LDAP-Anbindung PROBLEM

Hilfe zu Znuny Problemen aller Art
Locked
iZniZe
Znuny newbie
Posts: 5
Joined: 13 Mar 2012, 14:22
Znuny Version: 24900
Company: ITUP-Consulting GmbH

LDAP-Anbindung PROBLEM

Post by iZniZe »

Hallo zusammen,

lese hier schon seit geraumer Zeit mit und muss sagen das Forum hat mir hier oder da schon oft weiter geholfen.

Mein Problem ist folgendes will meine OTRS 3.1.2 (auf nem Debian 6.0.4) ans LDAP anbinden. -> Leider Erfolglos!

Meine Config.pm schaut so aus:

Code: Select all

# --
# Kernel/Config.pm - Config file for OTRS kernel
# Copyright (C) 2001-2011 xxx, http://otrs.org/
# --
# $Id: Config.pm.dist,v 1.25 2011/09/16 10:58:28 mg Exp $
# --
# This software comes with ABSOLUTELY NO WARRANTY. For details, see
# the enclosed file COPYING for license information (AGPL). If you
# did not receive this file, see http://www.gnu.org/licenses/agpl.txt.
# --
#  Note:
#
#  -->> OTRS does have a lot of config settings. For more settings
#       (Notifications, Ticket::ViewAccelerator, Ticket::NumberGenerator,
#       LDAP, PostMaster, Session, Preferences, ...) see
#       Kernel/Config/Defaults.pm and copy your wanted lines into "this"
#       config file. This file will not be changed on update!
#
# --

package Kernel::Config;

use utf8;

sub Load {
    my $Self = shift;
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
    #                                                      #
    #         Start of your own config options!!!          #
    #                                                      #
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #

    # ---------------------------------------------------- #
    # database settings                                    #
    # ---------------------------------------------------- #
    # DatabaseHost
    # (The database host.)
    $Self->{DatabaseHost} = 'localhost';
    # Database
    # (The database name.)
    $Self->{Database} = 'otrs';
    # DatabaseUser
    # (The database user.)
    $Self->{DatabaseUser} = 'otrs';
    # DatabasePw
    # (The password of database user. You also can use bin/otrs.CryptPassword.pl
    # for crypted passwords.)
    $Self->{DatabasePw} = 'otrs';
    # DatabaseDSN
    # (The database DSN for MySQL ==> more: "man DBD::mysql")
    $Self->{DatabaseDSN} = "DBI:mysql:database=$Self->{Database};host=$Self->{DatabaseHost};";

    # (The database DSN for PostgreSQL ==> more: "man DBD::Pg")
    # if you want to use a local socket connection
#    $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};";
    # if you want to use a tcpip connection
#    $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};host=$Self->{DatabaseHost};";
    # if you have PostgresSQL 8.1 or earlier, activate the legacy driver with this line:
#    $Self->{DatabasePostgresqlBefore82} = 1;

    # ---------------------------------------------------- #
    # fs root directory
    # ---------------------------------------------------- #
    $Self->{Home} = '/opt/otrs';

    # ---------------------------------------------------- #
    # insert your own config settings "here"               #
    # config settings taken from Kernel/Config/Defaults.pm #
    # ---------------------------------------------------- #
    # $Self->{SessionUseCookie} = 0;
    # $Self->{CheckMXRecord} = 0;

    # ---------------------------------------------------- #

    # ---------------------------------------------------- #
    # data inserted by installer                           #
    # ---------------------------------------------------- #
    # $DIBI$

    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
    #                                                      #
    #           End of your own config options!!!          #
    #                                                      #
    # ---------------------------------------------------- #
    # ---------------------------------------------------- #
}

# ---------------------------------------------------- #
# needed system stuff (don't edit this)                #
# ---------------------------------------------------- #
use strict;
use warnings;

use vars qw(@ISA $VERSION);
$VERSION = qw($Revision: 1.25 $)[1];

use Kernel::Config::Defaults;
push (@ISA, 'Kernel::Config::Defaults');

# -----------------------------------------------------#

1;

# -----------------------------------------------------#  
# ---------------------------------------------------- #
# LDAP konfiguration				       #
# ---------------------------------------------------- #
sub Load {
my $Self = shift;
# This is an example configuration for an LDAP auth. backend.
# (Make sure Net::LDAP is installed!)
$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = '192.168.4.137';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=itup-consulting,dc=de';
$Self->{'AuthModule::LDAP::UID'} = 'uid';
                         
#Check if the user is allowed to auth in a posixGroup
#(e. g. user needs to be in a group xyz to use otrs)
$Self->{'AuthModule::LDAP::GroupDN'} = 'cn=OTRS,ou=Groups,dc=itup-consulting,dc=de';
$Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
#for ldap posixGroups objectclass (just uid)
#$Self->{'AuthModule::LDAP::UserAttr'} = 'UID';
#for non ldap posixGroups objectclass (with full user dn)
#$Self->{'AuthModule::LDAP::UserAttr'} = 'DN';
                                                                        
# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
# $Self->{'AuthModule::LDAP::SearchUserDN'} = '';
# $Self->{'AuthModule::LDAP::SearchUserPw'} = '';
# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
#$Self->{'AuthModule::LDAP::AlwaysFilter'} = '';
# in case you want to add a suffix to each login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
#$Self->{'AuthModule::LDAP::UserSuffix'} = '@domain.com';

# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
$Self->{'AuthModule::LDAP::Params'} = {
port => 389,
timeout => 120,
async => 0,
version => 3,
};                                                                                                                                                                                                                                                                
# ---------------------------------------------------- #
# LDAP konfiguration					      #
# ---------------------------------------------------- #
# agent data sync against ldap
$Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';
$Self->{'AuthSyncModule::LDAP::Host'} = 'ldap://192.168.4.137/';
$Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=itup-consulting,dc=de';
$Self->{'AuthSyncModule::LDAP::UID'} = 'uid';
$Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'cn=admin, ou=user, dc=itup-consulting, dc=de';
$Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'password';
$Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
UserFirstname => 'givenName',
UserLastname  => 'sn',
UserEmail     => 'mail',
};
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
# AuthSyncModule::LDAP::UserSyncInitialGroups
# (sync following group with rw permission after initial create of first agent login)
$Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = ['users'];
}
Der openLDAP läuft auch auf einem Debian 6.0.4 und per LDAP Browser kann ich mich auch ohne Probleme anmelden.

Bekomme wenn ich ins OTRS will aber immer folgende Meldung :
Image

Apache Error Log:

Code: Select all

[Wed Mar 21 17:05:50 2012] -e: DBI connect('database=otrs;host=localhost;','otrs',...) failed: Access denied for user 'otrs'@'localhost' (using password: YES) at /opt/otrs//Kernel/System/DB.pm line 256
[Wed Mar 21 17:05:50 2012] -e: Use of uninitialized value in concatenation (.) or string at /opt/otrs//Kernel/System/Log.pm line 161.
ERROR: OTRS-CGI-01 Perl: 5.10.1 OS: linux Time: Wed Mar 21 17:05:50 2012

 Message: Access denied for user 'otrs'@'localhost' (using password: YES)

 Traceback (1278):
   Module: Kernel::System::DB::new (v1.144) Line: 227
   Module: Kernel::System::Web::InterfaceAgent::Run (v1.64) Line: 143
   Module: ModPerl::ROOT::ModPerl::Registry::opt_otrs_bin_cgi_2dbin_index_2epl::handler (unknown version) Line: 46
   Module: (eval) (v1.90) Line: 204
   Module: ModPerl::RegistryCooker::run (v1.90) Line: 204
   Module: ModPerl::RegistryCooker::default_handler (v1.90) Line: 170
   Module: ModPerl::Registry::handler (v1.99) Line: 31
Der User "otrs" hat aber alle privilegien bekommen um auf die mySQL DB zu connecten. (wenn ich den LDAP Teil auskommentiere in der Config.pm kann ich mich auch direkt wieder anmelden?!)

Für JEDE Hilfe bin ich sehr dankbar (ist mein Abschlussprojekt ;-) )
You do not have the required permissions to view the files attached to this post.
jojo
Znuny guru
Posts: 15020
Joined: 26 Jan 2007, 14:50
Znuny Version: Git Master
Contact:

Re: LDAP-Anbindung PROBLEM

Post by jojo »

Du hast Deine Config.pm zerstört indem Du etwas am Ende hinzugefügt hast.

Lies die Config.pm nochmal richtig und füge Deine Änderungen in dem Bereich ein, der für manuelle Anpassungen gedacht ist....
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master

Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
boris
Znuny wizard
Posts: 554
Joined: 22 Feb 2010, 18:27
Znuny Version: 3.0.4

Re: LDAP-Anbindung PROBLEM

Post by boris »

Produktiv:
OTRS 3.1.7
CentOS 6.3
Apache2/MySQL

Test:
OTRS 3.1.7
CentOS 6.3
Apache2/MySQL
iZniZe
Znuny newbie
Posts: 5
Joined: 13 Mar 2012, 14:22
Znuny Version: 24900
Company: ITUP-Consulting GmbH

Re: LDAP-Anbindung PROBLEM

Post by iZniZe »

So danke schonmal. "Soweit" klappt das ganze jetzt auch!

Meine NEUE Fehlermeldung lautet:

Code: Select all

[Thu Mar 22 10:01:34 2012] -e: Use of uninitialized value in concatenation (.) or string at /opt/otrs//Kernel/System/Log.pm line 161.
ERROR: OTRS-CGI-01 Perl: 5.10.1 OS: linux Time: Thu Mar 22 10:01:34 2012

 Message: No UserID found for 'darthvader@otrs.demo'!

 Traceback (1220):
   Module: Kernel::System::User::UserLookup (v1.116) Line: 746
   Module: Kernel::System::Auth::Auth (v1.54) Line: 232
   Module: Kernel::System::Web::InterfaceAgent::Run (v1.64) Line: 204
   Module: ModPerl::ROOT::ModPerl::Registry::opt_otrs_bin_cgi_2dbin_index_2epl::handler (unknown version) Line: 46
   Module: (eval) (v1.90) Line: 204
   Module: ModPerl::RegistryCooker::run (v1.90) Line: 204
   Module: ModPerl::RegistryCooker::default_handler (v1.90) Line: 170
   Module: ModPerl::Registry::handler (v1.99) Line: 31
Mein Problem ist jetzt, ich hab in den Modulen absolut gar nichts verstellt. :-(
iZniZe
Znuny newbie
Posts: 5
Joined: 13 Mar 2012, 14:22
Znuny Version: 24900
Company: ITUP-Consulting GmbH

Re: LDAP-Anbindung PROBLEM

Post by iZniZe »

Ah und es ist mir gerade noch eingefallen, hier meine LDIF :

Code: Select all

# Organization for Example Corporation
dn: dc=itup-consulting,dc=de
objectClass: dcObject
objectClass: organization
dc: itup-consulting
o: ITUP-Consulting
description: 

# Organizational Role for Directory Manager
dn: cn=manager,dc=itup-consulting,dc=de
objectClass: organizationalRole
cn: Manager
description: Directory Manager

# OrganizationUnit for users 
dn:ou=users, dc=itup-consulting, dc=de
objectclass: top
objectclass: organizationalUnit
ou: users 

# OrganizationUnit for groups
dn:ou=groups, dc=itup-consulting, dc=de
objectclass: top
objectclass: organizationalUnit
ou: groups

# users
dn: uid=skywalker, ou=users, dc=itup-consulting, dc=de
uid: skywalker
objectclass: top
objectclass: inetOrgPerson
givenName: Skywalker
sn: Anakin
cn: Anakin Skywalker
telephoneNumber: +49 069 696969
userpassword:skywalker 
mail: skywalker@otrs.demo
description: demo user

dn: uid=darthvader, ou=users, dc=itup-consulting, dc=de
uid: darthvader 
objectclass: top
objectclass: inetOrgPerson
givenName: Darthvader
sn: Fritz
cn: Fritz Darthvader
telephoneNumber: +49 069 696967
userpassword: darthvader
mail: darthvader@otrs.demo
description: demo user

dn: uid=hans, ou=users, dc=itup-consulting, dc=de
uid: hans
objectclass: top
objectclass: inetOrgPerson
givenName: Smith
sn: Hans
cn: Hans Smith
telephoneNumber: +49 069 696968
userpassword: hans
mail: hans@otrs.demo
description: demo user

# add user to groups
dn: cn=otrs-agent, ou=groups, dc=itup-consulting, dc=de
objectclass: top
objectclass: groupOfNames
cn: otrs-agent
member: uid=hans, ou=users, dc=itup-consulting, dc=de
member: uid=skywalker, ou=users, dc=itup-consulting, dc=de
Diese User können sich jedoch alle nicht anmelden :-$ ...also darthvader, skywalker & hans

Vielen Dank im vorraus an ALLE !!!
Locked