- otrs - OTRS mailing lists

Using multiple LDAP's for authenticating customers in one database.
by Marty Hillman 29 Aug '13

29 Aug '13

Yes Gerald, as well as appending that index key to each of the fields within each Auth entry. That was the detail that was inconsistent in the examples I found through Google. Let me provide an edited copy of my configuration to help clarify. I changed the subject line to better match my particular scenario. If any of the information is unclear, feel free to drop me a line. Requirements To build an OTRS system that validates agents in one domain, but allows customers from two separate Active Directory domains without modifying domain trusts. Users should be able to log in with either set of credentials. Description The below code has particular information one should pay attention to. The source of this code go into /opt/otrs/Kernel/Config.pm. In the code below, I am using Domain1 and Domain2. Customers are in either domain, but Agents are only in Domain1 in one particular OU. An LDAP inquiry user is configured in each domain. Also note that the variables within the secondary LDAP calls also have the index appended to them. For example, Notice the change to Host1 below. $Self->{'Customer::AuthModule1'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host1'} = 'dc.domain2.com'; Whereas, in Customer::AuthModule, the variable is referred to as Customer::AuthModule::LDAP::Host. I also had other issues with making the LDAP calls, so instead of using the DN of the LDAP user, I used the simple email address. It is also easier to type and maintain, leaving me able to restructure Active Directory without breaking authentication. By structuring it at the root level of the LDAP tree, all users in either domain are allowed as customers using single sign-on. I should clarify the definition of single sign-on is not the same as automatic login based on the credentials of the logged in user. It merely means that the same credentials used to log in to Windows will log you in to the support site. The user will still need to enter these to gain access to the site. I have not found a solution to auto-login as of yet. Code # ---------------------------------------------------- # # LDAP Configuration Settings for Agents - Domain 1 # # ---------------------------------------------------- # $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = 'dc.domain1.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Controllers,dc=domain1,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'ldapuser(a)domain1.com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = '************'; $Self->{'AuthModule::LDAP::GroupDN'} = 'ou=Agents,dc=domain1,dc=com'; $Self->{'AuthModule::LDAP::UserAttr'} = 'DN'; $Self->{'AuthModule::LDAP::AccessAttr'} = 'member'; $Self->{'AuthModule::LDAP::Params'} = { port => 389, timeout => 120, async => 0, version => 3, sscope => 'sub', }; # ---------------------------------------------------- # # User Configurations - Domain 1 # # ---------------------------------------------------- # $Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP'; $Self->{'AuthSyncModule::LDAP::Host'} = 'dc.domain1.com'; $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=domain1,dc=com'; $Self->{'AuthSyncModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN'; $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'member'; $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'ldapuser(a)domain1.com'; $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = '************'; $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = { UserFirstname => 'givenName', UserLastname => 'sn', UserEmail => 'mail', }; $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [ 'users', ]; # ---------------------------------------------------- # # User Configurations - Domain 1 # # ---------------------------------------------------- # $Self->{'AuthSyncModule1'} = 'Kernel::System::Auth::Sync::LDAP'; $Self->{'AuthSyncModule::LDAP::Host1'} = 'dc.domain2.com'; $Self->{'AuthSyncModule::LDAP::BaseDN1'} = 'dc=domain2,dc=com'; $Self->{'AuthSyncModule::LDAP::UID1'} = 'sAMAccountName'; $Self->{'AuthSyncModule::LDAP::UserAttr1'} = 'DN'; $Self->{'AuthSyncModule::LDAP::AccessAttr1'} = 'member'; $Self->{'AuthSyncModule::LDAP::SearchUserDN1'} = 'ldapuser(a)domain2.com'; $Self->{'AuthSyncModule::LDAP::SearchUserPw1'} = '************'; $Self->{'AuthSyncModule::LDAP::UserSyncMap1'} = { UserFirstname => 'givenName', UserLastname => 'sn', UserEmail => 'mail', }; $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [ 'users', ]; # ---------------------------------------------------- # # LDAP Configuration Settings for Domain 1 Customers # # ---------------------------------------------------- # $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = 'dc.domain1.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=domain1,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN'; $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'member'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'ldapuser(a)domain1.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '************'; $Self->{'Customer::AuthModule::LDAP::Params'} = { port => 389, timeout => 120, async => 0, version => 3, }; $Self->{CustomerUser} = { Name => 'LDAP Backend', Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'dc.domain1.com', BaseDN => 'DC=domain1,DC=com', SSCOPE => 'sub', UserDN => 'ldapuser(a)domain1.com', UserPw => '************', AlwaysFilter => '(objectclass=user)', SourceCharset => 'utf-8', DestCharset => 'utf-8', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'givenname', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], CustomerUserExcludePrimaryCustomerID => 0, AdminSetPreferences => 0, CacheTTL => 0, Map => [ [ 'UserTitle', 'Title', 'title', 1, 0, 'var', '', 0 ], [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var', '', 0 ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var', '', 0 ], [ 'UserLogin', 'Username', 'sAMAccountName', 1, 1, 'var', '', 0 ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var', '', 0 ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var', '', 0 ], [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var', '', 0 ], [ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var', '', 0 ], [ 'UserComment', 'Comment', 'description', 1, 0, 'var', '', 0 ], ], }; # ---------------------------------------------------- # # LDAP Configuration Settings for Domain 2 Customers # # ---------------------------------------------------- # $Self->{'Customer::AuthModule1'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host1'} = 'dc.domain2.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN1'} = 'dc=domain2,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID1'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::UserAttr1'} = 'DN'; $Self->{'Customer::AuthModule::LDAP::AccessAttr1'} = 'member'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN1'} = 'ldapuser(a)domain2.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw1'} = '************'; $Self->{'Customer::AuthModule::LDAP::Params1'} = { port => 389, timeout => 120, async => 0, version => 3, }; $Self->{CustomerUser1} = { Name => 'LDAP Backend1', Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'dc.domain2.com', BaseDN => 'DC=domain2,DC=com', SSCOPE => 'sub', UserDN => 'ldapuser(a)domain2.com', UserPw => '************', AlwaysFilter => '(objectclass=user)', SourceCharset => 'utf-8', DestCharset => 'utf-8', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'givenname', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], CustomerUserExcludePrimaryCustomerID => 0, AdminSetPreferences => 0, CacheTTL => 0, Map => [ [ 'UserTitle', 'Title', 'title', 1, 0, 'var', '', 0 ], [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var', '', 0 ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var', '', 0 ], [ 'UserLogin', 'Username', 'sAMAccountName', 1, 1, 'var', '', 0 ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var', '', 0 ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var', '', 0 ], [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var', '', 0 ], [ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var', '', 0 ], [ 'UserComment', 'Comment', 'description', 1, 0, 'var', '', 0 ], ], }; From: Gerald Young [mailto:crythias@gmail.com] Sent: Thursday, August 29, 2013 8:34 AM To: User questions and discussions about OTRS. Subject: Re: [otrs] Using multiple databases as external backend? The docs don't explicitly state this but the concept has been validated in practice and in the code. I realize this is a "take my word for it" thing, but it's pretty much as simple as appending a different index/number to each key of a separate set of Auth entries. On Thu, Aug 29, 2013 at 7:54 AM, Marty Hillman <mhillman(a)equuscs.com<mailto:mhillman@equuscs.com>> wrote: Good morning Gerald - Can you point to a source for this? I need to authenticate against two AD's using LDAP. I believe it is as simple as using the existing AuthModule and then adding AuthModule1 below it. I am looking for confirmation. From: Gerald Young [mailto:crythias@gmail.com<mailto:crythias@gmail.com>] Sent: Thursday, August 29, 2013 6:27 AM Customers, Companies, and Users (Agents) all can authenticate (Auth) and have demographics (Sync|CustomerUser/Map) at up to 11 different sources ('', 1 ..10) (a blank "index" counts as one of them). On Thu, Aug 29, 2013 at 6:38 AM, Bogdan Iosif <bogdan.iosif(a)gmail.com<mailto:bogdan.iosif@gmail.com>> wrote: "you can use one Company Backend" I take it to mean you can only use one backend for agents. Can anyone else confirm this please? I'm interested to know if I can use both DB and LDAP for agents. On Thu, Aug 29, 2013 at 10:47 AM, Florian Edlhuber <florian.edlhuber(a)gmx.de<mailto:florian.edlhuber@gmx.de>> wrote: Hi, it is in http://doc.otrs.org/3.2/en/html/external-backends.html#multiple-customer-ba… You can use up to 10 Customer Information backends. But IIRC you can use one Company Backend. Ciao Flo 29.08.2013 09:42 - Stefan Michael Guenther schrieb: Hello, am I right in assuming, that it is only possible to have ONE external customer user backend, but not more? One of our clients has bought another company and if it is not possible to connect both customer databases to OTRS, we would have to find a way to merge the two database into an internal customer database for OTRS. Regards, Stefan --------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs --------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs --------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs --------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs

1 0

Using multiple databases as external backend?
by Stefan Michael Guenther 29 Aug '13

29 Aug '13

Hello, am I right in assuming, that it is only possible to have ONE external customer user backend, but not more? One of our clients has bought another company and if it is not possible to connect both customer databases to OTRS, we would have to find a way to merge the two database into an internal customer database for OTRS. Regards, Stefan

8 17

'Ticket Commands'
by haynes.davis＠accenture.com 29 Aug '13

29 Aug '13

Hi, What are the valid values possible in 'Ticket Commands' while creating a job in 'Generic Agent'. Can we run bash scripts using this feature? I was looking to run some custom scripts while closing a ticket. Is this possible? Your help is appreciated. regards, Haynes Davis ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

3 5

Re: [otrs] Using multiple databases as external backend?
by Stefan Michael Guenther 29 Aug '13

29 Aug '13

Hi, > you can use more than one backend: See > http://doc.otrs.org/3.2/en/html/external-backends.html#customer-data > (section "Using more than one customer backend with OTRS") > sorry, I did not scroll down far enough :-( Stefan

1 0

How to debug LDAP
by Marty Hillman 27 Aug '13

27 Aug '13

Anyone know how to debug LDAP configurations? I had it all configured, but my network administrator decided to reorganize Active Directory and move everything around in new OUs. I changed the strings in Config.pm to point to the new DN, but it is still not allowing logins and shows Login Failed. Trying to figure out what log files I can look at or how to manually test to get an actual error rather than a failed login. Marty Hillman - IT Manager of Network Infrastructure [cid:image001.png@01CEA336.6AABF9A0] 5801 Clearwater Drive, Minnetonka, MN 55343 P 612.617.4333 | E mhillman(a)equuscs.com<mailto:mhillman@equuscs.com>

2 4

Forgot password mechanism doesn't send email.
by Stephen Martin 27 Aug '13

27 Aug '13

Hi All, Having a strange issue, quite a new install of OTRS have never had chance to see if this was working earlier and broke or just never worked but it seems that when a user uses the forgot password link on the cutomer portal login page they never receive an email. I checked this and indeed there is no email sent by OTRS I cannot see one being queued in the postfix log and nothing logged in OTRS's log, All other mail out of OTRS is working perfectly. I was running OTRS helpdesk 3.2.8 on CentOS 6.4_x86 but just upgraded to 3.2.10 to see if this would fix but still get the same issue. Any ideas? Thanks, Steve.

1 1

Modifying the printed PDF document
by Stefan Michael Guenther 27 Aug '13

27 Aug '13

Hello, my intention is to modify the layout of the PDF, which is created when I click on "Print". The underlying link is http://192.168.56.2/otrs/index.pl?Action=AgentTicketPrint;TicketID=2;Articl…, but when I modify Kernel/Output/HTML/Standard/AgentTicketPrint.dtl it has no effect on the PDF Output. What am I doing wrong? Thanks for any hints or suggestions, Stefan

2 1

Perl SSL error is keeping me from loving OTRS
by jose.salviati＠accenture.com 26 Aug '13

26 Aug '13

I feel as if I have finally found the root cause of all my issues. I found this in the PerlEX log: Can someone tell me how to force Perl to not require SSL or configure OTRS to use it? I would much rather NOT use it, but finding the "off" switch in Perl has proven troublesome. As always, any assistance you can provide is very appreciated. *** 'C:\otrs\OTRS\bin\cgi-bin\index.pl<http://index.pl>' log message at: 2013/08/21 07:10:26 [Wed Aug 21 07:09:37 2013] -e: ******************************************************************* [Wed Aug 21 07:09:37 2013] -e: Using the default of SSL_verify_mode of SSL_VERIFY_NONE for client [Wed Aug 21 07:09:37 2013] -e: is deprecated! Please set SSL_verify_mode to SSL_VERIFY_PEER [Wed Aug 21 07:09:37 2013] -e: together with SSL_ca_file|SSL_ca_path for verification. [Wed Aug 21 07:09:37 2013] -e: If you really don't want to verify the certificate and keep the [Wed Aug 21 07:09:37 2013] -e: connection open to Man-In-The-Middle attacks please set [Wed Aug 21 07:09:37 2013] -e: SSL_verify_mode explicitly to SSL_VERIFY_NONE in your application. [Wed Aug 21 07:09:37 2013] -e: ******************************************************************* Jose Salviati [cid:image001.jpg@01CE9E56.E9A69E70] <sip:Jose.Salviati@Accenture.com> Technology Consulting | Workplace Technology & Collaboration Direct Dial: (310) 726-2835 Mobile: (949) 829-1028 Email: Jose.Salviati(a)Accenture.com<mailto:Jose.Salviati@Accenture.com> ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

4 7

after Perl module update get IMAPS connection error
by Stefan Sabolowitsch 23 Aug '13

23 Aug '13

Hi all, after perl module update (FreeBSD-9 p6) i get this error messages. Message: IMAPS: Can't connect to 192.168.1.48 Traceback (2330): Module: Kernel::System::MailAccount::IMAPS::_Fetch (v1.12) Line: 127 Module: Kernel::System::MailAccount::IMAPS::Fetch (v1.12) Line: 79 Module: Kernel::System::MailAccount::MailAccountFetch (v1.17) Line: 424 Module: main::Fetch (v1.4) Line: 180 Module: /usr/local/otrs/bin/otrs.PostMasterMailbox.pl (v1.4) Line: 93 In logfile Exchange 2010 find this: 2013-08-23T10:30:05.595Z,00000000000003AB,0,192.168.1.48:993,192.168.100.112:42374,,0,0,0,OpenSession,, this module was updated: p5-BerkeleyDB-0.52 < needs updating (index has 0.53) p5-CPAN-Meta-2.131560 < needs updating (index has 2.132140) p5-Compress-Raw-Bzip2-2.061 < needs updating (index has 2.062) p5-Compress-Raw-Zlib-2.061 < needs updating (index has 2.062) p5-Email-Address-1.89.8 < needs updating (index has 1.90.0) p5-Email-MIME-1.911 < needs updating (index has 1.922) p5-Email-MIME-Encodings-1.313 < needs updating (index has 1.314) p5-GD-2.49 < needs updating (index has 2.50) p5-GD-Graph-1.44.01_5 < needs updating (index has 1.48) p5-IO-Compress-2.061 < needs updating (index has 2.062) p5-IO-Socket-SSL-1.94 < needs updating (index has 1.953) p5-Module-CoreList-2.94 < needs updating (index has 2.97) p5-Module-Metadata-1.000011 < needs updating (index has 1.000014) p5-Net-IMAP-Simple-1.2200 < needs updating (index has 1.2201) p5-Text-CSV_XS-0.97 < needs updating (index has 1.01) p5-perl-ldap-0.5600 < needs updating (index has 0.5700) p5-version-0.99.02 < needs updating (index has 0.99.03) Any idea? Many thanks for any help. Stefan

1 0

Possible to see what templates that are used?
by Jean BROW 22 Aug '13

22 Aug '13

Hi, We use a lot of different templates in OTRS. Is it possible that the agent who work on a ticket could see info about what templates that have been sent out so far on the current ticket? Thanks.

2 2