I have been searching through the list archives and trying to find more details on how exactly to make RT3 authenticate against our AD on our Windows 2000 domain. I have found some good information, such as here: http://lists.fsck.com/pipermail/rt-users/2003-July/015262.html and here: http://lists.fsck.com/pipermail/rt-users/2003-June/014988.html but I’m still not sure where to begin. I will start with saying that I have no experience whatsoever w/LDAP (which I assume I need to use) and integrating apache with LDAP / AD. I see some information on the lists about some apache settings to authenticate externally, as well as the RT_SiteConfig option to make sure authentication is external, but a lot of the information is jibberish to me. Stuff like this makes no sense:
AuthType Basic
AuthName "Request Tracker"
# sAMAccountName is the first.last style user name
AuthLDAPURL = "ldap://my.ldap/dc=3Dmydomain,dc=3Dcom?sAMAccountName"
# need this account and setting because Active Directory
# does not allow anonymous binding by default
AuthLDAPBindDN "dummy.user@mydomain.com"
AuthLDAPBindPassword "asdfg"
AuthLDAPAuthoritative off
require valid-user
and some of the other stuff I found in that first link mentioned here. Is there some good RT3 / Active Directory HOWTO out there? Am I going to have to first thoroughly learn how LDAP works? I’m tying to avoid having to manually enter in about 75+ users into RT3. We are going to use the SelfService part of RT3 for users to fill out requests, and it would be VERY handy if we could just keep authentication in sync w/our AD.
Any help pointing me where to even being would be MUCH appreciated. I am kindof on a time critical schedule with this and may have to just roll w/internal RT3 authenticaion anyway as I know that works and this thing is going to have to roll out soon this week. I’ll continue trying to make sense of some examples and information I see in the list archives.
Thanks!
Erik Spigle wrote:
I have been searching through the list archives and trying to find more details on how exactly to make RT3 authenticate
against our AD on our Windows 2000 domain. I have found some good
information, such as here:
http://lists.fsck.com/pipermail/rt-users/2003-July/015262.html and here:
http://lists.fsck.com/pipermail/rt-users/2003-June/014988.html but
I’m still not sure where to begin.
I will start with saying that I have no experience whatsoever w/LDAP
(which I assume I need to use) and
integrating apache with LDAP / AD. I see some information on the
lists about some apache settings to
authenticate externally, as well as the RT_SiteConfig option to make
sure authentication is external, but
a lot of the information is jibberish to me. Stuff like this makes
no sense:
AuthType Basic
AuthName "Request Tracker"
# sAMAccountName is the first.last style user name
AuthLDAPURL = "ldap://my.ldap/dc=3Dmydomain,dc=3Dcom?sAMAccountName"
# need this account and setting because Active Directory
# does not allow anonymous binding by default
AuthLDAPBindDN "dummy.user@mydomain.com"
AuthLDAPBindPassword "asdfg"
AuthLDAPAuthoritative off
require valid-user
go to apache’s website, look at auth_ldap’s documentation. The options
are explained there. I can explain why a few of them are there though.
The BindDN and Password are there because for LDAP to search the AD it
must first bind to the AD. This is because AD by default does not allow
anonymous viewing/searching. So I created an account called ‘ad.access’
in keeping with our blah.blah naming scheme with a password of ‘asdfg’.
So what happens is LDAP binds as ad.access, looks for whatever the user
said their name was, if that works it then tries to re-bind with the new
user name and password. If this binding works the user is
authenticated, otherwise they fail.
The LDAP URL is pretty easy to recreate. Replace dc=mydomain,dc=com
with whatever your sites domain is. So if you log into EXAMPLE.COM you
use dc=example,dc=com. The part after the question mark is the field
you search on. In AD the user’s account name is stored in sAMAccountName.
Hope that helps.
Oh yeah, my comment about autohandler. So once the user is
authenticated by apache the information is passed on to RT. RT wants
users to exist in the database. So what happens is autohandler runs a
function to acquire the user’s info from LDAP (AD) and uses it to
generate a user in the DB. 3.0.7 added support for this natively, we
were hacking it into autohandler before.
and some of the other stuff I found in that first link mentioned here. Is there some good RT3 / Active
Directory HOWTO out there? Am I going to have to first thoroughly
learn how LDAP works? I’m tying to
avoid having to manually enter in about 75+ users into RT3. We are
going to use the SelfService part
of RT3 for users to fill out requests, and it would be VERY handy if
we could just keep authentication
in sync w/our AD.
I found very little about AD and apache online. Most of it is in the
thread you found my post in.
Any help pointing me where to even being would be MUCH appreciated. I am kindof on a time critical
schedule with this and may have to just roll w/internal RT3
authenticaion anyway as I know that works
and this thing is going to have to roll out soon this week. I’ll
continue trying to make sense of some