Autogenerating a password for requestors

RT Users
1

Hi!

I’ve got a slightly complex question (at least to me…) and I haven’t
been able to come up with s solution after lots of googling, trying
stuff from the wiki, etc.

My bigger goal is to set up RT so that requestors get an email
notifying them of their ticket id etc aftre creation. If they are new
users, they should get a autocreated password.

There is a page in the wiki on this
http://wiki.bestpractical.com/view/AutogeneratedPassword

This works when I submit a ticket via email.

But…

On our website, we have a small feedback box (yes, inspired by
hiveminder :wink:
User can enter their problems there, which get temporarily stored in our
DB. A cronjob than takes the proto-tickets and submits them to our RT
via RT::Client::Rest. There we log into RT with a system user and set
the requestor to the users email address:

$ticket = RT::Client::REST::Ticket->new(
rt => $rt,
subject => $subject,
queue => $queue,
requestors => @requestors,
)->store( text => join( “\n”, $subject, ‘’, @desc ) );

This works perfectly, but not with the Password autogeneration.

After some trial and error, I figured out that RT::Client::REST seems to
set the requestors AFTER ticket creation, thus there are no requestors
during ‘On Create’. I figured out the correct custom condition (I
think):
return 0 unless $self->TransactionObj->Type eq ‘AddWatcher’;
return 0 unless $self->TransactionObj->Field eq ‘Requestor’;
return 1;

But I wasn’t able to get template from AutogeneratedPassword
to work. I guess, some of the values used in there do not apply to this
later stage.

So, any pointers on how do autogenerate a password right after on
Create?

Thanks!

#!/usr/bin/perl http://domm.plix.at
for(ref bless{},just’another’perl’hacker){s-:±$"-g&&print$_.$/}

2

My bigger goal is to set up RT so that requestors get an email
notifying them of their ticket id etc aftre creation. If they are new
users, they should get a autocreated password.

There is a page in the wiki on this
AutogeneratedPassword - Request Tracker Wiki

This works when I submit a ticket via email.

But I wasn’t able to get template from AutogeneratedPassword
to work. I guess, some of the values used in there do not apply to this
later stage.

I noticed that the Autogeneratepassword template scrip offered in the
wiki works fine at creating and emailing a password to a new user who
just created a ticket by email, but it did not seem to do the same
when a privileged user manually created a ticket in the RT web
interface.

The reason it didn;t is because in that case, the Transaction
CreatorObj is the privileged user, not the new user. Therefore, the
scripted tests that determine whether to set a password fail and the
whole set password script is skipped.

I (think) I fixed this by changing the “Autoreply” Templat script to be like so:

— begin Autoreply template —

Greetings,

Your support ticket [{$Ticket->QueueObj->SubjectTag || $rtname}
#{$Ticket->id()}] regarding:

"{$Ticket->Subject()}"

has been created, and a summary appears below.

Please check the history and progress of all your tickets and
communicate with our staff about your issue by logging in to the
web-based ticket system at:

{
*RT::User::GenerateRandomNextChar = &RT::User::_GenerateRandomNextChar;

CHANGED NEXT 3 LINES TO TEST REQUESTOR INSTEAD OF CREATOR

SO THAT WILL EMAIL REQUESTOR A PASSWORD WHEN STAFF CREATES

THE TICKET IN WEB INTERFACE

#if (($Transaction->CreatorObj->id != $RT::Nobody->id) &&

(!$Transaction->CreatorObj->Privileged) &&

($Transaction->CreatorObj->__Value(‘Password’) eq ‘NO-PASSWORD’)

if (($Ticket->Requestors->UserMembersObj->First->Id() != $RT::Nobody->id) &&
(!$Ticket->Requestors->UserMembersObj->First->Privileged) &&
($Ticket->Requestors->UserMembersObj->First->__Value(‘Password’)
eq ‘NO-PASSWORD’)
)
{
my $user = RT::User->new($RT::SystemUser);

$user->Load($Transaction->CreatorObj->Id);

    $user->Load($Ticket->Requestors->UserMembersObj->First->Id());
    my ($stat, $pass) = $user->SetRandomPassword();

    if (!$stat)
    {
            $OUT .=

“An internal error has occurred. RT was not able to set a password for you.
Please contact your local RT administrator for assistance.”;

    }

    use URI::Escape;

    $OUT .= "    ". $RT::WebURL."SelfService/?user=".

uri_escape($user->Name).“&pass=”. uri_escape($pass)."

Your username and password for the ticket system are:

Username: ".$user->Name."
Password: ".$pass."

You may change the password after you login if you wish.";
}
else
{
$OUT .= " ". $RT::WebURL .“Ticket/Display.html?id=”. $Ticket->id();
}
}

This is an automated message. Please do not reply.

Thank you,
{$Ticket->QueueObj->CorrespondAddress()}

{$Transaction->Content()}

— end Autoreply template —

I don;t know if that is right or proper, but it seems to work.

Allen

3

Hi!On Thu, May 07, 2009 at 10:44:01AM -0700, allen+rtlist@crystalfontz.com wrote:

CHANGED NEXT 3 LINES TO TEST REQUESTOR INSTEAD OF CREATOR

SO THAT WILL EMAIL REQUESTOR A PASSWORD WHEN STAFF CREATES

THE TICKET IN WEB INTERFACE

Worked like a charm, thanks a lot!

#!/usr/bin/perl http://domm.plix.at
for(ref bless{},just’another’perl’hacker){s-:±$"-g&&print$_.$/}

4

CHANGED NEXT 3 LINES TO TEST REQUESTOR INSTEAD OF CREATOR

SO THAT WILL EMAIL REQUESTOR A PASSWORD WHEN STAFF CREATES

THE TICKET IN WEB INTERFACE

Worked like a charm, thanks a lot!

Yikes! If I called someone and made a request via the phone and they
emailed a password for some system I’d never heard of, I’d probably flag it
as spam. I sure as heck wouldn’t log into it, because (a) I don’t know if
it really came from them, (b) I don’t know what this system does – XSS
attack, anyone? (c) the password was just emailed across the net in clear
text. Oi vay.

On the other hand, if I made the request via email, I might totally expect
to get a autoreply via email, but I’d still want my new password encrypted.

Perhaps RT can discover attached GPG/PGP keys and add them to a user’s
record at autocreate? Now that would be awesome.

– ============================
Tom Lahti
BIT Statement LLC

(425)251-0833 x 117
http://www.bitstatement.net/
– ============================

5

Tom Lahti ha scritto:

the password was just emailed across the net in clear text. Oi vay.

On the other hand, if I made the request via email, I might totally expect
to get a autoreply via email, but I’d still want my new password encrypted.

Or, it could be nice to be able to set a status in RT where an user has
just a one time password, after the first login he have to change it as
first and only things to do.

But I guess could be worth opening a new 3d for this topic…

cheers

Andrea Perotti
Cutaway S.r.l.
www.cutaway.it
c/o Seat PagineGialle

smime.p7s (3.4 KB)