LDAP/ActiveDirectory Auth für Customer Frontend

Hilfe zu Znuny Problemen aller Art
Forum rules
Locked
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Hallo Community,

ich habe das Problem, dass ich mich am Kundenfrontend (/otrs/customer.pl) nicht mit meinen AD Anmeldedaten einloggen kann. Ich bin bereits ein gutes Stück voran gekommen, aber es fehlt mir scheinbar noch ein kleiner Schritt.

Ich habe bereits Einiges an LDAP Einstellungen für das AuthModul gemacht. Die 2 deshalb, weil ich das DB AuthModule ebenfalls noch aktiv habe.
$Self->{'Customer::AuthModule2'} = 'Kernel::System::CustomerAuth::LDAP';
...


Auch einige CustomerUser Einstellungen wurde bereits durchgeführt.
$Self->{CustomerUser2} = {
Name => 'LDAP Backend',
Module => 'Kernel::System::CustomerUser::LDAP',


Ich erhalte im Log folgende Meldung, die mir sagt, das der LDAP Auth erfolgreich ist, aber kein Benutzer in der DB zu finden ist. Wir mein Verständnis, muss in der lokalen DB kein Kunde eingetragen sein, da die Info aus dem AD kommen.

Thu Dec 15 13:56:22 2016 error OTRS-CGI-11 No such user 'bernhard.beispiel'!
Thu Dec 15 13:56:22 2016 notice OTRS-CGI-11 CustomerUser: bernhard.beispiel (CN=Michael Jorck,OU=BENUTZER,DC=MYDOMAIN,DC=LOCAL) authentication ok (REMOTE_ADDR: 10.1.128.151).
Thu Dec 15 13:56:22 2016 notice OTRS-CGI-11 CustomerUser: No auth record in 'customer_user' for 'bernhard.beispiel' (REMOTE_ADDR: 10.1.128.151)


Ich habe einen Test gemacht und über das Adminmenü einen Kunden-Benutzer mit den gleichen Werten wie ein AD-Benutzer angelegt (kein Passwort vergeben). Anschließend funktioniert der Login mit dem Benutzernamen und dem AD-Kennwort. Ich komme in Kundenfrontend und kann Tickets erstellen. Leider werden bei diesen Tickets in der Agentansicht nicht die zusätzlichen Werte aus dem AD gelesen (Telefon, Position, usw.). Es handelt sich also nicht um die gleichen Benutzer.

Ich hoffe, ihr könnt mir einen Tipp geben.

Gruß Micha

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

Hi,

Dann müsstest Du mal Deine gesamte Config für CustomerUser zeigen.


Es deutet darauf hin, dass Du den falschen Login verwendest. Aber sicherer kann man das sagen, wenn Du uns Deine Config zeigst.


bzw. das hier

Code: Select all

No auth record in 'customer_user'
zeigt, dass er das LDAP nicht befrägt, sondern die lokale Benutzerdatenbank verwenden will.


Viele Grüße
Flo
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Hallo wurzel,

hier meine Config für CustomerUser aus /opt/otrs/Kernel/Config/Defaults.pm

Der Teil fürs DB Auth, welches wir nicht unbedingt benutzen wollen, aber drin lassen möchten, falls doch :)

Code: Select all

    # CustomerUser
    # (customer user database backend and settings)
    $Self->{CustomerUser1} = {
        Name   => 'Database Backend',
        Module => 'Kernel::System::CustomerUser::DB',
        Params => {
            # if you want to use an external database, add the
            # required settings
#            DSN  => 'DBI:odbc:yourdsn',
#            Type => 'mssql', # only for ODBC connections
#            DSN => 'DBI:mysql:database=customerdb;host=customerdbhost',
#            User => '',
#            Password => '',
            Table => 'customer_user',
#            ForeignDB => 0,    # set this to 1 if your table does not have create_time, create_by, change_time and change_by fields

            # CaseSensitive defines if the data storage of your DBMS is case sensitive and will be
            # preconfigured within the database driver by default.
            # If the collation of your data storage differs from the default settings,
            # you can set the current behavior ( either 1 = CaseSensitive or 0 = CaseINSensitive )
            # to fit your environment.
            #
#            CaseSensitive => 0,

            # SearchCaseSensitive will control if the searches within the data storage are performed
            # case sensitively (if possible) or not. Change this option to 1, if you want to search case sensitive.
            # This can improve the performance dramatically on large databases.
            SearchCaseSensitive => 0,
        },

        # customer unique id
        CustomerKey => 'login',

        # customer #
        CustomerID             => 'customer_id',
        CustomerValid          => 'valid_id',

        # The last field must always be the email address so that a valid
        #   email address like "John Doe" <john.doe@domain.com> can be constructed from the fields.
        CustomerUserListFields => [ 'first_name', 'last_name', 'email' ],

#        CustomerUserListFields => ['login', 'first_name', 'last_name', 'customer_id', 'email'],
        CustomerUserSearchFields           => [ 'login', 'first_name', 'last_name', 'customer_id' ],
        CustomerUserSearchPrefix           => '*',
        CustomerUserSearchSuffix           => '*',
        CustomerUserSearchListLimit        => 250,
        CustomerUserPostMasterSearchFields => ['email'],
        CustomerUserNameFields             => [ 'title', 'first_name', 'last_name' ],
        CustomerUserEmailUniqCheck         => 1,

#        # show now own tickets in customer panel, CompanyTickets
#        CustomerUserExcludePrimaryCustomerID => 0,
#        # generate auto logins
#        AutoLoginCreation => 0,
#        # generate auto login prefix
#        AutoLoginCreationPrefix => 'auto',
#        # admin can change customer preferences
#        AdminSetPreferences => 1,
        # use customer company support (reference to company, See CustomerCompany settings)
        #CustomerCompanySupport => 1,
        # cache time to live in sec. - cache any database queries
        CacheTTL => 60 * 60 * 24,
#        # just a read only source
#        ReadOnly => 1,
        Map => [

            # note: Login, Email and CustomerID needed!
            # var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly, http-link-target, link class(es)
            [ 'UserTitle',      Translatable('Title or salutation'), 'title',  1, 0, 'var', '', 0 ],
            [ 'UserFirstname',  Translatable('Firstname'),  'first_name', 1, 1, 'var', '', 0 ],
            [ 'UserLastname',   Translatable('Lastname'),   'last_name',  1, 1, 'var', '', 0 ],
            [ 'UserLogin',      Translatable('Username'),   'login',      1, 1, 'var', '', 0 ],
            [ 'UserPassword',   Translatable('Password'),   'pw',         0, 0, 'var', '', 0 ],
            [ 'UserEmail',      Translatable('Email'),      'email',      1, 1, 'var', '', 0 ],
#            [ 'UserEmail',      Translatable('Email'), 'email',           1, 1, 'var', '[% Env("CGIHandle") %]?Action=AgentTicketCompose;ResponseID=1;TicketID=[% Data.TicketID | uri %];ArticleID=[% Data.ArticleID | uri %]', 0, '', 'AsPopup OTRSPopup_TicketAction' ],
            [ 'UserCustomerID', Translatable('CustomerID'), 'customer_id', 0, 1, 'var', '', 0 ],
#            [ 'UserCustomerIDs', Translatable('CustomerIDs'), 'customer_ids', 1, 0, 'var', '', 0 ],
            [ 'UserPhone',        Translatable('Phone'),       'phone',        1, 0, 'var', '', 0 ],
            [ 'UserFax',          Translatable('Fax'),         'fax',          1, 0, 'var', '', 0 ],
            [ 'UserMobile',       Translatable('Mobile'),      'mobile',       1, 0, 'var', '', 0 ],
            [ 'UserStreet',       Translatable('Street'),      'street',       1, 0, 'var', '', 0 ],
            [ 'UserZip',          Translatable('Zip'),         'zip',          1, 0, 'var', '', 0 ],
            [ 'UserCity',         Translatable('City'),        'city',         1, 0, 'var', '', 0 ],
            [ 'UserCountry',      Translatable('Country'),     'country',      1, 0, 'var', '', 0 ],
            [ 'UserComment',      Translatable('Comment'),     'comments',     1, 0, 'var', '', 0 ],
            [ 'ValidID',          Translatable('Valid'),       'valid_id',     0, 1, 'int', '', 0 ],
        ],

        # default selections
        Selections => {

#            UserTitle => {
#                'Mr.' => Translatable('Mr.'),
#                'Mrs.' => Translatable('Mrs.'),
#            },
        },
    };
Hier der Teil für das AD-Auth

Code: Select all

# CustomerUser
# (customer user ldap backend and settings)
    $Self->{CustomerUser2} = {
        Name => 'LDAP Backend',
        Module => 'Kernel::System::CustomerUser::LDAP',
        Params => {
#            # ldap host
            Host => 'mydomain.local',
#            # ldap base dn
            BaseDN => 'DC=MYDOMAIN,DC=LOCAL',
#            # search scope (one|sub)
            SSCOPE => 'sub',
#            # The following is valid but would only be necessary if the
#            # anonymous user does NOT have permission to read from the LDAP tree
            UserDN => 'CN=OTRS_SA,OU=ServiceAccounts,DC=MYDOMAIN,DC=LOCAL',
            UserPw => 'XXXXXXXXXXXXX',
#            # in case you want to add always one filter to each ldap query, use
#            # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
            AlwaysFilter => '',
#            # if the charset of your ldap server is iso-8859-1, use this:
#            # SourceCharset => 'iso-8859-1',
#            # die if backend can't work, e. g. can't connect to server
            Die => 0,
#            # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
#            Params => {
#                port    => 389,
#                timeout => 120,
#                async   => 0,
#                version => 3,
#            },
        },
#        # customer unique id
        CustomerKey => 'mail',
#        # customer #
        CustomerID => 'mail',
        CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],
        CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],
        CustomerUserSearchPrefix => '*',
        CustomerUserSearchSuffix => '*',
        CustomerUserSearchListLimit => 2500,
#        CustomerUserPostMasterSearchFields => ['mail'],
#        CustomerUserNameFields => ['givenname', 'sn'],
#        # show now own tickets in customer panel, CompanyTickets
#        CustomerUserExcludePrimaryCustomerID => 0,
#        # add a ldap filter for valid users (expert setting)
#        # CustomerUserValidFilter => '(!(description=gesperrt))',
#        # admin can't change customer preferences
#        AdminSetPreferences => 0,
#        # cache time to live in sec. - cache any ldap queries
#        CacheTTL => 0,
        Map => [
            # note: Login, Email and CustomerID needed!
            # var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly
            [ 'UserTitle',      'Title',      'title',           1, 0, 'var', '', 0 ],
            [ 'UserFirstname',  'Firstname',  'givenname',       1, 1, 'var', '', 0 ],
            [ 'UserLastname',   'Lastname',   'sn',              1, 1, 'var', '', 0 ],
            [ 'UserLogin',      'Username',   'sAMAccountName',             1, 1, 'var', '', 0 ],
            [ 'UserEmail',      'Email',      'mail',            1, 1, 'var', '', 0 ],
            [ 'UserCustomerID', 'CustomerID', 'mail',            0, 1, 'var', '', 0 ],
            # [ 'UserCustomerIDs', 'CustomerIDs', 'second_customer_ids', 1, 0, 'var', '', 0 ],
            [ 'UserPhone',      'Phone',      'telephonenumber', 1, 0, 'var', '', 0 ],
            [ 'UserAddress',    'Address',    'postaladdress',   1, 0, 'var', '', 0 ],
            [ 'UserComment',    'Comment',    'description',     1, 0, 'var', '', 0 ],
        ],
    };
Brauchst du noch mehr Parameter?
Danke für die Unterstützung.

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

Hi,

schaut gut aus. Wie ist Deine CustomerAuth Konfiguration?

viele Grüße
Flo
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Hier der CustomerAuth Teil.

wieder für den DB Auth. Ich habe es hier ebenfalls bereits mit

Code: Select all

$Self->{'Customer::AuthModule1'}
probiert.

Code: Select all

    $Self->{'Customer::AuthModule'}                       = 'Kernel::System::CustomerAuth::DB';
    $Self->{'Customer::AuthModule::DB::Table'}            = 'customer_user';
    $Self->{'Customer::AuthModule::DB::CustomerKey'}      = 'login';
    $Self->{'Customer::AuthModule::DB::CustomerPassword'} = 'pw';

#    $Self->{'Customer::AuthModule::DB::DSN'} = "DBI:mysql:database=customerdb;host=customerdbhost";
#    $Self->{'Customer::AuthModule::DB::User'} = "some_user";
#    $Self->{'Customer::AuthModule::DB::Password'} = "some_password";

    # if you use odbc or you want to define a database type (without autodetection)
#    $Self->{'Customer::AuthModule::DB::Type'} = 'mysql';

    # password crypt type (bcrypt|sha2|sha1|md5|apr1|crypt|plain)
#    $Self->{'Customer::AuthModule::DB::CryptType'} = 'sha2';

    # This is an example configuration for an LDAP auth. backend.
    # (take care that Net::LDAP is installed!)
und der Teil für die AD Auth

Code: Select all

    # This is an example configuration for an LDAP auth. backend.
    # (take care that Net::LDAP is installed!)
    $Self->{'Customer::AuthModule2'} = 'Kernel::System::CustomerAuth::LDAP';
    $Self->{'Customer::AuthModule::LDAP::Host2'} = 'mydomain.local';
    $Self->{'Customer::AuthModule::LDAP::BaseDN2'} = 'DC=MYDOMAIN,DC=LOCAL';
    $Self->{'Customer::AuthModule::LDAP::UID2'} = 'sAMAccountName';

    # Check if the user is allowed to auth in a posixGroup
    # (e. g. user needs to be in a group xyz to use otrs)
#    $Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
#    $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
    # for ldap posixGroups objectclass (just uid)
#    $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';
    # for non ldap posixGroups objectclass (full user dn)
#    $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';

    # The following is valid but would only be necessary if the
    # anonymous user do NOT have permission to read from the LDAP tree
    $Self->{'Customer::AuthModule::LDAP::SearchUserDN2'} = 'CN=OTRS_SA,OU=ServiceAccounts,DC=MYDOMAIN,DC=LOCAL';
    $Self->{'Customer::AuthModule::LDAP::SearchUserPw2'} = 'XXXXXXXXXXXXXXXX';

    # in case you want to add always one filter to each ldap query, use
    # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
   $Self->{'Customer::AuthModule::LDAP::AlwaysFilter2'} = '';

    # in case you want to add a suffix to each customer login name, then
    # you can use this option. e. g. user just want to use user but
    # in your ldap directory exists user@domain.
#    $Self->{'Customer::AuthModule::LDAP::UserSuffix'} = '@domain.com';

    # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
#    $Self->{'Customer::AuthModule::LDAP::Params'} = {
#        port    => 389,
#        timeout => 120,
#        async   => 0,
#        version => 3,
#    };

    # Die if backend can't work, e. g. can't connect to server.
#    $Self->{'Customer::AuthModule::LDAP::Die'} = 1;
Grüße Micha

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
RStraub
Znuny guru
Posts: 2210
Joined: 13 Mar 2014, 09:16
Znuny Version: 6.0.14
Real Name: Rolf Straub

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by RStraub »

Als Randbemerkung:
Bitte nicht die Defaults.pm bearbeiten. Lieber den entsprechenden Teil herauskopieren und in die Config.pm pflegen.
Currently using: OTRS 6.0.14 -- MariaDB -- Ubuntu 16 LTS
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

hi,

ich sehe keinen Fehler :(

Kannst Du Deine komplette Config.pm mal posten (ohne Passwörter)?

viele Grüße
Flo
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Das ist die komplette Default.pm Konfiguration
Defaults.pm.txt
Hier ist ein Fehler, der im Log erscheint, wenn ich mich am Customer.pl anmelden möchte
httpd_Error.log.txt
You do not have the required permissions to view the files attached to this post.

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
jojo
Znuny guru
Posts: 15020
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:
Contact jojo

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by jojo »

Bitte niemals die Defaults.pm ändern!

Die entsprechenden Inhalte in die Config.pm kopieren und anpassen
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
Top
Sulaco
Znuny newbie
Posts: 5
Joined: 06 Jul 2016, 09:50
Znuny Version: 5.0.14

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by Sulaco »

Hallo

Teste doch mal deine LDAP-Verbindung mit einem ldapsearch und überprüfe die Daten(samaccountname, mail, cn, ...):

Code: Select all

 ldapsearch -H ldap://dc.domain.local -b 'OU=baseOU,dc=domain,dc=local' -D 'suchender-account@domain.local' -w 'pw-vom-suchenden' -E pr=1000/noprompt '(samaccountname=nutzer-der-sich-anmelden-will)'
Hier ist meine Config für die Customer zum Vergleich

Code: Select all

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = ['dc1.domain.local','dc2.domain.local','dc3.domain.local'];
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=domain,dc=local';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';
$Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '(objectclass=user)(mail=*)';
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'CN=otrs-acc,OU=serviceAcc,dc=domain,dc=local';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '**********';

$Self->{CustomerUser} = {
	Name => 'Backend domain.local',
	Module => 'Kernel::System::CustomerUser::LDAP',
	Params => {
		Host => ['dc1.domain.local','dc2.domdomain.local','dc3.domain.local'],
		BaseDN => 'dc=domain,dc=local',
		SSCOPE => 'sub',
		AlwaysFilter => '(objectclass=user)(mail=*)',
		UserDN =>'CN=otrs-acc,OU=serviceAcc,dc=domain,dc=local',
		UserPw => '**********',
	},
	CustomerKey => 'sAMAccountName',
	CustomerID => 'mail',
	CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],
	CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],
	CustomerUserSearchPrefix => '',
	CustomerUserSearchSuffix => '*',
	CustomerUserSearchListLimit => 250,
	CustomerUserPostMasterSearchFields => ['mail'],
	CustomerUserNameFields => ['givenname', 'sn'],
	Map => [
		# note: Login, Email and CustomerID needed!
		# var, frontend, storage, shown, required, storage-type
		[ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],
		[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
		[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
		[ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
		[ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],
		[ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],
		[ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],
		[ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],
	],
};
OTRS 5.0.14 | AD-Backend | MySQL | SLES 12.1
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

Hi,
Kannst Du Deine komplette Config.pm mal posten (ohne Passwörter)?
Danke
Flo
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Hi Flo,

ich bekomme jeden Tag noch eine Mail vom Cronjob

Code: Select all

syntax error at /opt/otrs/Kernel/Config/Defaults.pm line 1445, near "},"
Unmatched right curly bracket at /opt/otrs/Kernel/Config/Defaults.pm line 1512, at end of line Unmatched right curly bracket at /opt/otrs/Kernel/Config/Defaults.pm line 1513, at end of line Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1517.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1581.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1637.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1642.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1649.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1655.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1673.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1705.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1713.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1728.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1749.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1765.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1772.
Global symbol "$Self" requires explicit package name at /opt/otrs/Kernel/Config/Defaults.pm line 1781.
Unmatched right curly bracket at /opt/otrs/Kernel/Config/Defaults.pm line 1793, at end of line /opt/otrs/Kernel/Config/Defaults.pm has too many errors.
Compilation failed in require at /opt/otrs/Kernel/Config.pm line 96.
BEGIN failed--compilation aborted at /opt/otrs/Kernel/Config.pm line 96.
Compilation failed in require at /opt/otrs/Kernel/System/ObjectManager.pm line 23.
BEGIN failed--compilation aborted at /opt/otrs/Kernel/System/ObjectManager.pm line 23.
Compilation failed in require at /opt/otrs//bin/otrs.Daemon.pl line 35.
BEGIN failed--compilation aborted at /opt/otrs//bin/otrs.Daemon.pl line 35.
Ich habe das geprüft, aber die richtige Klammer habe ich nicht gefunden. Für mich passen die Klammern. Ich habe mal eine mehr oder weniger gemacht und dann kommt sofort Fehler 500. Kennt jemand ein Tool, womit ich die Klammersetzung prüfen kann, ohne den Code Zeile für Zeile durchgehen zumüssen?

Danke Micha

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

Hi,

Tut mir leid dass Du alle angebotene Hilfe nicht annimmst und unsere Postings nicht beantwortest.

Mir isses ja egal. Ich hab die Probleme ja nicht.

viele Grüße
Flo
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
reneeb
Znuny guru
Posts: 5018
Joined: 13 Mar 2011, 09:54
Znuny Version: 6.0.x
Real Name: Renée Bäcker
Company: Perl-Services.de
Contact:
Contact reneeb

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by reneeb »

Mit jedem Editor, der Code-Folding kann, solltest Du das schnell selbst finden...

Außerdem gibt Dir die Fehlermeldung mit

Code: Select all

syntax error at /opt/otrs/Kernel/Config/Defaults.pm line 1445, near "},"
schon einen gewissen Hinweis.

Ansonsten: Poste mal Deine Defaults.pm (mit anonymisierten Passwörtern) - aber das hatte @wurzel ja schon gesagt.
Perl / Znuny development: http://perl-services.de
Free Znuny add ons from the community: http://opar.perl-services.de
Commercial add ons: http://feature-addons.de
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

Hi,

t'schuldige dass ich mich einmische. ;)

Ich wollte die Config.pm sehen. Wie bereits mehrfach erwähnt soll man die Defaults.pm nicht ändern.
Da da ein Syntax Error drin ist würde ich am Besten das original aus dem Backup wiederherstellen.

Aber ja, die "manipulierte" Defaults.pm tuts am Ende auch ;)

viele Grüße
Flo
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Hi,

sorry ich hatte mich das letzte Mal nur auf den letzten Beitrag konzentriert. Die Anderen hab ich glatt übersehen. Sorry :(

Ich nehme den Hinweis mit der Config.pm gerne an und werde die Konfiguration entsprechend ändern. Ich melde mich, wenn ich damit durch bin und der Fehler noch vorhanden ist. Die Default.pm hatte ich bereits als Default.pm.txt an einen Beitrag angehangen, aber macht euch nicht die Mühe dort noch reinzuschauen.



Gruß Micha

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
mjo
Znuny newbie
Posts: 7
Joined: 15 Dec 2016, 14:01
Znuny Version: 5.0.15

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by mjo »

Hi Flo,

ich habe nun die Konfig umgebaut. Ich habe aus dem aktuellen RPM von OTRS 5.0.15 die Defaults.pm gezogen und nach /opt/otrs/Kernel/Config/Defaults.pm geschrieben. Damit müsste ich wieder die Standardeinstellungen haben.

Meine persönlichen Einstellungen aus der Defaults.pm habe ich nun in der Config.pm untergebracht. Das Ergebnis ist hier:

Config.pm

Code: Select all

# --
# Copyright (C) 2001-2016 xxx, http://otrs.com/
# --
# This software comes with ABSOLUTELY NO WARRANTY. For details, see
# the enclosed file COPYING for license information (AGPL). If you
# did not receive this file, see http://www.gnu.org/licenses/agpl.txt.
# --
#  Note:
#
#  -->> Most OTRS configuration should be done via the OTRS web interface
#       and the SysConfig. Only for some configuration, such as database
#       credentials and customer data source changes, you should edit this
#       file. For changes do customer data sources you can copy the definitions
#       from Kernel/Config/Defaults.pm and paste them in this file.
#       Config.pm will not be overwritten when updating OTRS.
# --

package Kernel::Config;

use strict;
use warnings;
use utf8;

sub Load {
    my $Self = shift;

    # ---------------------------------------------------- #
    # database settings                                    #
    # ---------------------------------------------------- #

    # The database host
    $Self->{'DatabaseHost'} = '127.0.0.1';

    # The database name
    $Self->{'Database'} = "otrs";

    # The database user
    $Self->{'DatabaseUser'} = "otrs";

    # The password of database user. You also can use bin/otrs.Console.pl Maint::Database::PasswordCrypt
    # for crypted passwords
    $Self->{'DatabasePw'} = '*******';

    # The database DSN for MySQL ==> more: "perldoc DBD::mysql"
    $Self->{'DatabaseDSN'} = "DBI:mysql:database=$Self->{Database};host=$Self->{DatabaseHost}";

    # The database DSN for PostgreSQL ==> more: "perldoc DBD::Pg"
    # if you want to use a local socket connection
#    $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};";
    # if you want to use a TCP/IP connection
#    $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};host=$Self->{DatabaseHost};";

    # The database DSN for Microsoft SQL Server - only supported if OTRS is
    # installed on Windows as well
#    $Self->{DatabaseDSN} = "DBI:ODBC:driver={SQL Server};Database=$Self->{Database};Server=$Self->{DatabaseHost},1433";

    # The database DSN for Oracle ==> more: "perldoc DBD::oracle"
#    $Self->{DatabaseDSN} = "DBI:Oracle://$Self->{DatabaseHost}:1521/$Self->{Database}";
#
#    $ENV{ORACLE_HOME}     = '/path/to/your/oracle';
#    $ENV{NLS_DATE_FORMAT} = 'YYYY-MM-DD HH24:MI:SS';
#    $ENV{NLS_LANG}        = 'AMERICAN_AMERICA.AL32UTF8';

    # ---------------------------------------------------- #
    # fs root directory
    # ---------------------------------------------------- #
    $Self->{Home} = '/opt/otrs';

    # ---------------------------------------------------- #
    # insert your own config settings "here"               #
    # config settings taken from Kernel/Config/Defaults.pm #
    # ---------------------------------------------------- #
    # $Self->{SessionUseCookie} = 0;
    # $Self->{CheckMXRecord} = 0;

    # ---------------------------------------------------- #
    # PIN MJO                                              #
    # ---------------------------------------------------- #
	# Agent Auth
	# Agent Sync
    $Self->{AuthModule2} = 'Kernel::System::Auth::LDAP';
    $Self->{'AuthModule::LDAP::Host2'} = 'mydomain.local';
    $Self->{'AuthModule::LDAP::BaseDN2'} = 'DC=mydomain,DC=local';
    $Self->{'AuthModule::LDAP::UID2'} = 'sAMAccountName';
    $Self->{'AuthModule::LDAP::GroupDN2'} = 'CN=OTRS-Agents_IT,OU=OTRS,DC=mydomain,DC=local';
    $Self->{'AuthModule::LDAP::AccessAttr2'} = 'member';
    $Self->{'AuthModule::LDAP::UserAttr2'} = 'DN';
    $Self->{'AuthModule::LDAP::SearchUserDN2'} = 'CN=OTRS_SA,OU=service-accounts,DC=mydomain,DC=local';
    $Self->{'AuthModule::LDAP::SearchUserPw2'} = '*******';
    $Self->{'AuthModule::LDAP::UserLowerCase2'} = 1;
    
    $Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::LDAP';
    $Self->{'AuthSyncModule::LDAP::Host'} = 'mydomain.local';
    $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'DC=mydomain,DC=local';
    $Self->{'AuthSyncModule::LDAP::UID'} = 'sAMAccountName';
    $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'CN=OTRS_SA,OU=service-accounts,DC=mydomain,DC=local';
    $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = '*******';
    $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
        # DB -> LDAP
        UserFirstname => 'givenName',
        UserLastname  => 'sn',
        UserEmail     => 'mail',
    };

    # TimeWorkingHours
    # (counted hours for working time used)
    $Self->{TimeWorkingHours} = {
        Mon => [ 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],
        Tue => [ 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],
        Wed => [ 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],
        Thu => [ 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],
        Fri => [ 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19 ],
        Sat => [],
        Sun => [],
    };

    $Self->{TimeVacationDays} = {
        1  => { 1 => 'New Year\'s Day', },
        5  => { 1 => 'International Workers\' Day', },
		10 => { 3 => 'Tag der Deutschen Einheit', },
        12 => {
            25 => 'First Christmas Day',
            26 => 'Second Christmas Day',
            31 => 'New Year\'s Eve',
        },
    };

    $Self->{TimeVacationDaysOneTime} = {
        2017 => {
		    4  => {
			    14 => 'Karfreitag',
				17 => 'Ostermontag',
			},
			5  => {
                25 => 'Christi Himmelfahrt',
            },
            6  => {
                5  => 'Pfingstmontag',
            },
			10 => {
                31 => 'Reformationstag \(500.\)',
            },
        },
    };
	
	#Customer Auth
    $Self->{'Customer::AuthModule2'} = 'Kernel::System::CustomerAuth::LDAP';
    $Self->{'Customer::AuthModule::LDAP::Host2'} = 'mydomain.local';
    $Self->{'Customer::AuthModule::LDAP::BaseDN2'} = 'DC=mydomain,DC=local';
    $Self->{'Customer::AuthModule::LDAP::UID2'} = 'sAMAccountName';
    $Self->{'Customer::AuthModule::LDAP::SearchUserDN2'} = 'CN=OTRS_SA,OU=service-accounts,DC=mydomain,DC=local';
    $Self->{'Customer::AuthModule::LDAP::SearchUserPw2'} = '*******';
    $Self->{'Customer::AuthModule::LDAP::AlwaysFilter2'} = '';
    $Self->{CustomerUser1} = {
        Name   => 'Database Backend',
        Module => 'Kernel::System::CustomerUser::DB',
        Params => {
            Table => 'customer_user',
            SearchCaseSensitive => 0,
        },
        CustomerKey => 'login',
        CustomerID             => 'customer_id',
        CustomerValid          => 'valid_id',
        CustomerUserListFields => [ 'first_name', 'last_name', 'email' ],
        CustomerUserSearchFields           => [ 'login', 'first_name', 'last_name', 'customer_id' ],
        CustomerUserSearchPrefix           => '*',
        CustomerUserSearchSuffix           => '*',
        CustomerUserSearchListLimit        => 250,
        CustomerUserPostMasterSearchFields => ['email'],
        CustomerUserNameFields             => [ 'title', 'first_name', 'last_name' ],
        CustomerUserEmailUniqCheck         => 1,
        CacheTTL => 60 * 60 * 24,
        Map => [
            [ 'UserTitle',      Translatable('Title or salutation'), 'title',  1, 0, 'var', '', 0 ],
            [ 'UserFirstname',  Translatable('Firstname'),  'first_name', 1, 1, 'var', '', 0 ],
            [ 'UserLastname',   Translatable('Lastname'),   'last_name',  1, 1, 'var', '', 0 ],
            [ 'UserLogin',      Translatable('Username'),   'login',      1, 1, 'var', '', 0 ],
            [ 'UserPassword',   Translatable('Password'),   'pw',         0, 0, 'var', '', 0 ],
            [ 'UserEmail',      Translatable('Email'),      'email',      1, 1, 'var', '', 0 ],
            [ 'UserCustomerID', Translatable('CustomerID'), 'customer_id', 0, 1, 'var', '', 0 ],
            [ 'UserPhone',        Translatable('Phone'),       'phone',        1, 0, 'var', '', 0 ],
            [ 'UserFax',          Translatable('Fax'),         'fax',          1, 0, 'var', '', 0 ],
            [ 'UserMobile',       Translatable('Mobile'),      'mobile',       1, 0, 'var', '', 0 ],
            [ 'UserStreet',       Translatable('Street'),      'street',       1, 0, 'var', '', 0 ],
            [ 'UserZip',          Translatable('Zip'),         'zip',          1, 0, 'var', '', 0 ],
            [ 'UserCity',         Translatable('City'),        'city',         1, 0, 'var', '', 0 ],
            [ 'UserCountry',      Translatable('Country'),     'country',      1, 0, 'var', '', 0 ],
            [ 'UserComment',      Translatable('Comment'),     'comments',     1, 0, 'var', '', 0 ],
            [ 'ValidID',          Translatable('Valid'),       'valid_id',     0, 1, 'int', '', 0 ],
        ],
	};
		$Self->{CustomerUser2} = {
        Name => 'LDAP Backend',
        Module => 'Kernel::System::CustomerUser::LDAP',
        Params => {
            Host => 'mydomain.local',
            BaseDN => 'DC=mydomain,DC=local',
            SSCOPE => 'sub',
            UserDN => 'CN=OTRS_SA,OU=service-accounts,DC=mydomain,DC=local',
            UserPw => '*******',
            AlwaysFilter => '',
            Die => 0,
        },
        CustomerKey => 'mail',
        CustomerID => 'mail',
        CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],
        CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],
        CustomerUserSearchPrefix => '*',
        CustomerUserSearchSuffix => '*',
        CustomerUserSearchListLimit => 2500,
        Map => [
            [ 'UserTitle',      'Title',      'title',           1, 0, 'var', '', 0 ],
            [ 'UserFirstname',  'Firstname',  'givenname',       1, 1, 'var', '', 0 ],
            [ 'UserLastname',   'Lastname',   'sn',              1, 1, 'var', '', 0 ],
            [ 'UserLogin',      'Username',   'sAMAccountName',             1, 1, 'var', '', 0 ],
            [ 'UserEmail',      'Email',      'mail',            1, 1, 'var', '', 0 ],
            [ 'UserCustomerID', 'CustomerID', 'mail',            0, 1, 'var', '', 0 ],
            [ 'UserPhone',      'Phone',      'telephonenumber', 1, 0, 'var', '', 0 ],
            [ 'UserAddress',    'Address',    'postaladdress',   1, 0, 'var', '', 0 ],
            [ 'UserComment',    'Comment',    'description',     1, 0, 'var', '', 0 ],
        ],
    };

    # ---------------------------------------------------- #

    # ---------------------------------------------------- #
    # data inserted by installer                           #
    # ---------------------------------------------------- #
    # $DIBI$

    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
    #                                                      #
    # end of your own config options!!!                    #
    #                                                      #
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
}

# ---------------------------------------------------- #
# needed system stuff (don't edit this)                #
# ---------------------------------------------------- #

use Kernel::Config::Defaults; # import Translatable()
use base qw(Kernel::Config::Defaults);

# -----------------------------------------------------#

1;
Das OTRS-Log zeigt weiterhin Folgendes:

Code: Select all

Tue Dec 27 18:14:23 2016	notice	OTRS-CGI-11	CustomerUser: michael.jorck (CN=Michael Jorck,OU=Benutzer,DC=mydomain,DC=local) authentication ok (REMOTE_ADDR: 10.1.128.151).
Tue Dec 27 18:14:23 2016	notice	OTRS-CGI-11	CustomerUser: No auth record in 'customer_user' for 'michael.jorck' (REMOTE_ADDR: 10.1.128.151)
Im Kundenfrontend erhält der Customer die Fehlermeldung:
Fehlermeldung wrote:Authentifizierung erfolgreich, aber im Kunden-Backend wurde kein Kunden-Eintrag gefunden. Bitte kontaktieren Sie Ihren Administrator.

Sulaco wrote: Teste doch mal deine LDAP-Verbindung mit einem ldapsearch und überprüfe die Daten(samaccountname, mail, cn, ...):

Code: Select all

 ldapsearch -H ldap://dc.domain.local -b 'OU=baseOU,dc=domain,dc=local' -D 'suchender-account@domain.local' -w 'pw-vom-suchenden' -E pr=1000/noprompt '(samaccountname=nutzer-der-sich-anmelden-will)'
@Sulaco: Ein ldapsearch ist erfolgreich. Ich bekomme alle Details des "Nutzer-der-sich-anmelden-will". Im Agent-Bereich funktioniert der Login inkl. Sync in die Agents-Tabelle wunderbar.


Ich hoffe Ihr könnt jetzt was sehen.

Gruß Micha

Testsystem: OTRS 5.X.X, OTRS::ITSM5
OS: CentOS / Apache2 / MySQL 5+
Top
wurzel
Znuny guru
Posts: 3273
Joined: 08 Jul 2010, 22:25
Znuny Version: x.x.x
Real Name: Florian

Re: LDAP/ActiveDirectory Auth für Customer Frontend

Post by wurzel »

*edit*

falsches Posting sorry
OTRS 2025 SILVER (Prod)
OTRS 2025 auf Debian 12 (Test)
Znuny 7.x latest version testing auf Debian 12

-- Ich beantworte keine Forums-Fragen PN - No PN please

I won't answer to unfriendly users any more. A greeting and regards are just polite.
Top
Locked

Return to “Hilfe”