Re: [otrs] LDAP customer information

14 May 2013

      Hi Gerald,

Sorry I forgot to send this yesterday, here is a copy of the config.pm (obvious bits removed) 

Simon   

# --
# Kernel/Config.pm - Config file for OTRS kernel
# Copyright (C) 2001-2012 OTRS AG, http://otrs.org/
# --
# $Id: Config.pm.dist,v 1.27 2012/11/20 14:26:12 mh Exp $
# --
# This software comes with ABSOLUTELY NO WARRANTY. For details, see
# the enclosed file COPYING for license information (AGPL). If you
# did not receive this file, see http://www.gnu.org/licenses/agpl.txt.
# --
#  Note:
#
#  -->> OTRS does have a lot of config settings. For more settings
#       (Notifications, Ticket::ViewAccelerator, Ticket::NumberGenerator,
#       LDAP, PostMaster, Session, Preferences, ...) see
#       Kernel/Config/Defaults.pm and copy your wanted lines into "this"
#       config file. This file will not be changed on update!
#
# --

package Kernel::Config;

use utf8;

sub Load {
    my $Self = shift;
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
    #                                                      #
    #         Start of your own config options!!!          #
    #                                                      #
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #

    # ---------------------------------------------------- #
    # database settings                                    #
    # ---------------------------------------------------- #
    # DatabaseHost
    # (The database host.)
    $Self->{'DatabaseHost'} = 'localhost';
    # Database
    # (The database name.)
    $Self->{'Database'} = 'otrs';
    # DatabaseUser
    # (The database user.)
    $Self->{'DatabaseUser'} = 'otrs';
    # DatabasePw
    # (The password of database user. You also can use bin/otrs.CryptPassword.pl
    # for crypted passwords.)
    $Self->{'DatabasePw'} = '';
    # DatabaseDSN
    # (The database DSN for MySQL ==> more: "man DBD::mysql")
    $Self->{DatabaseDSN} = "DBI:mysql:database=$Self->{Database};host=$Self->{DatabaseHost};";

    # (The database DSN for PostgreSQL ==> more: "man DBD::Pg")
    # if you want to use a local socket connection
#    $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};";
    # if you want to use a tcpip connection
#    $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};host=$Self->{DatabaseHost};";
    # if you have PostgresSQL 8.1 or earlier, activate the legacy driver with this line:
#    $Self->{DatabasePostgresqlBefore82} = 1;

    # ---------------------------------------------------- #
    # fs root directory
    # ---------------------------------------------------- #
    $Self->{Home} = 'C:/PROGRA~1/OTRS/OTRS';

    # ---------------------------------------------------- #
    # insert your own config settings "here"               #
    # config settings taken from Kernel/Config/Defaults.pm #
    # ---------------------------------------------------- #
    # $Self->{SessionUseCookie} = 0;
    # $Self->{CheckMXRecord} = 0;

    # ---------------------------------------------------- #

    # ---------------------------------------------------- #
    # data inserted by installer                           #
    # ---------------------------------------------------- #

    $Self->{LogModule}          = 'Kernel::System::Log::File';
    $Self->{LogModule::LogFile} = 'C:/PROGRA~1/OTRS/OTRS/var/log/otrs.log';

# ---------------------------------------------------- #
    # LDAP Integration for .INTERNAL                  #
    # ---------------------------------------------------- #

    # Enable LDAP lookups for Agent logins. User must be a member of OTRS Agents group.
    $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
    $Self->{'AuthModule::LDAP::Host'} = '';
    $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=,dc=internal';
    $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';
    $Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=otrs,cn=Users,dc=,dc=internal';
    $Self->{'AuthModule::LDAP::SearchUserPw'} = '';
    $Self->{'AuthModule::LDAP::AlwaysFilter'} = '(objectclass=user)';
    $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=OTRSAllow,ou=Admin Groups,dc=,dc=internal';
    $Self->{'AuthModule::LDAP::AccessAttr'} = 'member';
    $Self->{'AuthModule::LDAP::UserAttr'} = 'DN';

    # Enable LDAP lookups of Agent account informations and default roles.
    $Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';
    $Self->{'AuthSyncModule::LDAP::Host'} = '';
    $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=,dc=internal';
    $Self->{'AuthSyncModule::LDAP::UID'} = 'sAMAccountName';
    $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'cn=otrs,cn=Users,dc=,dc=internal';
    $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = '';
    $Self->{'AuthSyncModule::LDAP::AlwaysFilter'} = '(objectclass=user)';
    $Self->{'AuthSyncModule::LDAP::GroupDN'} = 'cn=OTRSAllow,ou=Admin Groups,dc=,dc=internal';
    $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'member';
    $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN';
    $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
        UserFirstname => 'givenName',
        UserLastname  => 'sn',
        UserEmail     => 'mail',
    };

 $Self->{'AuthSyncModule::LDAP::UserSyncRolesDefinition'} = {
  'cn=OTRSAllow,cn=Admin Groups,dc=,dc=internal' => {
            'Company Agents' => 1,
        },
        'cn=Domain Admins,cn=Users,dc=,dc=internal' => {
            'Tech Support Agents' => 1,
        }
    };

	# defines AuthSyncBackend (AuthSyncModule) for AuthModule
# if this key exists and is empty, there won't be a sync.
# example values: AuthSyncBackend, AuthSyncBackend2
$Self->{'AuthModule::UseSyncBackend'} = 'AuthSyncBackend';

# agent data sync against ldap
$Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';
$Self->{'AuthSyncModule::LDAP::Host'} = '';
$Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=, dc=internal';
$Self->{'AuthSyncModule::LDAP::UID'} = 'sAMAccountName';
$Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'cn=otrs, cn=users, dc=, dc=internal';
$Self->{'AuthSyncModule::LDAP::SearchUserPw'} = '';
$Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
    # DB -> LDAP
    UserFirstname => 'givenName',
    UserLastname  => 'sn',
    UserEmail     => 'mail',
};

# AuthSyncModule::LDAP::UserSyncInitialGroups
# (sync following group with rw permission after initial create of first agent
# login)
$Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [
    'users',
];

# This is customer LDAP configuration for an LDAP auth. backend.
# (make sure Net::LDAP is installed!)
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = '';
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=,dc=internal';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';

# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
$Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'OU=SDC,OU=Establishments,DC=,DC=INTERNAL';
$Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'member';
# for ldap posixGroups objectclass (just uid)
#$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';
# for non ldap posixGroups objectclass (full user dn)
$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';

# The following is valid but would only be necessary if the
# anonymous user does NOT have permission to read from the LDAP tree
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=otrs,cn=Users,dc=,dc=internal';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '';

# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
$Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '(mail=*)';

# in case you want to add a suffix to each customer login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
#$Self->{'Customer::AuthModule::LDAP::UserSuffix'} = '@.internal';

# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
$Self->{'Customer::AuthModule::LDAP::Params'} = {
    port => 389,
    timeout => 120,
    async => 0,
    version => 3,
};

 # Enable LDAP lookups for Customer account information.
    $Self->{CustomerUser} = {
      Module => 'Kernel::System::CustomerUser::LDAP',
      Params => {
        Host => '',
        BaseDN => 'dc=,dc=internal',
        SSCOPE => 'sub',
        UserDN => 'cn=otrs,cn=Users,dc=,dc=internal',
        UserPw => '',
        AlwaysFilter => '(objectclass=user)',
        GroupDN => 'ou=SDC,ou=establishments,dc=,dc=internal',
#        GroupDN => 'cn=OTRS Customers,cn=Users,dc=,dc=internal',
        AccessAttr => 'member',
        UserAttr => 'DN',
      },

	  # customer uniq id
		CustomerKey => 'sAMAccountName',
		# customer #
		CustomerID => 'mail',
		CustomerUserListFields => ['givenname', 'sn', 'mail'],
		CustomerUserSearchFields =>
['displayName','sAMAccountName','givenname', 'sn',
'mail','description'],
		CustomerUserPostMasterSearchFields =>
['displayName','sAMAccountName','givenname','sn','mail','description'],
		CustomerUserNameFields => ['givenname', 'sn'],
		# show not own tickets in customer panel, CompanyTickets
    CustomerUserExcludePrimaryCustomerID => 0,
    # add an ldap filter for valid users (expert setting)
#    CustomerUserValidFilter => '(!(description=locked))',
    # administrator can't change customer preferences
    AdminSetPreferences => 0,
#    # cache time to live in sec. - cache any database queries
#CacheTTL => 0,
		Map => [
			# note: Login, Email and CustomerID needed!
			# var, frontend, storage, shown, required, storage-type
			[ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],
			[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
			[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
			[ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
			[ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],
			[ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],
			#[ 'UserCustomerIDs', 'CustomerIDs', 'wWWHomePage', 1, 0, 'var' ],
			[ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],
			[ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],
			[ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],
			],
	};

  #    CustomerKey => 'sAMAccountName',
   #   CustomerID => 'mail',
   #   CustomerUserListFields => ['sAMAccountName', 'sn', 'givenname', 'company',  'mail'],
   #   CustomerUserSearchFields => ['sAMAccountName', 'sn', 'givenname', 'company', 'mail'],
   #   CustomerUserPostMasterSearchFields => ['displayName','mail'],
    #  CustomerUserNameFields => ['givenname', 'sn'],
    #  Map => [
     #   [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],
     #   [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
   #     [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
    #    [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
    #    [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],
    #    [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],
    #    [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],
     #   [ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],
     #   [ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],
    #  ],
   # };

# Customer single sign on 
#$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::HTTPBasicAuth';

# This is an example configuration for an apache ($ENV{REMOTE_USER})
# auth. backend. Use it if you want to have a single login through
# apache http-basic-auth
#$Self->{'AuthModule'} = 'Kernel::System::Auth::HTTPBasicAuth';
#$Self->{'AuthModule::HTTPBasicAuth::Replace'} = '\\';

# Note:
#
# If you use this module, you should use as fallback
# the following configuration settings if the user is not authorized
# apache ($ENV{REMOTE_USER})
#$Self->{LoginURL} = 'http:///otrs/not-authorised-for-otrs.html';
#$Self->{LogoutURL} = 'http:///otrs/thanks-for-using-otrs.html';

    # $DIBI$
   # --------------------------------------------------- #
    #                                                     #
    #             Start of config options!!!              #
    #                 CustomerUser stuff                  #
    #                                                     #
    # --------------------------------------------------- #

    # CustomerUser
    # (customer user database backend and settings)
  #  $Self->{CustomerUser} = {
   #     Name   => 'Database Backend',
   #     Module => 'Kernel::System::CustomerUser::DB',
   #     Params => {
            # if you want to use an external database, add the
            # required settings
#            DSN => 'DBI:odbc:yourdsn',
#            DSN => 'DBI:mysql:database=customerdb;host=customerdbhost',
#            User => '',
#            Password => '',
    #        Table => 'customer_user',
            # if your frontend is unicode and the charset of your
            # customer database server is iso-8859-1, use these options.
#           SourceCharset => 'iso-8859-1',
#           DestCharset => 'utf-8',

            # CaseSensitive will control if the SQL statements need LOWER()
            #   function calls to work case insensitively. Setting this to
            #   1 will improve performance dramatically on large databases.
     #       CaseSensitive => 0,
     #   },

        # customer unique id
     #   CustomerKey => 'login',

        # customer #
     #   CustomerID             => 'customer_id',
      #  CustomerValid          => 'valid_id',
      #  CustomerUserListFields => [ 'first_name', 'last_name', 'email' ],

#        CustomerUserListFields => ['login', 'first_name', 'last_name', 'customer_id', 'email'],
      #  CustomerUserSearchFields           => [ 'login', 'first_name', 'last_name', 'customer_id' ],
       # CustomerUserSearchPrefix           => '*',
      #  CustomerUserSearchSuffix           => '*',
      #  CustomerUserSearchListLimit        => 250,
      #  CustomerUserPostMasterSearchFields => ['email'],
       # CustomerUserNameFields     => [ 'title', 'first_name', 'last_name' ],
       # CustomerUserEmailUniqCheck => 1,

#        # show now own tickets in customer panel, CompanyTickets
#        CustomerUserExcludePrimaryCustomerID => 0,
#        # generate auto logins
#        AutoLoginCreation => 0,
#        # generate auto login prefix
#        AutoLoginCreationPrefix => 'auto',
#        # admin can change customer preferences
#        AdminSetPreferences => 1,
#        # use customer company support (reference to company, See CustomerCompany settings)
#        CustomerCompanySupport => 1,
        # cache time to live in sec. - cache any database queries
       # CacheTTL => 60 * 60 * 24,
#        # just a read only source
#        ReadOnly => 1,
        #Map => [

            # note: Login, Email and CustomerID needed!
            # var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly, http-link-target, link class(es)
         #   [ 'UserTitle',      'Title',      'title',      1, 0, 'var', '', 0 ],
         #   [ 'UserFirstname',  'Firstname',  'first_name', 1, 1, 'var', '', 0 ],
         #   [ 'UserLastname',   'Lastname',   'last_name',  1, 1, 'var', '', 0 ],
         #   [ 'UserLogin',      'Username',   'login',      1, 1, 'var', '', 0 ],
          #  [ 'UserPassword',   'Password',   'pw',         0, 0, 'var', '', 0 ],
          #  [ 'UserEmail',      'Email',      'email',      1, 1, 'var', '', 0 ],

#            [ 'UserEmail',      'Email', 'email',           1, 1, 'var', '$Env{"CGIHandle"}?Action=AgentTicketCompose;ResponseID=1;TicketID=$Data{"TicketID"};ArticleID=$Data{"ArticleID"}', 0, '', 'AsPopup OTRSPopup_TicketAction' ],
          #  [ 'UserCustomerID', 'CustomerID', 'customer_id', 0, 1, 'var', '', 0 ],

#            [ 'UserCustomerIDs', 'CustomerIDs', 'customer_ids', 1, 0, 'var', '', 0 ],
          #  [ 'UserPhone',        'Phone',       'phone',        1, 0, 'var', '', 0 ],
          #  [ 'UserFax',          'Fax',         'fax',          1, 0, 'var', '', 0 ],
           # [ 'UserMobile',       'Mobile',      'mobile',       1, 0, 'var', '', 0 ],
			#[ 'UserRoom',       'Room',       'room',        1, 0, 'var', '', 0 ],
			#[ 'UserExtNo',       'ExtNo',       'ExtNo',        1, 0, 'var', '', 0 ],
           # [ 'UserStreet',       'Street',      'street',       1, 0, 'var', '', 0 ],
           # [ 'UserZip',          'Zip',         'zip',          1, 0, 'var', '', 0 ],
            #[ 'UserCity',         'City',        'city',         1, 0, 'var', '', 0 ],
            #[ 'UserCountry',      'Country',     'country',      1, 0, 'var', '', 0 ],
            #[ 'UserComment',      'Comment',     'comments',     1, 0, 'var', '', 0 ],
            #[ 'ValidID',          'Valid',       'valid_id',     0, 1, 'int', '', 0 ],

       # ],

        # default selections
        #Selections => {

#            UserTitle => {
#                'Mr.' => 'Mr.',
#                'Mrs.' => 'Mrs.',
#            },
        #},
   # };

    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
    #                                                      #
    #           End of your own config options!!!          #
    #                                                      #
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
}

# ---------------------------------------------------- #
# needed system stuff (don't edit this)                #
# ---------------------------------------------------- #
use strict;
use warnings;

use vars qw(@ISA $VERSION);
$VERSION = qw($Revision: 1.27 $)[1];

use Kernel::Config::Defaults;
push (@ISA, 'Kernel::Config::Defaults');

# -----------------------------------------------------#

1;

**********************************************************************
This message may contain privileged and confidential information.
It is intended solely for the person to whom it is addressed.
If you are not the intended recipient, please notify the sender and delete the message immediately. 

The text in this e-mail and any attachments should not be altered or tampered with in any way. 
Any views expressed in this message are those of the individual sender and do not necessarily 
reflect the views of South Downs College.
**********************************************************************

Re: [otrs] LDAP customer information

Simon Allison