Edward, Thanks for the suggestion. I copied your configuration and now have both agents and customers successfully logging in with authentication against our AD server. Thanks!!! Robert On 9/24/07, Edward Kovarski wrote:

Robert,

I would suggest trying to simplify the configurations by removing the AlwaysFilter and specifying the root of your Active Directory as the BaseDN. Once it authenticates properly you can start customizing and narrowing the BaseDN scope.

Here is an excerpt from Config.pm which I just tested on our dev environment as we don't use the customer interface in production. It properly authenticated and pulled in all the proper values into OTRS...

# --- Customer --- $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = 'ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Customer,dc=ad,dc=groupkae,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'ldap@ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'ad.groupkae.com', BaseDN => 'ou=Customer,dc=ad,dc=groupkae,dc=com', SSCOPE => 'sub', UserDN =>'ldap@ad.groupkae.com', UserPw => 'password', },

CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ], ], };

On 24-Sep-07, at 10:42 AM, Robert Aldridge wrote:

...

Thanks for the suggestion, Edward. Changing the SearchUserDN to <username>@<domain> continues to work for the agent login. I still haven't been able to get the customer login working. Any hints? Here's my current LDAP portion of Config.pm:

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' ldapserver.domain.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'OTRS@domain.com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = '********';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' ldapserver.domain.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = ' OTRS@domain.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = '********';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' ldapserver.domain.com', BaseDN => 'ou=Group of Users,dc=domain,dc=com', SSCOPE => 'sub', AlwaysFilter => '(&(sAMAccountName=*)(mail=*))', UserDN => 'OTRS@domain.com', UserPW => '********', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ # note: Login, Email and CustomerID needed! # var, frontend, storage, shown, required, storage-type # [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ], [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

On 9/21/07, Edward Kovarski < edward.kovarski@groupkae.com> wrote: Robert,

You may also try <username>@<domain> which is the new Microsoft style for specifying users within domains. This is what we use in configuration...

Ed

On 21-Sep-07, at 2:48 PM, Robert Aldridge wrote:

...

Finally got it working...

I changed every entry of:

'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com';

to:

'tsteel\OTRS'

and, to pull user data to the local DB, I added:

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

Perhaps this will help someone else who's trying to set OTRS up with Microsoft Active Directory.

Thanks,

Robert Aldridge

On 9/21/07, Robert Aldridge < bamarob55@gmail.com> wrote: Hi folks,

First let me say that OTRS appears to be a great product! Kudos to the developers!

We are in the process of evaluating our options for a helpdesk/ trouble-ticket system. I would really like to give OTRS a good evaluation, but I'm having some problems. Our chosen solution must be able to authenticate users (both agents and customers) via Microsoft Active Directory. It appears that this is possible, but I've yet to have any success. I'll outline the steps I've taken and solicit any input from the community.

OTRS is working fine when authenticating against it's own database. Here's what I've done to try to authenticate against AD:

I edited Kernel/Config.pm and added:

<begin additions to Config.pm>

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' lincoln.tsteel.com ', BaseDN => 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', SSCOPE => 'sub', UserDN => 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', UserPW => 'password', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => 'sAMAccountName', 'cn', 'mail', CustomerUserSearchFields => 'sAMAccountName', 'cn', 'mail', CustomerUserPostMasterSearchFields => 'mail', CustomerUserNameFields => 'givenname', 'sn', Map => [ [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

<end additions to Config.pm>

On my AD box, I ran: ldifde -f users.ldf -d "OU=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com" -r ""

Which returned a listing of all users in the Tuscaloosa - Sheet Mill org unit. Within the users.ldf file (output from the above command), there's an entry for OTRS Admin:

<begin snippet from users.ldf>

dn: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: OTRS sn: Admin givenName: OTRS distinguishedName: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com instanceType: 4 whenCreated: 20070920125829.0Z whenChanged: 20070921135825.0Z displayName: OTRS uSNCreated: 8512826 uSNChanged: 8549454 name: OTRS objectGUID:: po7FpWyIxEWWQeiUc9XMwA== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 128347689772801250 lastLogoff: 0 lastLogon: 128347693211238750 pwdLastSet: 128347667099207500 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAApR5XA/l+DSsgfDsl4xwAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: OTRS sAMAccountType: 805306368 userPrincipalName: OTRS@tsteel.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=tsteel,DC=com dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921131751.0Z dSCorePropagationData: 16010108151056.0Z lastLogonTimestamp: 128347680934676250

<end snippet from users.ldf>

With this configuration, when I attempt to login as an agent using my username (which I know is valid in AD), it errors out with:

Login failed! Your username or password was entered incorrectly.

And, when I revert the Config.pm back (so I can log in) and check the system log, I see:

User: raldridge authentication failed, no LDAP entry found! BaseDN='ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', Filter='(sAMAccountName=raldridge)', (REMOTE_ADDR: 10.1.1.50).

Any help would be greatly appreciated.

Thanks,

Robert Aldridge

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

Mike, For Unix, as per http://doc.otrs.org/2.2/en/html/x354.html, you would need Net::LDAP. To install the module via CPAN, you'd type in: perl -MCPAN -e 'install Net::LDAP' or, alternatively some Unices allow: cpan Net::LDAP To answer your second question, you'd login via "username" or specifically the sAMAccountName LDAP attribute in Active Directory. Ed On 24-Sep-07, at 2:57 PM, Michael Holland wrote:

Robert and or anyone that can assist. 2 quick questions…

Do you have any instructions on how to install the correct PERL Ldap modules? When you login to OTRS do you use the username or domain\username?

Thanks for any help offered. I have been chasing this issue for well over a month.

Mike Holland

From: otrs-bounces@otrs.org [mailto:otrs-bounces@otrs.org] On Behalf Of Robert Aldridge Sent: Monday, September 24, 2007 11:43 AM To: User questions and discussions about OTRS.org Subject: Re: [otrs] Re: LDAP Authentication using Microsoft Active Directoryserver

Edward,

Thanks for the suggestion. I copied your configuration and now have both agents and customers successfully logging in with authentication against our AD server.

Thanks!!!

Robert

On 9/24/07, Edward Kovarski wrote:

Robert,

I would suggest trying to simplify the configurations by removing the AlwaysFilter and specifying the root of your Active Directory as the BaseDN. Once it authenticates properly you can start customizing and narrowing the BaseDN scope.

Here is an excerpt from Config.pm which I just tested on our dev environment as we don't use the customer interface in production. It properly authenticated and pulled in all the proper values into OTRS...

# --- Customer --- $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Customer,dc=ad,dc=groupkae,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'ldap@ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'ad.groupkae.com', BaseDN => 'ou=Customer,dc=ad,dc=groupkae,dc=com', SSCOPE => 'sub', UserDN =>'ldap@ad.groupkae.com', UserPw => 'password', },

CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ], ], };

On 24-Sep-07, at 10:42 AM, Robert Aldridge wrote:

...

Thanks for the suggestion, Edward. Changing the SearchUserDN to <username>@<domain> continues to work for the agent login. I still haven't been able to get the customer login working. Any hints? Here's my current LDAP portion of Config.pm:

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' ldapserver.domain.com '; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = ' OTRS@domain.com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = '********';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' ldapserver.domain.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = ' OTRS@domain.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = '********';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' ldapserver.domain.com', BaseDN => 'ou=Group of Users,dc=domain,dc=com', SSCOPE => 'sub', AlwaysFilter => '(&(sAMAccountName=*)(mail=*))', UserDN => 'OTRS@domain.com', UserPW => '********', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ # note: Login, Email and CustomerID needed! # var, frontend, storage, shown, required, storage-type # [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ], [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

On 9/21/07, Edward Kovarski < edward.kovarski@groupkae.com> wrote: Robert,

You may also try <username>@<domain> which is the new Microsoft style for specifying users within domains. This is what we use in configuration...

Ed

On 21-Sep-07, at 2:48 PM, Robert Aldridge wrote:

...

Finally got it working...

I changed every entry of:

'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com';

to:

'tsteel\OTRS'

and, to pull user data to the local DB, I added:

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

Perhaps this will help someone else who's trying to set OTRS up with Microsoft Active Directory.

Thanks,

Robert Aldridge

On 9/21/07, Robert Aldridge < bamarob55@gmail.com> wrote: Hi folks,

First let me say that OTRS appears to be a great product! Kudos to the developers!

We are in the process of evaluating our options for a helpdesk/ trouble-ticket system. I would really like to give OTRS a good evaluation, but I'm having some problems. Our chosen solution must be able to authenticate users (both agents and customers) via Microsoft Active Directory. It appears that this is possible, but I've yet to have any success. I'll outline the steps I've taken and solicit any input from the community.

OTRS is working fine when authenticating against it's own database. Here's what I've done to try to authenticate against AD:

I edited Kernel/Config.pm and added:

<begin additions to Config.pm>

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' lincoln.tsteel.com ', BaseDN => 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', SSCOPE => 'sub', UserDN => 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', UserPW => 'password', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => 'sAMAccountName', 'cn', 'mail', CustomerUserSearchFields => 'sAMAccountName', 'cn', 'mail', CustomerUserPostMasterSearchFields => 'mail', CustomerUserNameFields => 'givenname', 'sn', Map => [ [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

<end additions to Config.pm>

On my AD box, I ran: ldifde -f users.ldf -d "OU=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com" -r ""

Which returned a listing of all users in the Tuscaloosa - Sheet Mill org unit. Within the users.ldf file (output from the above command), there's an entry for OTRS Admin:

<begin snippet from users.ldf>

dn: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: OTRS sn: Admin givenName: OTRS distinguishedName: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com instanceType: 4 whenCreated: 20070920125829.0Z whenChanged: 20070921135825.0Z displayName: OTRS uSNCreated: 8512826 uSNChanged: 8549454 name: OTRS objectGUID:: po7FpWyIxEWWQeiUc9XMwA== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 128347689772801250 lastLogoff: 0 lastLogon: 128347693211238750 pwdLastSet: 128347667099207500 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAApR5XA/l+DSsgfDsl4xwAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: OTRS sAMAccountType: 805306368 userPrincipalName: OTRS@tsteel.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=tsteel,DC=com dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921131751.0Z dSCorePropagationData: 16010108151056.0Z lastLogonTimestamp: 128347680934676250

<end snippet from users.ldf>

With this configuration, when I attempt to login as an agent using my username (which I know is valid in AD), it errors out with:

Login failed! Your username or password was entered incorrectly.

And, when I revert the Config.pm back (so I can log in) and check the system log, I see:

User: raldridge authentication failed, no LDAP entry found! BaseDN='ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', Filter='(sAMAccountName=raldridge)', (REMOTE_ADDR: 10.1.1.50).

Any help would be greatly appreciated.

Thanks,

Robert Aldridge

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

Haven't used ActivePerl for a while but try this from a command prompt, ppm install Net::LDAP Ed On 24-Sep-07, at 3:37 PM, Michael Holland wrote:

This is actually on a Windows Server 2003 box. Any thoughts on how to install NET::LDAP on a Windows box? I'm sorry, I'm not a PERL expert at all.

Thanks.

-----Original Message----- From: otrs-bounces@otrs.org [mailto:otrs-bounces@otrs.org] On Behalf Of Edward Kovarski Sent: Monday, September 24, 2007 2:28 PM To: User questions and discussions about OTRS.org Subject: Re: [otrs] Re: LDAP Authentication using Microsoft ActiveDirectoryserver

Mike,

For Unix, as per http://doc.otrs.org/2.2/en/html/x354.html, you would need Net::LDAP. To install the module via CPAN, you'd type in:

perl -MCPAN -e 'install Net::LDAP'

or, alternatively some Unices allow:

cpan Net::LDAP

To answer your second question, you'd login via "username" or specifically the sAMAccountName LDAP attribute in Active Directory.

Ed

On 24-Sep-07, at 2:57 PM, Michael Holland wrote:

...

Robert and or anyone that can assist. 2 quick questions...

Do you have any instructions on how to install the correct PERL Ldap modules? When you login to OTRS do you use the username or domain\username?

Thanks for any help offered. I have been chasing this issue for well over a month.

Mike Holland

From: otrs-bounces@otrs.org [mailto:otrs-bounces@otrs.org] On Behalf Of Robert Aldridge Sent: Monday, September 24, 2007 11:43 AM To: User questions and discussions about OTRS.org Subject: Re: [otrs] Re: LDAP Authentication using Microsoft Active Directoryserver

Edward,

Thanks for the suggestion. I copied your configuration and now have both agents and customers successfully logging in with authentication against our AD server.

Thanks!!!

Robert

On 9/24/07, Edward Kovarski wrote:

Robert,

I would suggest trying to simplify the configurations by removing the AlwaysFilter and specifying the root of your Active Directory as the BaseDN. Once it authenticates properly you can start customizing and narrowing the BaseDN scope.

Here is an excerpt from Config.pm which I just tested on our dev environment as we don't use the customer interface in production. It properly authenticated and pulled in all the proper values into OTRS...

# --- Customer --- $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Customer,dc=ad,dc=groupkae,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'ldap@ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'ad.groupkae.com', BaseDN => 'ou=Customer,dc=ad,dc=groupkae,dc=com', SSCOPE => 'sub', UserDN =>'ldap@ad.groupkae.com', UserPw => 'password', },

CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ], ], };

On 24-Sep-07, at 10:42 AM, Robert Aldridge wrote:

...

Thanks for the suggestion, Edward. Changing the SearchUserDN to <username>@<domain> continues to work for the agent login. I still haven't been able to get the customer login working. Any hints? Here's my current LDAP portion of Config.pm:

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' ldapserver.domain.com '; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = ' OTRS@domain.com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = '********';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' ldapserver.domain.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = ' OTRS@domain.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = '********';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' ldapserver.domain.com', BaseDN => 'ou=Group of Users,dc=domain,dc=com', SSCOPE => 'sub', AlwaysFilter => '(&(sAMAccountName=*)(mail=*))', UserDN => 'OTRS@domain.com', UserPW => '********', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ # note: Login, Email and CustomerID needed! # var, frontend, storage, shown, required, storage-type # [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ], [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

On 9/21/07, Edward Kovarski < edward.kovarski@groupkae.com> wrote: Robert,

You may also try <username>@<domain> which is the new Microsoft style for specifying users within domains. This is what we use in configuration...

Ed

On 21-Sep-07, at 2:48 PM, Robert Aldridge wrote:

...

Finally got it working...

I changed every entry of:

'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com';

to:

'tsteel\OTRS'

and, to pull user data to the local DB, I added:

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

Perhaps this will help someone else who's trying to set OTRS up with Microsoft Active Directory.

Thanks,

Robert Aldridge

On 9/21/07, Robert Aldridge < bamarob55@gmail.com> wrote: Hi folks,

First let me say that OTRS appears to be a great product! Kudos to the developers!

We are in the process of evaluating our options for a helpdesk/ trouble-ticket system. I would really like to give OTRS a good evaluation, but I'm having some problems. Our chosen solution must be able to authenticate users (both agents and customers) via Microsoft Active Directory. It appears that this is possible, but I've yet to have any success. I'll outline the steps I've taken and solicit any input from the community.

OTRS is working fine when authenticating against it's own database. Here's what I've done to try to authenticate against AD:

I edited Kernel/Config.pm and added:

<begin additions to Config.pm>

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' lincoln.tsteel.com ', BaseDN => 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', SSCOPE => 'sub', UserDN => 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', UserPW => 'password', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => 'sAMAccountName', 'cn', 'mail', CustomerUserSearchFields => 'sAMAccountName', 'cn', 'mail', CustomerUserPostMasterSearchFields => 'mail', CustomerUserNameFields => 'givenname', 'sn', Map => [ [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

<end additions to Config.pm>

On my AD box, I ran: ldifde -f users.ldf -d "OU=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com" -r ""

Which returned a listing of all users in the Tuscaloosa - Sheet Mill org unit. Within the users.ldf file (output from the above command), there's an entry for OTRS Admin:

<begin snippet from users.ldf>

dn: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: OTRS sn: Admin givenName: OTRS distinguishedName: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com instanceType: 4 whenCreated: 20070920125829.0Z whenChanged: 20070921135825.0Z displayName: OTRS uSNCreated: 8512826 uSNChanged: 8549454 name: OTRS objectGUID:: po7FpWyIxEWWQeiUc9XMwA== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 128347689772801250 lastLogoff: 0 lastLogon: 128347693211238750 pwdLastSet: 128347667099207500 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAApR5XA/l+DSsgfDsl4xwAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: OTRS sAMAccountType: 805306368 userPrincipalName: OTRS@tsteel.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=tsteel,DC=com dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921131751.0Z dSCorePropagationData: 16010108151056.0Z lastLogonTimestamp: 128347680934676250

<end snippet from users.ldf>

With this configuration, when I attempt to login as an agent using my username (which I know is valid in AD), it errors out with:

Login failed! Your username or password was entered incorrectly.

And, when I revert the Config.pm back (so I can log in) and check the system log, I see:

User: raldridge authentication failed, no LDAP entry found! BaseDN='ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', Filter='(sAMAccountName=raldridge)', (REMOTE_ADDR: 10.1.1.50).

Any help would be greatly appreciated.

Thanks,

Robert Aldridge

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? =http://www.otrs.com/ _______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

Yeah the AlwaysFilter thing never did work for us.. Which stinks because not everyone in our company is a customer/agent. -Andy On 9/24/07 12:21 PM, "Edward Kovarski" wrote:

Robert,

I would suggest trying to simplify the configurations by removing the AlwaysFilter and specifying the root of your Active Directory as the BaseDN. Once it authenticates properly you can start customizing and narrowing the BaseDN scope.

Here is an excerpt from Config.pm which I just tested on our dev environment as we don't use the customer interface in production. It properly authenticated and pulled in all the proper values into OTRS...

# --- Customer --- $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = 'ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Customer,dc=ad,dc=groupkae,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'ldap@ad.groupkae.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'ad.groupkae.com', BaseDN => 'ou=Customer,dc=ad,dc=groupkae,dc=com', SSCOPE => 'sub', UserDN =>'ldap@ad.groupkae.com', UserPw => 'password', },

CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ], ], };

On 24-Sep-07, at 10:42 AM, Robert Aldridge wrote:

...

Thanks for the suggestion, Edward. Changing the SearchUserDN to <username>@<domain> continues to work for the agent login. I still haven't been able to get the customer login working. Any hints? Here's my current LDAP portion of Config.pm:

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' ldapserver.domain.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'OTRS@domain.com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = '********';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' ldapserver.domain.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Group of Users,dc=domain,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = ' OTRS@domain.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = '********';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' ldapserver.domain.com', BaseDN => 'ou=Group of Users,dc=domain,dc=com', SSCOPE => 'sub', AlwaysFilter => '(&(sAMAccountName=*)(mail=*))', UserDN => 'OTRS@domain.com', UserPW => '********', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ # note: Login, Email and CustomerID needed! # var, frontend, storage, shown, required, storage-type # [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ], [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

On 9/21/07, Edward Kovarski < edward.kovarski@groupkae.com> wrote: Robert,

You may also try <username>@<domain> which is the new Microsoft style for specifying users within domains. This is what we use in configuration...

Ed

On 21-Sep-07, at 2:48 PM, Robert Aldridge wrote:

...

Finally got it working...

I changed every entry of:

'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com';

to:

'tsteel\OTRS'

and, to pull user data to the local DB, I added:

# UserSyncLDAPMap # (map if agent should create/synced from LDAP to DB after login) $Self->{UserSyncLDAPMap} = { # DB -> LDAP Firstname => 'givenName', Lastname => 'sn', Email => 'mail', };

# UserSyncLDAPGroups # (If "LDAP" was selected for AuthModule, you can specify initial # user groups for first login.) $Self->{UserSyncLDAPGroups} = [ 'users', ];

Perhaps this will help someone else who's trying to set OTRS up with Microsoft Active Directory.

Thanks,

Robert Aldridge

On 9/21/07, Robert Aldridge < bamarob55@gmail.com> wrote: Hi folks,

First let me say that OTRS appears to be a great product! Kudos to the developers!

We are in the process of evaluating our options for a helpdesk/ trouble-ticket system. I would really like to give OTRS a good evaluation, but I'm having some problems. Our chosen solution must be able to authenticate users (both agents and customers) via Microsoft Active Directory. It appears that this is possible, but I've yet to have any success. I'll outline the steps I've taken and solicit any input from the community.

OTRS is working fine when authenticating against it's own database. Here's what I've done to try to authenticate against AD:

I edited Kernel/Config.pm and added:

<begin additions to Config.pm>

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = 'password';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = ' lincoln.tsteel.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPW'} = 'password';

$Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => ' lincoln.tsteel.com ', BaseDN => 'ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', SSCOPE => 'sub', UserDN => 'cn=OTRS Admin,ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', UserPW => 'password', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => 'sAMAccountName', 'cn', 'mail', CustomerUserSearchFields => 'sAMAccountName', 'cn', 'mail', CustomerUserPostMasterSearchFields => 'mail', CustomerUserNameFields => 'givenname', 'sn', Map => [ [ 'UserFirstName', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastName', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], ], };

<end additions to Config.pm>

On my AD box, I ran: ldifde -f users.ldf -d "OU=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com" -r ""

Which returned a listing of all users in the Tuscaloosa - Sheet Mill org unit. Within the users.ldf file (output from the above command), there's an entry for OTRS Admin:

<begin snippet from users.ldf>

dn: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: OTRS sn: Admin givenName: OTRS distinguishedName: CN=OTRS,OU=Tuscaloosa - Sheet Mill,DC=tsteel,DC=com instanceType: 4 whenCreated: 20070920125829.0Z whenChanged: 20070921135825.0Z displayName: OTRS uSNCreated: 8512826 uSNChanged: 8549454 name: OTRS objectGUID:: po7FpWyIxEWWQeiUc9XMwA== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 128347689772801250 lastLogoff: 0 lastLogon: 128347693211238750 pwdLastSet: 128347667099207500 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAApR5XA/l+DSsgfDsl4xwAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: OTRS sAMAccountType: 805306368 userPrincipalName: OTRS@tsteel.com objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=tsteel,DC=com dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921135825.0Z dSCorePropagationData: 20070921131751.0Z dSCorePropagationData: 16010108151056.0Z lastLogonTimestamp: 128347680934676250

<end snippet from users.ldf>

With this configuration, when I attempt to login as an agent using my username (which I know is valid in AD), it errors out with:

Login failed! Your username or password was entered incorrectly.

And, when I revert the Config.pm back (so I can log in) and check the system log, I see:

User: raldridge authentication failed, no LDAP entry found! BaseDN='ou=Tuscaloosa - Sheet Mill,dc=tsteel,dc=com', Filter='(sAMAccountName=raldridge)', (REMOTE_ADDR: 10.1.1.50).

Any help would be greatly appreciated.

Thanks,

Robert Aldridge

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

_______________________________________________ OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs Support or consulting for your OTRS system? => http://www.otrs.com/

--