If you have an LDAP server, Koha can use that to authenticate users.

In the modules/C4 directory, you'll find the Auth_with_ldap.pm package. Open it with your text editor, modify it to fit your needs (LDAP server name and parameters), then :

It should work. Note that when you upgrade your Koha version, you have to manually copy your modified Auth_with_ldap.pm and overwrite the official Auth.pm once again.

Don't forget to save the official Auth.pm somewhere; it can alway be useful.

An anonymous bind to LDAP requires us to compare passwords by retrieving the password then comparing to what the user has supplied. If passwords stored in LDAP are hashed using different mechanisms, the burden of determining what mechanism is used is on the Koha application. I changed the code in Auth.pm a little so that bind() uses the person's DN and password. The burden of what password hash is used is on LDAP and not Koha.

Between local in Auth.pm:

        ##################################################
        ### LOCAL
        ### Change the code below to match your own LDAP server.
        ##################################################
        # LDAP connexion parameters

        # LDAP server
        my $ldapserver = '172.16.0.24';

        # Base DN for users
        my $name  = "ou=users,dc=tow,dc=net";

        # Bind uses the users full DN, if uid doesn't work try "cn"
#        my $binddn = "cn=$userid,$name";
        my $binddn = "uid=$userid,$name";

        my $db = Net::LDAP->new( $ldapserver );
        
        # do bind
        my $res =$db->bind(
                        dn        =>$binddn,
                        password =>$password);
        
        # check connexion, anything other code than LDAP_SUCCESS (0)
        # is a problem
        if($res->code != 0 ) {
                # auth refused
                warn "LDAP Auth failed server not responding or wrong user password combination";
                return 0;
        # search user
        }else {
        
                my $userdnsearch = $db->search(base => "$name",
                                filter =>"(cn=$userid)",
                                );
                my $userldapentry=$userdnsearch -> shift_entry;
                
                # build LDAP hash
                my %memberhash;
                my $x =$userldapentry->{asn}{attributes};
                my $key;
                foreach my $k ( @$x) {
                        foreach my $k2 (keys %$k) {
                                if ($k2 eq 'type') {
                                        $key = $$k{$k2};
                                } else {
                                        my $a = @$k{$k2};
                                        foreach my $k3 (@$a) {
                                                $memberhash{$key} .= $k3." ";
                                        }
                                }
                        }
                }
                #
                # BUILD %borrower to CREATE or MODIFY BORROWER
                # change $memberhash{'xxx'} to fit your ldap structure.
                # check twice that mandatory fields are correctly filled
                #
                my %borrower;
                $borrower{cardnumber} = $userid;
                $borrower{firstname} = $memberhash{givenName}; # MANDATORY FIELD
                $borrower{surname} = $memberhash{sn}; # MANDATORY FIELD
                $borrower{initials} = substr($borrower{firstname},0,1).substr($borrower{surname},0,1)."  "; # MANDATORY FIELD
                $borrower{streetaddress} = $memberhash{homePostalAddress}." "; # MANDATORY FIELD
                $borrower{city} = $memberhash{l}." "; # MANDATORY FIELD
                $borrower{phone} = $memberhash{homePhone}." "; # MANDATORY FIELD
                $borrower{branchcode} = $memberhash{businessCategory}; # MANDATORY FIELD
                $borrower{emailaddress} = $memberhash{mail};
                $borrower{categorycode} = $memberhash{employeeType};
        ##################################################
        ### /LOCAL
        ### No change needed after this line (unless there's a bug ;-) )
        ##################################################

This works for passwords stored in LDAP that use MD5 or SMD5. I imagine it will work for other hashing mechanisms also.

For testing the LDAP password, I needed to patch this code to not do an anonymous bind. I don't use the compare() function. I just do:

        my $res =$db->bind( "uid=$userid,$name",password => $password);
        # check connexion
        if($res->code) {
                # auth refused
                #warn "LDAP Auth: not binded";
                return 0;
                }