Editing LDAP (section)

====LDAP Authentication ====

All changes for LDAP authentication can be made in a single file, the file contains useful notes on configuration. Here is an example from my site, I have configured a standard Samba Domain using LDAP for authentication, if you have similar then this config may work for you :

See [[user_login.pl]] for general information on check_user_password.

Edit the file :

 vi /opt/eprints3/archives/yourarchivename/cfg/cfg.d/user_login.pl

 # This function allows you to override the default username/password
 # authentication. For example, you could apply different authentication rules to 
 # different types of user.
 #
 # Example: LDAP Authentication (Quick Start)
 #
 # Tip: use the test script to determine your LDAP parameters first! Then put the 
 # following parameters in ldap.pl or similarly name file in your archive's 
 # cfg/cfg.d directory:  ldap_hostname, ldap_bind_username, ldap_bind_password
 # ldap_import_base, ldap_import_filter, ldap_login_base, ldap_login_filter
 # Tip: remove the set-password privilege from users and editors in
 # user_roles.pl. Also consider removing edit-own-record and 
 # change-email.
 
 $c->{check_user_password} = sub {
   my( $session, $username, $password ) = @_;
 
   # Cannot login with a username
   return 0 if $username =~ /[^a-zA-Z0-9._\-@]/;
 
   # See if user already exists in EPrints.  .
   my $user = EPrints::DataObj::User::user_with_username( $session, $username );
 
   # You may wish fail login if the user does not already have an account.
   # return 0 unless defined $user;
 
   # Get user type from database or assume standard user if no user / user type is set.
   my $usertype = defined $user ? $user->get_type : "user";
 
   # minuser and local_admin types have local database logins.        
   if( $usertype eq "minuser" || $usertype eq "local_admin" )
   {
     return $session->get_database->valid_login( $username, $password );
   }
 
   # Connect to the LDAP hostname configured for this repositiory
   use Net::LDAP;
   my $ldap_host = $session->get_repository->get_conf( "ldap_hostname" );
   my $ldap = Net::LDAP->new ( $ldap_host, version => 3 );
   unless( $ldap )
   {
     $session->get_repository->log( "LDAP connect error: $@\n" );
     return 0;
   }
 
   # Bind using username and password configured for this repository
   my $bind_dn = $session->get_repository->get_conf( "ldap_bind_username" ) || "";
   my $bind_pword = $session->get_repository->get_conf( "ldap_bind_password" ) || "";
   my $mesg;
   if( $bind_dn eq "" && $bind_pword eq "" )
   {
     $mesg = $ldap->bind; # anonymous bind
   }
   else
   {
     $mesg = $ldap->bind( $bind_dn, password => $bind_pword );
   }
   if( $mesg->code() )
   {
     $session->get_repository->log( "LDAP bind error: " . $mesg->error . "\n" );
     return 0;
   }
 
   # Lookup the user based on the username they provided when logging in.  It is assume this is 
   # the sAMAccountName attribute on your Active Directory LDAP server, it may be uid or cn.
   my $base = $session->get_repository->get_conf( "ldap_login_base" );
   my $filter = $session->get_repository->get_conf( "ldap_login_filter" );
   $mesg = $ldap->search(
     base => $base,
     attrs => [qw( sAMAccountName givenName sn mail displayname description memberOf )],
     scope => "sub",
     filter => "&(sAMAccountName=$username) $filter",
     sizelimit => 2,
     timelimit => 30,
   );
   if( $mesg->code() )
   {
     $session->get_repository->log( "LDAP search error: ".$mesg->error."\n" );
     return 0;
   }
   if( $mesg->count() != 1 )
   {
      return 0;
   }
 
   # If user could be found in LDAP check the password they provided when logging in is correct.
   my $entr = $mesg->entry(0);
   my $user_dn = $entr->dn();
   $mesg = $ldap->bind( $user_dn, password => $password );
   if( $mesg->code )
   {
     $session->get_repository->log( "Failed authentication for $user_dn: ".$mesg->error."\n" );
     return 0;
   }
 
   # Uncomment to allow on-demand creation of users
   #unless( defined $user )
   #{
   #  my $data = {
   #    username => $username,
   #    usertype => $usertype, # This will be a standard user
   #  };
   #  my $name;
   #  $name->{given} = $entr->get_value( "givenName" ) if defined $entr->get_value( "givenName" );
   #  $name->{family} = $entr->get_value( "sn" ) if defined $entr->get_value( "sn" );
   #  $data->{name} = $name if defined $name;
   #  $data->{email} = $entr->get_value( "mail" ) if defined $entr->get_value( "mail" );
   #  $data->{dept} = $entr->get_value( "ou" ) if defined $entr->get_value( "ou" );
   # 
   #  $user = EPrints::DataObj::User->create_from_data(
   #    $session,
   #    $data,
   #    $session->get_repository->get_dataset( "user" ) 
   #  );
   #}
 
     return 1;
 }

After editing restart Apache.