'}, " default to: $default for ", $borrower{userid}; + $borrower{'categorycode'} = $default + } + return %borrower; } @@ -168,16 +249,33 @@ sub exists_local($) { my $sth = $dbh->prepare("$select WHERE userid=?"); # was cardnumber=? $sth->execute($arg); - $debug and print STDERR printf "Userid '$arg' exists_local? %s\n", $sth->rows; + $debug and printf STDERR "Userid '$arg' exists_local? %s\n", $sth->rows; ($sth->rows == 1) and return $sth->fetchrow; $sth = $dbh->prepare("$select WHERE cardnumber=?"); $sth->execute($arg); - $debug and print STDERR printf "Cardnumber '$arg' exists_local? %s\n", $sth->rows; + $debug and printf STDERR "Cardnumber '$arg' exists_local? %s\n", $sth->rows; ($sth->rows == 1) and return $sth->fetchrow; return 0; } +sub _do_changepassword { + my ($userid, $borrowerid, $digest) = @_; + $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; + changepassword($userid, $borrowerid, $digest); + + # Confirm changes + my $sth = C4::Context->dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); + $sth->execute($borrowerid); + if ($sth->rows) { + my ($md5password, $cardnum) = $sth->fetchrow; + ($digest eq $md5password) and return $cardnum; + warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; + return undef; + } + die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; +} + sub update_local($$$$) { my $userid = shift or return undef; my $digest = md5_base64(shift) or return undef; @@ -199,20 +297,7 @@ sub update_local($$$$) { ); # MODIFY PASSWORD/LOGIN - # search borrowerid - $debug and print STDERR "changing local password for borrowernumber=$borrowerid to '$digest'\n"; - changepassword($userid, $borrowerid, $digest); - - # Confirm changes - $sth = $dbh->prepare("SELECT password,cardnumber FROM borrowers WHERE borrowernumber=? "); - $sth->execute($borrowerid); - if ($sth->rows) { - my ($md5password, $cardnum) = $sth->fetchrow; - ($digest eq $md5password) and return $cardnum; - warn "Password mismatch after update to cardnumber=$cardnum (borrowernumber=$borrowerid)"; - return undef; - } - die "Unexpected error after password update to userid/borrowernumber: $userid / $borrowerid."; + _do_changepassword($userid, $borrowerid, $digest); } 1; @@ -241,80 +326,99 @@ C4::Auth - Authenticates Koha users What are the required fields? Well, in mysql you can check the database table "borrowers" like this: mysql> show COLUMNS from borrowers; - +------------------+--------------+------+-----+---------+----------------+ - | Field | Type | Null | Key | Default | Extra | - +------------------+--------------+------+-----+---------+----------------+ - | borrowernumber | int(11) | NO | PRI | NULL | auto_increment | - | cardnumber | varchar(16) | YES | UNI | NULL | | - | surname | mediumtext | NO | | | | - | firstname | text | YES | | NULL | | - | title | mediumtext | YES | | NULL | | - | othernames | mediumtext | YES | | NULL | | - | initials | text | YES | | NULL | | - | streetnumber | varchar(10) | YES | | NULL | | - | streettype | varchar(50) | YES | | NULL | | - | address | mediumtext | NO | | | | - | address2 | text | YES | | NULL | | - | city | mediumtext | NO | | | | - | zipcode | varchar(25) | YES | | NULL | | - | email | mediumtext | YES | | NULL | | - | phone | text | YES | | NULL | | - | mobile | varchar(50) | YES | | NULL | | - | fax | mediumtext | YES | | NULL | | - | emailpro | text | YES | | NULL | | - | phonepro | text | YES | | NULL | | - | B_streetnumber | varchar(10) | YES | | NULL | | - | B_streettype | varchar(50) | YES | | NULL | | - | B_address | varchar(100) | YES | | NULL | | - | B_city | mediumtext | YES | | NULL | | - | B_zipcode | varchar(25) | YES | | NULL | | - | B_email | text | YES | | NULL | | - | B_phone | mediumtext | YES | | NULL | | - | dateofbirth | date | YES | | NULL | | - | branchcode | varchar(10) | NO | MUL | | | - | categorycode | varchar(10) | NO | MUL | | | - | dateenrolled | date | YES | | NULL | | - | dateexpiry | date | YES | | NULL | | - | gonenoaddress | tinyint(1) | YES | | NULL | | - | lost | tinyint(1) | YES | | NULL | | - | debarred | tinyint(1) | YES | | NULL | | - | contactname | mediumtext | YES | | NULL | | - | contactfirstname | text | YES | | NULL | | - | contacttitle | text | YES | | NULL | | - | guarantorid | int(11) | YES | | NULL | | - | borrowernotes | mediumtext | YES | | NULL | | - | relationship | varchar(100) | YES | | NULL | | - | ethnicity | varchar(50) | YES | | NULL | | - | ethnotes | varchar(255) | YES | | NULL | | - | sex | varchar(1) | YES | | NULL | | - | password | varchar(30) | YES | | NULL | | - | flags | int(11) | YES | | NULL | | - | userid | varchar(30) | YES | MUL | NULL | | # UNIQUE in next release. - | opacnote | mediumtext | YES | | NULL | | - | contactnote | varchar(255) | YES | | NULL | | - | sort1 | varchar(80) | YES | | NULL | | - | sort2 | varchar(80) | YES | | NULL | | - +------------------+--------------+------+-----+---------+----------------+ - 50 rows in set (0.01 sec) - + +---------------------+--------------+------+-----+---------+----------------+ + | Field | Type | Null | Key | Default | Extra | + +---------------------+--------------+------+-----+---------+----------------+ + | borrowernumber | int(11) | NO | PRI | NULL | auto_increment | + | cardnumber | varchar(16) | YES | UNI | NULL | | + | surname | mediumtext | NO | | NULL | | + | firstname | text | YES | | NULL | | + | title | mediumtext | YES | | NULL | | + | othernames | mediumtext | YES | | NULL | | + | initials | text | YES | | NULL | | + | streetnumber | varchar(10) | YES | | NULL | | + | streettype | varchar(50) | YES | | NULL | | + | address | mediumtext | NO | | NULL | | + | address2 | text | YES | | NULL | | + | city | mediumtext | NO | | NULL | | + | state | mediumtext | YES | | NULL | | + | zipcode | varchar(25) | YES | | NULL | | + | country | text | YES | | NULL | | + | email | mediumtext | YES | | NULL | | + | phone | text | YES | | NULL | | + | mobile | varchar(50) | YES | | NULL | | + | fax | mediumtext | YES | | NULL | | + | emailpro | text | YES | | NULL | | + | phonepro | text | YES | | NULL | | + | B_streetnumber | varchar(10) | YES | | NULL | | + | B_streettype | varchar(50) | YES | | NULL | | + | B_address | varchar(100) | YES | | NULL | | + | B_address2 | text | YES | | NULL | | + | B_city | mediumtext | YES | | NULL | | + | B_state | mediumtext | YES | | NULL | | + | B_zipcode | varchar(25) | YES | | NULL | | + | B_country | text | YES | | NULL | | + | B_email | text | YES | | NULL | | + | B_phone | mediumtext | YES | | NULL | | + | dateofbirth | date | YES | | NULL | | + | branchcode | varchar(10) | NO | MUL | | | + | categorycode | varchar(10) | NO | MUL | | | + | dateenrolled | date | YES | | NULL | | + | dateexpiry | date | YES | | NULL | | + | gonenoaddress | tinyint(1) | YES | | NULL | | + | lost | tinyint(1) | YES | | NULL | | + | debarred | date | YES | | NULL | | + | debarredcomment | varchar(255) | YES | | NULL | | + | contactname | mediumtext | YES | | NULL | | + | contactfirstname | text | YES | | NULL | | + | contacttitle | text | YES | | NULL | | + | guarantorid | int(11) | YES | MUL | NULL | | + | borrowernotes | mediumtext | YES | | NULL | | + | relationship | varchar(100) | YES | | NULL | | + | ethnicity | varchar(50) | YES | | NULL | | + | ethnotes | varchar(255) | YES | | NULL | | + | sex | varchar(1) | YES | | NULL | | + | password | varchar(30) | YES | | NULL | | + | flags | int(11) | YES | | NULL | | + | userid | varchar(30) | YES | MUL | NULL | | + | opacnote | mediumtext | YES | | NULL | | + | contactnote | varchar(255) | YES | | NULL | | + | sort1 | varchar(80) | YES | | NULL | | + | sort2 | varchar(80) | YES | | NULL | | + | altcontactfirstname | varchar(255) | YES | | NULL | | + | altcontactsurname | varchar(255) | YES | | NULL | | + | altcontactaddress1 | varchar(255) | YES | | NULL | | + | altcontactaddress2 | varchar(255) | YES | | NULL | | + | altcontactaddress3 | varchar(255) | YES | | NULL | | + | altcontactstate | mediumtext | YES | | NULL | | + | altcontactzipcode | varchar(50) | YES | | NULL | | + | altcontactcountry | text | YES | | NULL | | + | altcontactphone | varchar(50) | YES | | NULL | | + | smsalertnumber | varchar(50) | YES | | NULL | | + | privacy | int(11) | NO | | 1 | | + +---------------------+--------------+------+-----+---------+----------------+ + 66 rows in set (0.00 sec) Where Null="NO", the field is required. -=cut - =head1 KOHA_CONF and field mapping Example XML stanza for LDAP configuration in KOHA_CONF. ... + 1 localhost dc=metavore,dc=com cn=Manager,dc=metavore,dc=com - metavore - 1 - 1 + metavore + 1 + 1 + 0 + %s@my_domain.com + @@ -336,8 +440,84 @@ is the column in mysql, with the "is" characteristic set to the LDAP attribute n between the element tags is taken as the default value. In this example, the default categorycode is "PT" (for patron). +=head1 CONFIGURATION + +Once a user has been accepted by the LDAP server, there are several possibilities for how Koha will behave, depending on +your configuration and the presence of a matching Koha user in your local DB: + + LOCAL_USER + OPTION UPDATE REPLICATE EXISTS? RESULT + A1 1 1 1 OK : We're updating them anyway. + A2 1 1 0 OK : We're adding them anyway. + B1 1 0 1 OK : We update them. + B2 1 0 0 FAIL: We cannot add new user. + C1 0 1 1 OK : We do nothing. (maybe should update password?) + C2 0 1 0 OK : We add the new user. + D1 0 0 1 OK : We do nothing. (maybe should update password?) + D2 0 0 0 FAIL: We cannot add new user. + +Note: failure here just means that Koha will fallback to checking the local DB. That is, a given user could login with +their LDAP password OR their local one. If this is a problem, then you should enable update and supply a mapping for +password. Then the local value will be updated at successful LDAP login and the passwords will be synced. + +If you choose NOT to update local users, the borrowers table will not be affected at all. +Note that this means that patron passwords may appear to change if LDAP is ever disabled, because +the local table never contained the LDAP values. + +=head2 auth_by_bind + +Binds as the user instead of retrieving their record. Recommended if update disabled. + +=head2 principal_name + +Provides an optional sprintf-style format for manipulating the userid before the bind. +Even though the userPrincipalName is one intended target, any uniquely identifying +attribute that the server allows to be used for binding could be used. + +Currently, principal_name only operates when auth_by_bind is enabled. + +=head2 Active Directory + +The auth_by_bind and principal_name settings are recommended for Active Directory. + +Under default Active Directory rules, we cannot determine the distinguishedName attribute from the Koha userid as reliably as +we would typically under openldap. Instead of: + + distinguishedName: CN=barnes.7,DC=my_company,DC=com + +We might get: + + distinguishedName: CN=Barnes\, Jim,OU=Test Accounts,OU=User Accounts,DC=my_company,DC=com + +Matching that would require us to know more info about the account (firstname, surname) and to include punctuation and whitespace +in Koha userids. But the userPrincipalName should be consistent, something like: + + userPrincipalName: barnes.7@my_company.com + +Therefore it is often easier to bind to Active Directory with userPrincipalName, effectively the +canonical email address for that user, or what it would be if email were enabled for them. If Koha userid values +will match the username portion of the userPrincipalName, and the domain suffix is the same for all users, then use principal_name +like this: + %s@core.my_company.com + +The user of the previous example, barnes.7, would then attempt to bind as: + barnes.7@core.my_company.com + +=head1 SEE ALSO + +CGI(3) + +Net::LDAP() + +XML::Simple() + +Digest::MD5(3) + +sprintf() + =cut +# For reference, here's an important difference in the data structure we rely on. # ======================================== # Using attrs instead of {asn}->attributes # ======================================== @@ -350,15 +530,3 @@ patron). # LDAP key: ->{ givenname} = ARRAY w/ 1 members. # LDAP key: ->{ givenname}->{Steve} = Steve # - -=head1 SEE ALSO - -CGI(3) - -Net::LDAP() - -XML::Simple() - -Digest::MD5(3) - -=cut