[otrs] CustomerUserValidFilter usage (LDAP backend)

26 Aug 2007

      Hi:

I'm trying to configure OTRS 2.2.2 so it uses a customer LDAP backend.  
Currently clients authenticate against OpenLDAP just fine, but I'm having 
problems defining who are valid users since I take them out of my company's 
white pages (which, of course, have a ton of entries that are *not* customer 
users).

Authentication is managed by means of a posix group, and just works OK like 
this:

  $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
  $Self->{'Customer::AuthModule::LDAP::Host'} = 'server.example.com';
  $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
  $Self->{'Customer::AuthModule::LDAP::UID'} = 'uid';
  $Self->{'Customer::AuthModule::LDAP::GroupDN'} 
=  'cn=supportclients,ou=groups,dc=example,dc=com';
  $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
  $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';

And then, customer data, which is the problematic part:

  $Self->{CustomerUser} = {
    Name => 'LDAP Backend',
    Module => 'Kernel::System::CustomerUser::LDAP',
    Params => {
      Host => 'server.example.com',
      BaseDN => 'dc=example,dc=com',
      SSCOPE => 'sub',
      Die => 1,
    },
    CustomerKey => 'uid',
    CustomerID => 'o',
#  CustomerUserValidFilter => '(!(description=gesperrt))',
#  CustomerUserValidFilter => '',
(...)

This, of course, shows *every* user in the directory as client (for instance 
at Admin->Clients within the web interface).  I think I should create 
a "CustomerUserValidFilter" so only those users that belong to the 
supportclients group are listed (those whose Uid is listed on the memberUid 
attribute from the cn=supportclients,ou=groups,dc=example,dc=com group) but 
I'm lost regarding how can it be done or what's the sintax the 
CustomerUserValidFilter param expects.

Any suggestion?
TIA
-- 
Jesús M. Navarro
Jefe de Sistemas y Soporte
Ándago Ingeniería - www.andago.com

Teléfono: +34 916 011 373 (ext. 29)
Móvil: +34 666 431 088
e-mail: jesus.navarro@andago.com