Hallo Andreas,
wir haben ADS auf 2003,
Hier die Config.pm:
# --------------------------------------------------- #
# LDAP authentication for Agent
# --------------------------------------------------- #
$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = 'LNSDCDEES1';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=xyz,dc=,dc=com';
$Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';
$Self->{'AuthModule::LDAP::Params'} = {
#port => 3268,
port => 389,
version => 3,
scope => 'sub',
};
# Parameter wurde erweitert von maibaum
# Wird ben igt, damit Name in Agentliste angezeigt wird
$Self->{DatabaseUserTableUserName} = 'last_name';
# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
$Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=otrsuser,cn=users,dc=xyz,dc=com';
$Self->{'AuthModule::LDAP::SearchUserPw'} = 'passwort';
# Parameter wurde erweiter von Michael Teuber
# Pruefen ob ADS-User Berechtigt ist sich als OTRS-Agent anzumelden
# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
$Self->{'AuthModule::LDAP::GroupDN'} = 'cn=dl_OTRSAgentsNK,ou=PERMGROUPS,ou=BER_E,ou=Standard,ou=Neunkirchen,dc=xyz,dc=com';
#$Self->{'AuthModule::LDAP::GroupDN'} = 'OTRSAgentsNK';
#$Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
$Self->{'AuthModule::LDAP::AccessAttr'} = 'member';
#$Self->{'AuthModule::LDAP::UserAttr'} = 'UID';
# $Self->{'AuthModule::LDAP::UserAttr'} = 'member';
$Self->{'AuthModule::LDAP::UserAttr'} = 'DN';
# --------------------------------------------------- #
# LDAP Kundenbenutzer Daten
# --------------------------------------------------- #
$Self->{CustomerUser} = {
Module => 'Kernel::System::CustomerUser::LDAP',
Params => {
# ldap host
Host => 'LE1SDCEBER2.xyz.com',
# ldap base dn
BaseDN => 'DC=xyz,DC=com',
# search scope (one|sub)
SSCOPE => 'sub',
AlwaysFilter => '(&(objectClass=Person)(!(objectClass=Computer))(!(objectClass=publicFolder)))',
# The following is valid but would only be necessary if the
# anonymous user does NOT have permission to read from the LDAP tree
#
# Dummy User ohne Rechte
#
UserDN => 'CN=otrsuser,CN=Users,DC=xyz,DC=com',
UserPw => 'passwort',
Params => {
port => 3268,
version => 3,
},
UserSearchListLimit => 150,
},
# customer uniq id
CustomerKey => 'sAMAccountName',
# customer #
CustomerID => 'sAMAccountName',
# CustomerUserListFields => ['login', 'first_name', 'last_name', 'customer_id', 'email','Kst','UserPhone','UserComment','UserCity'],
CustomerUserListFields => ['mail'],
CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],
CustomerUserPostMasterSearchFields => ['mail'],
CustomerUserNameFields => ['givenname', 'sn'],
Map => [
# note: Login, Email and CustomerID needed!
# var, frontend, storage, shown, required, storage-type
[ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],
[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
[ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
[ 'UserCustomerID', 'CustomerID', 'sAMAccountName', 0, 1, 'var' ],
[ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],
[ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],
[ 'UserComment', 'Abteilung', 'department', 1, 0, 'var' ],
[ 'UserCity', 'City', 'extensionAttribute1', 1, 0, 'var' ],
[ 'Kst', 'Kostenstelle', 'extensionAttribute2', 1, 0, 'var' ],
],
};
============================================================================
Hier noch ein Auszug aus einen "ldapsearch" von der Linux-Kiste (auf dem das OTRS läuft) gegen die ADS:
oldschlapor:/opt/otrs/Kernel # ldapsearch -Hldap://x.x.x.x -b "dc=xyz,dc=com" "(&(objectclass=Group) (cn=dl_OTRSAgentsNK))" -x -W -Ddees\\Administrator
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base
May 11 09:31:43 oldschlapor OTRS-CGI-10[25256]: [Notice][Kernel::System::Auth::LDAP::Auth] User: n05027 authentication failed, no LDAP group entry found GroupDN='cn=OTRSAgentsNK,ou=PERMGROUPS,ou=BER_E,ou=Standard,ou=Neunkirchen,dc=xyz,dc=com', Result='Net::LDAP::Search=HASH(0x9a130a0)'
Filter='(member=CN=Teuber\, Michael,OU=USER,OU=BER_E,OU=Standard,OU=Neunkirchen,DC=xyz,DC=com)'! (REMOTE_ADDR: 10.101.1.254).
Welche Windows-Version verwendet Ihr? 2000, 2003? Der GroupDN stimmt auch komplett? Sind im Gruppen-Namen vielleicht Blanks enthalten (ist der CN!) Poste mal bitte die Config für die User-Authentifizierung noch dazu. Gruß Andreas -- Andreas Rothlauf OpenBC: https://www.openbc.com/hp/Andreas_Rothlauf/ _______________________________________________ OTRS Mailingliste: otrs-de - Webpage: http://otrs.org/ Archiv: http://lists.otrs.org/pipermail/otrs-de/ Listenabo verwalten: http://lists.otrs.org/cgi-bin/listinfo/otrs-de/ Support oder Consulting fuer Ihr OTRS System? =http://www.otrs.de/