Hi, Do the same with this for users. Hope this help $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; #$Self->{'Customer::AuthModule::LDAP::Host'} = 'ldapserver'; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=Yourusers,dc=domain,dc=local'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=ldapadmin,cn=users,dc=exploitation,dc=local'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'password'; $Self->{CustomerUser} = { Module => 'Kernel::System::CustomerUser::LDAP', Params => { Host => 'ldapserver', BaseDN => 'ou=Yourusers,dc=domain,dc=local', SSCOPE => 'sub', UserDN => 'cn=ldapadmin,cn=users,dc=domain,dc=local', UserPw => 'password', }, CustomerKey => 'sAMAccountName', CustomerID => 'mail', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserPostMasterSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserNameFields => ['givenname', 'sn'], Map => [ # note: Login, Email and CustomerID needed! # # var, frontend, storage, shown, required, storage-type # # [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ], [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ], [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ], [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ], [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ], [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ], [ 'UserPhone', 'Phone', 'telephoneNumber', 1, 0, 'var' ], #[ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ], #[ 'UserComment', 'Comment', 'description', 1, 0, 'var' ], ], }; Le 20/04/2010 17:57, Martin, Michael a écrit :

Hello again. I’m now able to get my OTRS server to use Microsoft’s AD to allow user login. Again, I’ve taken my config from:

http://wiki.otrs-forum.de/index.php?title=Using_OTRS_with_Microsoft_Active_D...

(Thank You to Michiel Beijen)

My Config.pm is nearly identical to the one listed in that link above. I have looked at the OTRS manual and I’m not able to find a section that describes how to differentiate between users and agents as they log in with their A.D. accounts. As of now, everyone who logs into OTRS is an agent.

My question is how do I allow some A.D. users to be “users” and other A.D. users to be “Agents” or “Admins?”

If anyone has a document or resource they could point me to it would be greatly appreciated.

Thank You!

/MM

Michael Martin Systems Administrator, Local Government Division P: 800-646-2633

--------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs

NEW! ENTERPRISE SUBSCRIPTION - Get more information NOW! http://www.otrs.com/en/support/enterprise-subscription/

-- Guillaume REHM Centre de Ressources Informatiques Responsable Sécurité du Système d'Information (RSSI) Bibliothèque Nationale et Universitaire de Strasbourg 5 rue du Maréchal Joffre BP 51029 67070 Strasbourg tél: 03 88 25 28 23 fax: 03 88 25 28 03 mail: guillaume.rehm@bnu.fr web: http://www.bnu.fr

Hi Michael, I'm not using the latest version of configuration sentences but they work so here they're: For customers, I use the following: $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host'} = 'A.B.C.D; $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'OU=XXXX,DC=YYYY,DC=ZZZZ'; $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName'; #The following is valid but would only be necessary if the #anonymous user do NOT have permission to read from the LDAP tree $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'user@domain'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'password'; # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP) $Self->{'Customer::AuthModule::LDAP::Params'} = { port => 389, timeout => 120, async => 0, version => 3, }; For Agents, I use the following: $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP'; $Self->{'AuthModule::LDAP::Host'} = 'A.B.C.D; $Self->{'AuthModule::LDAP::BaseDN'} = 'OU=XXXX,DC=YYYY,DC=ZZZZ'; $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName'; #The following is valid but would only be necessary if the #anonymous user do NOT have permission to read from the LDAP tree $Self->{'AuthModule::LDAP::SearchUserDN'} = 'user@domain'; $Self->{'AuthModule::LDAP::SearchUserPw'} = 'password'; # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP) $Self->{'AuthModule::LDAP::Params'} = { port => 389, timeout => 120, async => 0, version => 3, }; Keep in mind that you should have those customers/agents created on your database backend, AD sync will check that the user exist and that the provided password is correct but if that user in not in the database backend, you'll get a "Panic! no user data" error message I hope it helps, Leonardo Certuche www.itconsultores.com.co On 21 April 2010 14:57, Martin, Michael wrote:

Hello again. I have tried to get this working with Microsoft’s A.D. but I’m still having troubles, but I think I’m getting closer. I’ve adapted my Config with help from this email list. (Thank You to Michiel Beijen and Guillaume Rehm.)

My question is how do I allow some A.D. users to be “users” and other A.D. users to be “Agents” or “Admins?” Here is my config so far:

((SNIP))

$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';

$Self->{'AuthModule::LDAP::Host'} = 'AD Server';

$Self->{'AuthModule::LDAP::BaseDN'} = 'DC=my,DC=corp';

$Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';

$Self->{'AuthModule::LDAP::GroupDN'} = 'CN=Agents-Group,OU=My-OU,DC=my,DC=corp';

$Self->{'AuthModule::LDAP::AccessAttr'} = 'member';

$Self->{'AuthModule::LDAP::UserAttr'} = 'DN';

$Self->{'AuthModule::LDAP::SearchUserDN'} = 'CN=otrs-user,OU=user-acct,DC=my,DC=corp';

$Self->{'AuthModule::LDAP::SearchUserPw'} = 'Password';

# $Self->{'AuthModule::LDAP::AlwaysFilter'} = ;

$Self->{'AuthModule::LDAP::Params'} = {

port => 389,

timeout => 120,

async => 0,

version => 3,

};

$Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';

$Self->{'AuthSyncModule::LDAP::Host'} = 'AD Server';

$Self->{'AuthSyncModule::LDAP::BaseDN'} = 'DC=my,DC=corp';

$Self->{'AuthSyncModule::LDAP::UID'} = 'sAMAccountName';

$Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'CN=otrs-user,OU=user-Acct,DC=my,DC=corp';

$Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'Password';

$Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {

# DB -> LDAP

UserFirstname => 'givenName',

UserLastname => 'sn',

UserEmail => 'mail',

};

$Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [

'users',

];

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';

$Self->{'Customer::AuthModule::LDAP::Host'} = 'AD Server';

$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'DC=my,DC=corp';

$Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';

$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'CN=otrs-user,OU=user-acct,DC=my,DC=corp';

$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'Password';

$Self->{CustomerUser} = {

Module => 'Kernel::System::CustomerUser::LDAP',

Params => {

Host => 'AD Server',

BaseDN => 'DC=my,DC=corp',

SSCOPE => 'sub',

UserDN => 'CN=otrs-user,OU=user-acct,DC=my,DC=corp',

UserPw => 'Password',

},

CustomerKey => 'sAMAccountName',

CustomerID => 'mail',

CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],

CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],

CustomerUserPostMasterSearchFields => ['sAMAccountName', 'cn', 'mail'],

CustomerUserNameFields => ['givenname', 'sn'],

Map => [

# note: Login, Email and CustomerID needed!

# # var, frontend, storage, shown, required, storage-type

# # [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],

[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],

[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],

[ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],

[ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],

[ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],

[ 'UserPhone', 'Phone', 'telephoneNumber', 1, 0, 'var' ],

#[ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],

#[ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],

],

};

((END SNIP))

I’m sure I’m missing something fundamental in this configuration. Any pointers would be appreciated very much!

/MM

Michael Martin Systems Administrator, Local Government Division P: 800-646-2633

--------------------------------------------------------------------- OTRS mailing list: otrs - Webpage: http://otrs.org/ Archive: http://lists.otrs.org/pipermail/otrs To unsubscribe: http://lists.otrs.org/cgi-bin/listinfo/otrs

NEW! ENTERPRISE SUBSCRIPTION - Get more information NOW! http://www.otrs.com/en/support/enterprise-subscription/