LDAP authentication

katerina · Post by **katerina** » 19 Jul 2012, 13:29

Hi,
I am for some days trying to configure LDAP authentication.
Now I am in this situation: after entering in customer.pl userID and password, if it matches for that in LDAP or defautl DB, I got Internal server error. In error.log I have
Undefined subroutine &Kernel::Config::Load called at /opt/otrs//Kernel/Config/Defaults.pm line 1770.\n

If password doesn't match LDAP or default DB, user is rejected and I see a shake and then login again.

In Kernel/Config.pm I added:
# This is an example configuration for an LDAP auth. backend.
# (make sure Net::LDAP is installed!)
$Self->{'AuthModule1'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = '172.19.11.205';
$Self->{'AuthModule::LDAP::BaseDN'} = '';
$Self->{'AuthModule::LDAP::UID'} = 'bubenickova';

$Self->{'AuthModule::LDAP::SearchUserDN'} = 'o=lecebna,ou=sivt,CN=bubenickova';
$Self->{'AuthModule::LDAP::SearchUserPw'} = 'xxxx';

$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = '172.19.11.205';
#$Self->{'Customer::AuthModule::LDAP::BaseDN'} = '';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'bubenickova';
# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
$Self->{'Customer::AuthModule::LDAP::GroupDN'} =
'o=lecebna,ou=sivt,cn=bubenickova';
$Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
# for ldap posixGroups objectclass (just uid)
$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';
# for non ldap posixGroups objectclass (full user dn)
#$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';
# The following is valid but would only be necessary if the
# anonymous user does NOT ave permission to read from the LDAP tree
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'o=lecebna,ou=sivt,cn=bubenickova';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'buben';
# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
$Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '';
# in case you want to add a suffix to each customer login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain
#$Self->{'Customer::AuthModule::LDAP::UserSuffix'} = '@domain.com';
# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
$Self->{'Customer::AuthModule::LDAP::Params'} = {.
Module => 'Kernel::System::CustomerUser::LDAP',
Name => 'ASI AD LDAP',
Params => {
Host => '172.19.11.205',
BaseDN => '',
SSCOPE => 'sub',
UserDN => 'bubenickova',
UserPw => 'xxxx',
},
CustomerKey => 'bubenickova',
CustomerID => 'bubenickova@plbohnice.cz',
CustomerUserListFields => ['cn', 'mail'],
CustomerUserSearchFields => ['uid', 'cn', 'mail'],
CustomerUserPostMasterSearchFields => ['mail'],
CustomerUserNameFields => ['givenname', 'sn'],
# timeout => 120,
# async => 0,
# version => 3,
# };

#$Self->{CustomerUser} = {
Map => [
# note: Login, Email and CustomerID are mandatory!
# var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly
# [ 'UserTitle', 'Title', 'title', 1, 0, 'var', '', 0 ],
[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var', '', 0 ],
[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var', '', 0 ],
[ 'UserLogin', 'Username', 'uid', 1, 1, 'var', '', 0 ],
[ 'UserEmail', 'Email', 'mail', 1, 1, 'var', '', 0 ],
[ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var', '', 0 ],
# [ 'UserCustomerIDs', 'CustomerIDs', 'second_customer_ids', 1, 0, 'var', '', 0 ],
# [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var', '', 0 ],
# [ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var', '', 0 ],
# [ 'UserComment', 'Comment', 'description', 1, 0, 'var', '', 0 ],
],
};

-------------------------
thank you for any advice

Post by **crythias** » 19 Jul 2012, 14:06

The very first line has an index of 1 but no subsequent entries for that AuthModule do.
$Self->{'AuthModule1'} = 'Kernel::System::Auth::LDAP';

I haven't bothered to further troubleshoot after that, but likely what's happening is that AuthModule is using Defaults.pm which connects to DB.

katerina · Post by **katerina** » 19 Jul 2012, 15:39

Thanks, that was one mistake,
but after I corrected it, I can only login as user in LDAP, not as user in default db,
but after login I got Internal server error again,
in error.log I have again
Undefined subroutine &Kernel::Config::Load called at /opt/otrs//Kernel/Config/Defaults.pm line 1770

Post by **crythias** » 19 Jul 2012, 16:52

katerina wrote:but after I corrected it, I can only login as user in LDAP, not as user in default db

Append the index (1) to all such entries for LDAP and you should regain both access.

Also, what version OTRS?

katerina wrote:Undefined subroutine &Kernel::Config::Load called at /opt/otrs//Kernel/Config/Defaults.pm line 1770

This is because Config.pm doesn't have sub Load, or it's broken.

Can you please post your entire (password redacted) Config.pm?

katerina · Post by **katerina** » 20 Jul 2012, 12:33

Thanks for your help, I am totaly lost in the code for LDAP.
I tried several versions of code, that I found in otrs manual and in discussions here.
Our LDAP for sure doesn't contain all informations about customers,
I wanted to add them later if needed.
I would like to authenticate users against database or LDAP, if possible (one of them). The agents could be only in DB, it doesn,t matter. (That means I need to authenticate via customer.pl with LDAP, I don't need to authenticate in index.pl with LDAP and I would apreciate if I could add another customer into db, not into LDAP)

I reinstalled otrs and I haven't got internal server error any more. But now I can authenticate only with db, not with LDAP.
I use an account for searching LDAP which is lecebna.sivt.bubenickova, o=lecebna, ou=sivt, cn=bubenickova.
I was told dc is only for AD, for LDAP novell it is empty.

-----------------Config.pm
package Kernel::Config;

use utf8;

sub Load {
my $Self = shift;
# ---------------------------------------------------- #
# ---------------------------------------------------- #
# #
# Start of your own config options!!! #
# #
# ---------------------------------------------------- #
# ---------------------------------------------------- #

# ---------------------------------------------------- #
# database settings #
# ---------------------------------------------------- #
# DatabaseHost
# (The database host.)
$Self->{'DatabaseHost'} = 'localhost';
# Database
# (The database name.)
$Self->{'Database'} = 'otrs';
# DatabaseUser
# (The database user.)
$Self->{'DatabaseUser'} = 'otrs';
# DatabasePw
# (The password of database user. You also can use bin/otrs.CryptPassword.pl
# for crypted passwords.)
$Self->{'DatabasePw'} = 'hot';
# DatabaseDSN
# (The database DSN for MySQL ==> more: "man DBD::mysql")
$Self->{DatabaseDSN} = "DBI:mysql:database=$Self->{Database};host=$Self->{DatabaseHost};";

# (The database DSN for PostgreSQL ==> more: "man DBD::Pg")
# if you want to use a local socket connection
# $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};";
# if you want to use a tcpip connection
# $Self->{DatabaseDSN} = "DBI:Pg:dbname=$Self->{Database};host=$Self->{DatabaseHost};";
# if you have PostgresSQL 8.1 or earlier, activate the legacy driver with this line:
# $Self->{DatabasePostgresqlBefore82} = 1;

# ---------------------------------------------------- #
# fs root directory
# ---------------------------------------------------- #
$Self->{Home} = '/opt/otrs';

# ---------------------------------------------------- #
# insert your own config settings "here" #
# config settings taken from Kernel/Config/Defaults.pm #
# ---------------------------------------------------- #
# $Self->{SessionUseCookie} = 0;
# $Self->{CheckMXRecord} = 0;

# ---------------------------------------------------- #
# This is an example configuration for an LDAP auth. backend.
# (make sure Net::LDAP is installed!)
$Self->{'AuthModule1'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule1::LDAP::Host'} = '172.19.11.68';
$Self->{'AuthModule1::LDAP::BaseDN'} = '';
$Self->{'AuthModule1::LDAP::UID'} = 'bubenickova';

$Self->{'AuthModule1::LDAP::SearchUserDN'} = 'o=lecebna,ou=sivt,CN=bubenickova';
$Self->{'AuthModule1::LDAP::SearchUserPw'} = 'xxx';

$Self->{'Customer::AuthModule1'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule1::LDAP::Host'} = '172.19.11.68';
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = '';
$Self->{'Customer::AuthModule1::LDAP::UID'} = 'bubenickova';
# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
$Self->{'Customer::AuthModule1::LDAP::GroupDN'} =
'o=lecebna,ou=sivt,cn=bubenickova';
$Self->{'Customer::AuthModule1::LDAP::AccessAttr'} = 'memberUid';
# for ldap posixGroups objectclass (just uid)
$Self->{'Customer::AuthModule1::LDAP::UserAttr'} = 'UID';
# for non ldap posixGroups objectclass (full user dn)
#$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';
# The following is valid but would only be necessary if the
# anonymous user does NOT ave permission to read from the LDAP tree
$Self->{'Customer::AuthModule1::LDAP::SearchUserDN'} = 'o=lecebna,ou=sivt,cn=bubenickova';
$Self->{'Customer::AuthModule1::LDAP::SearchUserPw'} = 'buben';
# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
$Self->{'Customer::AuthModule1::LDAP::AlwaysFilter'} = '';
# in case you want to add a suffix to each customer login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
#$Self->{'Customer::AuthModule::LDAP::UserSuffix'} = '@domain.com';
# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP).
$Self->{'Customer::AuthModule1::LDAP::Params'} = {.
Module => 'Kernel::System::CustomerUser::LDAP',
Name => 'LDAP datasource',
Params => {
Host => '172.19.11.68',
BaseDN => '',
SSCOPE => 'sub',
UserDN => 'bubenickova',
UserPw => 'xxx',
timeout => 120,
async => 0,
version => 3,
},
CustomerKey => 'bubenickova',
CustomerID => 'bubenickova@plbohnice.cz',
CustomerUserListFields => ['cn', 'mail'],
CustomerUserSearchFields => ['uid', 'cn', 'mail'],
CustomerUserPostMasterSearchFields => ['mail'],
CustomerUserNameFields => ['givenname', 'sn'],.
.

#$Self->{CustomerUser} = {
Map => [
# note: Login, Email and CustomerID are mandatory!
# var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly
# [ 'UserTitle', 'Title', 'title', 1, 0, 'var', '', 0 ],
[ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var', '', 0 ],
[ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var', '', 0 ],
[ 'UserLogin', 'Username', 'uid', 1, 1, 'var', '', 0 ],
[ 'UserEmail', 'Email', 'mail', 1, 1, 'var', '', 0 ],
[ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var', '', 0 ],
# [ 'UserCustomerIDs', 'CustomerIDs', 'second_customer_ids', 1, 0, 'var', '', 0 ],
# [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var', '', 0 ],
# [ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var', '', 0 ],
# [ 'UserComment', 'Comment', 'description', 1, 0, 'var', '', 0 ],
],
};

# ---------------------------------------------------- #
# data inserted by installer #
# ---------------------------------------------------- #

# ---------------------------------------------------- #
# ---------------------------------------------------- #
# #
# End of your own config options!!! #
# #
# ---------------------------------------------------- #
# ---------------------------------------------------- #
}

# ---------------------------------------------------- #
# needed system stuff (don't edit this) #
# ---------------------------------------------------- #
use strict;
use warnings;

use vars qw(@ISA $VERSION);
$VERSION = qw($Revision: 1.25 $)[1];

use Kernel::Config::Defaults;
push (@ISA, 'Kernel::Config::Defaults');

# -----------------------------------------------------#

1;

Post by **crythias** » 20 Jul 2012, 13:01

You made the same mistake that I made when I first fought this. When I said, 'append', I really meant append, not insert. :)

This is for agents. Customers have a similar index/numbering scheme.