Just replying to myself as an update..   this configuration does allow the listing of customers and have added filter of<div> AlwaysFilter =&gt; &#39;(objectclass=person)&#39;,<div><br></div><div>Auth still problematic for me - any pointers as to where I am going wrong?</div>

<div><br></div><div>W</div><div><br><br><div class="gmail_quote">2009/11/19 William Hamilton <span dir="ltr">&lt;<a href="mailto:william.hamilton@gmail.com">william.hamilton@gmail.com</a>&gt;</span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

Hi we have LAM (LDAP Account Manager) installed on a box which is used to authenticate a Samba server.  I want to use this server to hold OTRS auth and user details for internal company.   I am not sure how much LAM differs from AD (which most of the docs seems to point to).<div>


<br></div><div>I am not getting any authentication happening nor able to list users (using root@localhost login).   Anyone else using LAM?</div><div><br></div><div>tia</div><div><br></div><div>W<br><div><br><div><br></div>


<div>Setup</div><div>Debian (Stable LDAP server and Testing OTRS server)</div><div>LAM 2.3.0</div><div><br></div><div>Config.pm entries looks like below</div><div><div><div>############ Customer stuff (staff)  ###############</div>


<div> # CustomerUser</div><div>    # (customer user ldap backend and settings)</div><div>    $Self-&gt;{CustomerUser} = {</div><div>        Name =&gt; &#39;LDAP Data source&#39;,</div><div>        Module =&gt; &#39;Kernel::System::CustomerUser::LDAP&#39;,</div>


<div>        Params =&gt; {</div><div>            Host =&gt; &#39;ldapserver&#39;,</div><div>            BaseDN =&gt; &#39;dc=xxxx,dc=com&#39;,</div><div>            SSCOPE =&gt; &#39;sub&#39;,</div><div>            UserDN =&gt; &#39;&#39;,</div>


<div>            UserPw =&gt; &#39;&#39;,</div><div>            AlwaysFilter =&gt; &#39;&#39;,</div><div>#            SourceCharset =&gt; &#39;utf-8&#39;,</div><div>#            DestCharset =&gt; &#39;iso-8859-1&#39;,</div>


<div>            # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)</div><div>            Params =&gt; {</div><div>                port =&gt; 389,</div><div>                timeout =&gt; 120,</div><div>


                async =&gt; 0,</div><div>                version =&gt; 3,</div><div>            },</div><div>        },</div><div>        # customer uniq id</div><div>        CustomerKey =&gt; &#39;uid&#39;,</div><div>        # customer #</div>


<div>        CustomerID =&gt; &#39;mail&#39;,</div><div>        CustomerUserListFields =&gt; [&#39;cn&#39;, &#39;mail&#39;],</div><div>        CustomerUserSearchFields =&gt; [&#39;uid&#39;, &#39;cn&#39;, &#39;mail&#39;],</div>


<div>        CustomerUserSearchPrefix =&gt; &#39;&#39;,</div><div>        CustomerUserSearchSuffix =&gt; &#39;*&#39;,</div><div>        CustomerUserSearchListLimit =&gt; 250,</div><div>        CustomerUserPostMasterSearchFields =&gt; [&#39;mail&#39;],</div>


<div>        CustomerUserNameFields =&gt; [&#39;givenname&#39;, &#39;sn&#39;],</div><div>        # show now own tickets in customer panel, CompanyTickets</div><div>        CustomerUserExcludePrimaryCustomerID =&gt; 0,</div>


<div>        # add a ldap filter for valid users (expert setting)</div><div>#       CustomerUserValidFilter =&gt; &#39;(!(description=gesperrt))&#39;,</div><div>        # admin can&#39;t change customer preferences</div>

<div>
        AdminSetPreferences =&gt; 0,</div><div>        Map =&gt; [</div><div>            # note: Login, Email and CustomerID needed!</div><div>            # var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly</div>


<div>            [ &#39;UserSalutation&#39;, &#39;Title&#39;,      &#39;title&#39;,           1, 0, &#39;var&#39;, &#39;&#39;, 0 ],</div><div>            [ &#39;UserFirstname&#39;,  &#39;Firstname&#39;,  &#39;givenname&#39;,       1, 1, &#39;var&#39;, &#39;&#39;, 0 ],</div>


<div>            [ &#39;UserLastname&#39;,   &#39;Lastname&#39;,   &#39;sn&#39;,              1, 1, &#39;var&#39;, &#39;&#39;, 0 ],</div><div>            [ &#39;UserLogin&#39;,      &#39;Username&#39;,   &#39;uid&#39;,             1, 1, &#39;var&#39;, &#39;&#39;, 0 ],</div>


<div>            [ &#39;UserEmail&#39;,      &#39;Email&#39;,      &#39;mail&#39;,            1, 1, &#39;var&#39;, &#39;&#39;, 0 ],</div><div>            [ &#39;UserCustomerID&#39;, &#39;CustomerID&#39;, &#39;mail&#39;,            0, 1, &#39;var&#39;, &#39;&#39;, 0 ],</div>


<div>#            [ &#39;UserCustomerIDs&#39;, &#39;CustomerIDs&#39;, &#39;second_customer_ids&#39;, 1, 0, &#39;var&#39;, &#39;&#39;, 0 ],</div><div>            [ &#39;UserPhone&#39;,      &#39;Phone&#39;,      &#39;telephonenumber&#39;, 1, 0, &#39;var&#39;, &#39;&#39;, 0 ],</div>


<div>            [ &#39;UserAddress&#39;,    &#39;Address&#39;,    &#39;postaladdress&#39;,   1, 0, &#39;var&#39;, &#39;&#39;, 0 ],</div><div>            [ &#39;UserComment&#39;,    &#39;Comment&#39;,    &#39;description&#39;,     1, 0, &#39;var&#39;, &#39;&#39;, 0 ],</div>


<div>        ],</div><div>    };</div><div><br></div><div><br></div><div><div>#############  Auth customer folk (staff)  ##############</div><div>    # (take care that Net::LDAP is installed!)</div><div>     $Self-&gt;{&#39;Customer::AuthModule&#39;} = &#39;Kernel::System::CustomerAuth::LDAP&#39;;</div>


<div>     $Self-&gt;{&#39;Customer::AuthModule::LDAP::Host&#39;} = &#39;ldapserver&#39;;</div><div>     $Self-&gt;{&#39;Customer::AuthModule::LDAP::BaseDN&#39;} = &#39;dc=xxxx,dc=com&#39;;</div><div>     $Self-&gt;{&#39;Customer::AuthModule::LDAP::UID&#39;} = &#39;uid&#39;;</div>


<div><br></div><div>    # Check if the user is allowed to auth in a posixGroup</div><div>    # (e. g. user needs to be in a group xyz to use otrs)</div><div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::GroupDN&#39;} = &#39;cn=1gstaff,ou=Groups,dc=xxxx,dc=com&#39;;</div>


<div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::AccessAttr&#39;} = &#39;memberUid&#39;;</div><div>    # for ldap posixGroups objectclass (just uid)</div><div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::UserAttr&#39;} = &#39;uid&#39;;</div>


<div>    # for non ldap posixGroups objectclass (full user dn)</div><div>#    $Self-&gt;{&#39;Customer::AuthModule::LDAP::UserAttr&#39;} = &#39;DN&#39;;</div><div><br></div><div>    # The following is valid but would only be necessary if the</div>


<div>    # anonymous user do NOT have permission to read from the LDAP tree</div><div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::SearchUserDN&#39;} = &#39;&#39;;</div><div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::SearchUserPw&#39;} = &#39;&#39;;</div>


<div><br></div><div>    # in case you want to add always one filter to each ldap query, use</div><div>    # this option. e. g. AlwaysFilter =&gt; &#39;(mail=*)&#39; or AlwaysFilter =&gt; &#39;(objectclass=user)&#39;</div>


<div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::AlwaysFilter&#39;} = &#39;&#39;;</div><div><br></div><div>    # in case you want to add a suffix to each customer login name, then</div><div>    # you can use this option. e. g. user just want to use user but</div>


<div>    # in your ldap directory exists user@domain.</div><div>#    $Self-&gt;{&#39;Customer::AuthModule::LDAP::UserSuffix&#39;} = &#39;@<a href="http://domain.com" target="_blank">domain.com</a>&#39;;</div><div><br></div>

<div>    # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)</div>
<div>    $Self-&gt;{&#39;Customer::AuthModule::LDAP::Params&#39;} = {</div><div>        port =&gt; 389,</div><div>        timeout =&gt; 120,</div><div>        async =&gt; 0,</div><div>        version =&gt; 3,</div><div>    };</div>


<div><br></div><div><div>#############  Auth support folk (1gtech)  ##############</div><div>    # (take care that Net::LDAP is installed!)</div><div>    $Self-&gt;{&#39;AuthModule&#39;} = &#39;Kernel::System::Auth::LDAP&#39;;</div>


<div>    $Self-&gt;{&#39;AuthModule::LDAP::Host&#39;} = &#39;ldapserver&#39;;</div><div>    $Self-&gt;{&#39;AuthModule::LDAP::BaseDN&#39;} = &#39;dc=xxxx,dc=com&#39;;</div><div>    $Self-&gt;{&#39;AuthModule::LDAP::UID&#39;} = &#39;uid&#39;;</div>


<div><br></div><div>    # The following is valid but would only be necessary if the</div><div>    # anonymous user do NOT have permission to read from the LDAP tree</div><div>    $Self-&gt;{&#39;AuthModule::LDAP::SearchUserDN&#39;} = &#39;&#39;;</div>


<div>    $Self-&gt;{&#39;AuthModule::LDAP::SearchUserPw&#39;} = &#39;&#39;;</div><div><br></div><div>    # Check if the user is allowed to auth in a posixGroup</div><div>    # (e. g. user needs to be in a group xyz to use otrs)</div>


<div>    $Self-&gt;{&#39;AuthModule::LDAP::GroupDN&#39;} = &#39;cn=1gtech,ou=groups,dc=xxxx,dc=com&#39;;</div><div>    $Self-&gt;{&#39;AuthModule::LDAP::AccessAttr&#39;} = &#39;memberUid&#39;;</div><div>    # for ldap posixGroups objectclass (just uid)</div>


<div>    $Self-&gt;{&#39;AuthModule::LDAP::UserAttr&#39;} = &#39;UID&#39;;</div><div>    # for non ldap posixGroups objectclass (with full user dn)</div><div>    $Self-&gt;{&#39;AuthModule::LDAP::UserAttr&#39;} = &#39;DN&#39;;</div>


<div><br></div><div><br></div><div>    # in case you want to add always one filter to each ldap query, use</div><div>    # this option. e. g. AlwaysFilter =&gt; &#39;(mail=*)&#39; or AlwaysFilter =&gt; &#39;(objectclass=user)&#39;</div>


<div>    $Self-&gt;{&#39;AuthModule::LDAP::AlwaysFilter&#39;} = &#39;&#39;;</div><div><br></div><div>    # in case you want to add a suffix to each login name, then</div><div>    # you can use this option. e. g. user just want to use user but</div>


<div>    # in your ldap directory exists user@domain.</div><div>#    $Self-&gt;{&#39;AuthModule::LDAP::UserSuffix&#39;} = &#39;@<a href="http://domain.com" target="_blank">domain.com</a>&#39;;</div><div><br></div><div>    # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)</div>


<div>    $Self-&gt;{&#39;AuthModule::LDAP::Params&#39;} = {</div><div>        port =&gt; 389,</div><div>        timeout =&gt; 120,</div><div>        async =&gt; 0,</div><div>        version =&gt; 3,</div><div>    };</div>


<div><br></div><div>           # agent data sync against ldap</div><div>    $Self-&gt;{&#39;AuthSyncModule&#39;} = &#39;Kernel::System::Auth::Sync::LDAP&#39;;</div><div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::Host&#39;} = &#39;ldap://ldapserver/&#39;;</div>


<div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::BaseDN&#39;} = &#39;dc=xxxx,dc=com&#39;;</div><div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::UID&#39;} = &#39;uid&#39;;</div><div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::SearchUserDN&#39;} = &#39;&#39;;</div>


<div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::SearchUserPw&#39;} = &#39;&#39;;</div><div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::UserSyncMap&#39;} = {</div><div>        # DB -&gt; LDAP</div><div>        UserFirstname =&gt; &#39;givenName&#39;,</div>


<div>        UserLastname  =&gt; &#39;sn&#39;,</div><div>        UserEmail     =&gt; &#39;mail&#39;,</div><div>    };</div><div><br></div><div>    # AuthSyncModule::LDAP::UserSyncInitialGroups</div><div>    # (sync following group with rw permission after initial create of first agent</div>


<div>    # login)</div><div>    $Self-&gt;{&#39;AuthSyncModule::LDAP::UserSyncInitialGroups&#39;} = [</div><div>        &#39;users&#39;,</div><div>    ];</div><div><br></div></div></div></div></div><div><br></div></div></div>


</blockquote></div><br></div></div>