Agent LDAP auth from different groups (CNs)

[Jarod]

Hi everybody,

I am currently working on the LDAP auth module of OTRS4.
We have created a group (cn) called "otrs_allow". In this group, all agents (member attribute) are "directly" in this group.
I use the following for auth:

Code: Select all

$Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrs_allow,ou=Security,ou=.Groups,ou=Users,dc=mno,dc=abc,dc=xy';
$Self->{'AuthModule::LDAP::AccessAttr'} = 'member';

Login works. So far, so good.

Some days ago my admin told me that he is redesigning the LDAP/X.500-server.
He wants the "otrs-allow" group to be removed.
Now all of our users inside the company are grouped together in ONE group.
Permissions are created via OUs.
My problem ist, that user from ou e.g. "OP" and ou "PU" should be allowed to log in on OTRS.

Is it possible to define more than one CN (or the complete DN) for agents to auth?

Best regards

Patrick

[crythias]

Use the filter.

[Jarod]

Hi,

thanks for your reply.
But I don#t understand the way the filter works.

[crythias]

Please start here and let us know if you have a specific example that you've tried that is causing issues.

[Jarod]

OK, I'll check it tomorrow and will give feedback.
Thank you so far for your help.

[Jarod]

Hi,

it works now.

I had to use the "memberOf" attribute to filter.
Took some time to understand our AD design, but it's working.

Thanks for your support and the "filter-hint".