LDAP
If there is a LDAP tree available with your users then you can
use the user LDAP auth backend. This module is just read only (
means it can't write to your LDAP tree - this should just be possibe for
your tree manager) so you can't create or update user via the Admin-Interface.
[Kernel/Config.pm]
# This is an example configuration for an LDAP auth. backend.
# (take care that Net::LDAP is installed!)
$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'AuthModule::LDAP::UID'} = 'uid';
# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
# $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
# $Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
$Self->{'AuthModule::LDAP::SearchUserDN'} = '';
$Self->{'AuthModule::LDAP::SearchUserPw'} = '';
# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
# $Self->{'AuthModule::LDAP::AlwaysFilter'} = '';
# in case you want to add a suffix to each login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
# $Self->{'AuthModule::LDAP::UserSuffix'} = '@domain.com';
# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
# $Self->{'AuthModule::LDAP::Params'} = {
# port => 389,
# version => 3,
# };
[...] |
LDAP entries shall conform to the PosixAccount and inetOrgPerson schema. An example entry might look like:
dn: uid=lester,ou=user,dc=example,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: officePerson
uid: lester
cn: Lester Adamas
userPassword: {crypt}X5/DBrWPOQQaI
gecos: Lester
loginShell: /bin/csh
uidNumber: 10
gidNumber: 10
homeDirectory: /home/lester
sn: Adams
givenName: Lester
mail: lester@example.com
preferredLanguage: fr
comment: technical support |
Please note, that in version 1.x you have to create a db entry for the ldap user.
This is done automatically on first login in versions > 1.1.x.
This will be the config option to map the LDAP attributes to database. Default is:
# UserSyncLDAPMap
# (map if agent should create/synced from LDAP to DB after login)
$Self->{UserSyncLDAPMap} = {
# DB -> LDAP
Firstname => 'givenName',
Lastname => 'sn',
Email => 'mail',
}; |