Editing LDAP (section)

===Kerberos Authentication on AD with On-Demand Creation of Users using LDAP ===

Tested on 3.3.8

Here's another example of a customized <tt>/opt/eprints3/archives/ARCHIVEID/cfg/cfg.d/user_login.pl</tt>:

* allowing LDAP accounts to login, using the following example
* allowing the local eprints admin account to login w/ database authentication
* creating eprints accounts for all successfully authenticated LDAP users ''on the fly''


 $c->{check_user_password} = sub {
   my( $session, $username, $password ) = @_;
   
   # Kerberos authentication for "user", "editor" and "admin" types (roles)
   
   use Net::LDAP; # IO::Socket::SSL also required
   use Authen::Krb5::Simple;
   use Authen::SASL;
   
   # LDAP tunables
   my $ldap_host = "ldap.example.org";
   my $base      = "OU=people,DC=example,DC=org";
   my $proxy_user ="ad_read";
   my $dn        = "CN=$proxy_user,$base";
   
   # Kerberos tunables
   my $krb_host = "example.org";
      
   my $krb 	  = Authen::Krb5::Simple->new(realm => $krb_host);
   unless ( $krb )
   {
   	print STDERR "Kerberos error: $@\n";
   	return 0;
   }
   
   my $ldap      = Net::LDAP->new ( $ldap_host );
   unless( $ldap )
   {
       print STDERR "LDAP error: $@\n";
       return 0;
   }
   
   my $sasl = Authen::SASL->new(
          mechanism => 'GSSAPI', 
          callback => { user => 'ad_read' }
        ) or die "$@";
   
   my $mesg = $ldap->bind(sasl => $sasl);
   
   if( $mesg->code() )
   {
       print STDERR "LDAP Bind error: " . $mesg->error() . "\n";
       return 0;
   }
   
   # Distinguished name (and attribues needed later on) for this user
   my $result = $ldap->search (
       base    => "$base",
       filter  => "(&(sAMAccountName=$username))",
       attrs   =>  ['1.1', 'uid', 'sn', 'givenname', 'mail', 'department', 'title'],
       sizelimit=>1
   );
   
   my $entr = $result->pop_entry;
   unless( defined $entr )
   {
       # Allow local EPrints authentication for admins (accounts not found in LDAP)
       my $user = EPrints::DataObj::User::user_with_username( $session, $username );
       return 0 unless $user;
   
       my $user_type = $user->get_type;
       if( $user_type eq "admin" )
       {
           # internal authentication for "admin" type
           return $session->get_database->valid_login( $username, $password );
       }
       return 0;
   }
   
   # Check password
   if( !$krb->authenticate( $username, $password ) )
   {
   	print STDERR "$username authentication failed: ", $krb->errstr(), "\n";
       return 0;
   }
   
   # Does account already exist?
   my $user = EPrints::DataObj::User::user_with_username( $session, $username );
   if( !defined $user )
   {
       # New account
       $user = EPrints::DataObj::User::create( $session, "user" );
       $user->set_value( "username", $username );
   }
   
   # Set metadata
   my $name = {};
   $name->{family} = $entr->get_value( "sn" );
   $name->{given} = $entr->get_value( "givenName" );
   $name->{honourific} = $entr->get_value( "title");
   $user->set_value( "name", $name );
   $user->set_value( "username", $username );
   $user->set_value( "email", $entr->get_value( "mail" ) );
   $user->set_value( "dept", $entr->get_value("department")  );
   $user->commit();
   
   $ldap->unbind if $ldap;
   
   return 1;
  }