Hi Esteffano,
I share my setting lines with you, I have no problem with them and I work
for this environment. I have little experience with ldap but the error says
userid
$Self->{'AuthModule::LDAP::SearchUserDN'} = 'user@domain';
$Self->{'AuthModule::LDAP::SearchUserPw'} = passwd';
the rest of my changes are like yours. I do only login with the userid,
without domain.
Regards.
De: otrs-bounces@otrs.org [mailto:otrs-bounces@otrs.org] En nombre de
Stefano Ricci
Enviado el: martes, 10 de julio de 2012 08:29 a.m.
Para: User questions and discussions about OTRS.
Asunto: Re: [otrs] LDAP - Windows Server 2008 R2 - AD Object 2003
i talk for Customer... when you use only OTRS database, and remove the
register form, you have to add manualy the Customer (and if is the case, use
the Customer Company ID to aggregate the ticket of same company)...
afte you have to set the persmission of this customer on the differen
groups...
in my case i assign to a queue a group.... always the reference is 1 to
1.... now i assign the permission of sustomer for the group..
example:
* queue1 -> group1
* queue2 -> group2
* queue3 .> group3
now i associate the customer to a group and set the permission..
* group1 -> not associated
* group2 -> read and wite
* group3 -> not associated...
now if the customer login to the web interface or send email, can only
read/open tickets on queue2...
and if is included in a customer company can se the ticket of all company...
when i use Active directory to login i want to replicate the same idea.....
for example with agents is possible to map group in active directory with
roles in OTRS, and manage the permission in the admin console...
it's possible to do the same for customers?
now in the CONFIG.PM i have that:
# Enable LDAP lookups for Customer logins.
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = 'dcad101';
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=adone,dc=lan';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} =
'cn=otrs,cn=Users,dc=adone,dc=lan';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'a12345++';
$Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '';
$Self->{'Customer::AuthModule::LDAP::GroupDN'} =
'cn=OTRSCustomers,cn=Users,dc=adone,dc=lan';
$Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'member';
$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';
# Enable LDAP lookups for Customer account information.
$Self->{CustomerUser} = {
Module => 'Kernel::System::CustomerUser::LDAP',
Params => {
Host => 'dcad101',
BaseDN => 'dc=adone,dc=lan',
SSCOPE => 'sub',
UserDN => 'cn=otrs,cn=Users,dc=adone,dc=lan',
UserPw => 'a12345++',
AlwaysFilter => '',
GroupDN => 'cn=OTRSCustomers,cn=Users,dc=adone,dc=lan',
AccessAttr => 'memberUid',
UserAttr => 'UID',
},
CustomerKey => 'sAMAccountName',
#CustomerID => '[customer_id]',
CustomerID => 'sAMAccountName',
CustomerUserListFields => ['sAMAccountName', 'sn', 'givenname',
'company', 'mail'],
CustomerUserSearchFields => ['sAMAccountName', 'sn', 'givenname',
'company', 'mail'],
CustomerUserPostMasterSearchFields => ['mail'],
CustomerUserNameFields => ['givenname', 'sn'],
CustomerUserValidFilter => '(company=*)',
Map => [
[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
[ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
[ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],
[ 'UserCustomerID', 'CustomerID', 'company', 0, 1, 'var' ],
],
};
i can login the customer, but it can not write any ticket.... i think that
the default group for customer is user... but i disable all permission on
this group... because i want to have more group in function of
persimssion...
the second ask is related to incoming email filter.... if an email are not
in customer list, otrs ignore this... whit active directori, is the same?
the third ask is related to the use of more Active directory's.... and a way
do realize that....
for example if i have 3 customer company, i have to login user from
different domain..
a good idea is to support the login int this format "domain\user"... because
is possible that different company have equals user name...
now for single company i use how ID the user name (in active directory
sAMAccountName)... there is a variable of active directory that store in the
same string the full name "domain\user"?
thanks for the help
On 10 July 2012 14:46, Gerald Young