A couple of ideas…
Password/user sync: I
think you can have it sync the users automatically as well:
# Create the users in the
OTRS DB on first login and populate user data.
# "givenName",
"sn" and "mail" fields MUST be
populated in AD/LDAP before login will work.
$Self->{UserSyncLDAPMap} = {
# DB
-> LDAP
UserFirstname => 'givenName',
UserLastname => 'sn',
UserEmail => 'mail',
};
Regarding child
domains, I’m not sure how this would be done as I’ve never tested this.
But I would think that one way to do it is to create yet another LDAP auth
section.
Just found this page,
sounds like a good explanation: http://faq.otrs.org/otrs/public.pl?Action=PublicFAQ&ItemID=219
(the sync above is
also mentioned there, also with multiple backends)
Your customer authentication
issue…
I see you have “CustomerKey => 'uid',”
in your config below.
In mine I have “CustomerKey => 'sAMAccountName',”.
It’s been a
while I’ve been digging in this, but I’m pretty sure I’ve
seen issues with this in the past.
Also, if you’re
using UPNs (<username>@<domain>) you
should be looking at the userPrincipalName attribute
instead, I think.
There may be a few
more spots in that section that are sensitive with regards to the attributes
used, especially the “Map =>”.
I also have a filter
on so I don’t get too much from the ldap query:
# We only need to see
users. !Computers. And no disabled
users.
AlwaysFilter =>
'(&(!(objectClass=Computer))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))',
Hope it helps.
--
/Sune T.
From:
otrs-bounces@otrs.org [mailto:otrs-bounces@otrs.org] On Behalf Of Dave Glue
Sent: 3. marts 2010 16:00
To: otrs@otrs.org
Subject: [otrs] LDAP integration
with child domains, LDAP with customer portal not working with any domain
I
have LDAP agent authentication working fine from a single domain (well,
password sync - agents still need to be created in the database first which as
I understand is normal behavior and don't have a problem with it), however not
sure how to proceed for child domains. Most of our agents and users are
in trusted child domains from the root forest. Documentation seems to be
a little sparse in dealing with this situation.
Regarding
customer authentication, even from testing from an account in the root forest
domain I have yet to get this working. I receive "Login failed! Your
username or password was entered incorrectly." when trying to login to a
customer portal from a verified AD account. I can select LDAP from the
drop-down in adding a customer from the web admin, but no current user in the
domain can log in. From what I've read there shouldn’t be a need to
have an internal account already created for the customer portal.
Here's
the relevant portion of my config.pm. My root domain is
testprod.com, GC controller is test-dc1.testprod.com. OTRS access account
is a member of domain users and builtin\Windows Authorization Access Group
Properties. Anything jump out as improperly configured?
Domain
is Server 2008 SP2.
#LDAP Authentication for Production Forest
#Agent Authentication
$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = 'test-dc1.testprod.com';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=testprod,dc=com';
$Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';
$Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS
Access,cn=Users,dc=testprod,dc=com';
$Self->{'AuthModule::LDAP::SearchUserPw'} = '*******!';
#LDAP
Authentication - Customer
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = 'test-dc1.testprod.com';
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=testprod,dc=com';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS
Access,cn=Users,dc=testprod,dc=com';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '********!';
#LDAP Getting Customer User Information
# CustomerUser
# (customer user ldap backend and settings)
$Self->{CustomerUser} = {
Name => 'LDAP Data Source',
Module =>
'Kernel::System::CustomerUser::LDAP',
Params => {
# ldap host
Host =>
'test-dc1.testprod.com',
# ldap base
dn
BaseDN =>
'dc=testprod,dc=com',
# search
scope (one|sub)
SSCOPE =>
'sub',
# # The
following is valid but would only be necessary if the
# # anonymous
user does NOT have permission to read from the LDAP tree
UserDN =>
'cn=OTRS Access,cn=Users,dc=testprod,dc=com',
UserPw =>
'********!',
# in case
you want to add always one filter to each ldap query, use
# this
option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter =>
'(objectclass=user)'
AlwaysFilter
=> '',
# if your
frontend is e. g. iso-8859-1 and the charset of your
# ldap
server is utf-8, use these options.
#
SourceCharset => 'utf-8',
# DestCharset
=> 'iso-8859-1',
# if both
your frontend and your LDAP are unicode, use this:
#
SourceCharset => 'utf-8',
#
DestCharset => 'utf-8',
# Net::LDAP
new params (if needed - for more info see perldoc Net::LDAP)
Params =>
{
port => 389,
timeout => 120,
async => 0,
version => 3,
},
},
# customer unique id
CustomerKey => 'uid',
# customer #
CustomerID => 'mail',
CustomerUserListFields => ['cn',
'mail'],
CustomerUserSearchFields =>
['uid', 'cn', 'mail'],
CustomerUserSearchPrefix => '',
CustomerUserSearchSuffix => '*',
CustomerUserSearchListLimit =>
250,
CustomerUserPostMasterSearchFields
=> ['mail'],
CustomerUserNameFields =>
['givenname', 'sn'],
# show not own tickets in customer
panel, CompanyTickets
CustomerUserExcludePrimaryCustomerID
=> 0,
# add an ldap filter for valid users
(expert setting)
# CustomerUserValidFilter =>
'(!(description=locked))',
# administrator can't change
customer preferences
AdminSetPreferences => 0,
# # cache time to live in sec. -
cache any database queries
# CacheTTL => 0,
Map => [
# note:
Login, Email and CustomerID are mandatory!
# var,
frontend, storage, shown (1=always,2=lite), required, storage-type, http-link,
readonly
[
'UserSalutation', 'Title',
'title', 1, 0,
'var', '', 0 ],
[
'UserFirstname', 'Firstname',
'givenname', 1, 1, 'var', '', 0 ],
[
'UserLastname', 'Lastname',
'sn',
1, 1, 'var', '', 0 ],
[
'UserLogin', 'Username',
'uid',
1, 1, 'var', '', 0 ],
[
'UserEmail',
'Email',
'mail', 1, 1,
'var', '', 0 ],
[
'UserCustomerID', 'CustomerID',
'mail', 0, 1,
'var', '', 0 ],
# [
'UserCustomerIDs', 'CustomerIDs', 'second_customer_ids', 1, 0, 'var', '', 0 ],
[
'UserPhone',
'Phone', 'telephonenumber', 1, 0, 'var', '', 0 ],
[
'UserAddress', 'Address',
'postaladdress', 1, 0, 'var', '', 0 ],
[
'UserComment', 'Comment',
'description', 1, 0, 'var', '', 0 ],
],
};