External Auth (LDAP) and Mail Attribute

Thomas_Misilo · November 15, 2011, 3:24pm

Is there any special trick other than having:

   # The mapping of RT attributes on to LDAP attributes
                     'attr_map'                  =>  {   'Name' => 'cn',
                                                         'EmailAddress' => 'mail',
                                                         'RealName' => 'displayName',

‘ExternalAuthId’ => ‘cn’,
‘Gecos’ => ‘cn’
}

In your config to get the email? As it pulls Gecos correctly, but nothing else, Including ExternalAuthId.

Thanks for any ideas.

Tom

Kevin_Falcone · November 15, 2011, 4:36pm

Is there any special trick other than having:

      # The mapping of RT attributes on to LDAP attributes

                        'attr_map'                  =>  {   'Name' => 'cn',

                                                            'EmailAddress' => 'mail',

                                                            'RealName' => 'displayName',

‘ExternalAuthId’ => ‘cn’,

                                                           'Gecos' => 'cn'

                                                        }

In your config to get the email? As it pulls Gecos correctly, but nothing else, Including
ExternalAuthId.

As long as those are the right attributes, and you have rights to read
the ldap recpard, it should be fine.

The debug logs list what data is pulled from LDAP so you can confirm.

-kevin

Thomas_Misilo · November 15, 2011, 4:51pm

Is there any special trick other than having:
      # The mapping of RT attributes on to LDAP attributes

                        'attr_map'                  =>  {   'Name' => 'cn',
‘EmailAddress’ => ‘mail’,

‘RealName’ => ‘displayName’,

‘ExternalAuthId’ => ‘cn’,
                                                           'Gecos' => 'cn'

                                                        }
In your config to get the email? As it pulls Gecos correctly, but nothing else, Including
ExternalAuthId.

As long as those are the right attributes, and you have rights to read the ldap recpard, it should be fine.

The debug logs list what data is pulled from LDAP so you can confirm.

I turned on debug via:

Set($LogToSyslog, “debug”);
Set($LogToScreen, “debug”);
Set($LogToFile, 1);

And I am getting more data in the apache log, but I do not see anything that lists the specific attributes it is getting.

I can browse and read the attributes using ldp in windows.

Thanks for any help,

Tom

Thomas_Misilo · November 15, 2011, 4:55pm

Is there any special trick other than having:
      # The mapping of RT attributes on to LDAP attributes

                        'attr_map'                  =>  {   'Name' => 'cn',
‘EmailAddress’ => ‘mail’,

‘RealName’ => ‘displayName’,

‘ExternalAuthId’ => ‘cn’,
                                                           'Gecos' => 'cn'

                                                        }
In your config to get the email? As it pulls Gecos correctly, but nothing else, Including
ExternalAuthId.

As long as those are the right attributes, and you have rights to read the ldap recpard, it should be fine.

The debug logs list what data is pulled from LDAP so you can confirm.

I turned on debug via:

Set($LogToSyslog, “debug”);
Set($LogToScreen, “debug”);
Set($LogToFile, 1);

And I am getting more data in the apache log, but I do not see anything that lists the specific attributes it is getting.

I can browse and read the attributes using ldp in windows.

Thanks for any help,

Tom

Okay I think I see what my problem is.

In the log is see “== Attrs: displayName,mail,cn,cn,cn” and when I try and select the attributes like that from the AD it doesn’t find them. They are separated by ; I believe with windows AD.

Kevin_Falcone · November 15, 2011, 5:04pm

Okay I think I see what my problem is.

In the log is see “== Attrs: displayName,mail,cn,cn,cn” and when I try and select the attributes like that from the AD it doesn’t find them. They are separated by ; I believe with windows AD.

That’s a debugging convention, not the literal command sent.
The filter is right above it in the logs.

The usual next step is to run ldapsearch manually with the filter and
see what you get back

-kevin

Thomas_Misilo · November 15, 2011, 5:21pm

Okay I think I see what my problem is.

In the log is see “== Attrs: displayName,mail,cn,cn,cn” and when I try and select the attributes like that from the AD it doesn’t find them. They are separated by ; I believe with windows AD.

That’s a debugging convention, not the literal command sent.
The filter is right above it in the logs.

The usual next step is to run ldapsearch manually with the filter and see what you get back

-kevin

Okay I ran;

ldapsearch -h server-x -b “dc=server,dc=tld” -D “CN=user,OU=Group User Accounts,OU=Groups ,DC=server,DC=tld” -W “(&(cn=userIwant))” displayName mail cn

and it displays correctly the following:

cn: userIwant
displayName: Name
mail: userIwant@server.tld

I have tried changing line 304 in LDAP.pm to join with spaces, but that doesn’t work.

Tom

Kevin_Falcone · November 15, 2011, 5:34pm

-----Original Message-----
From: rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com] On Behalf Of Kevin Falcone
Sent: Tuesday, November 15, 2011 12:05 PM
To: rt-users@lists.bestpractical.com
Subject: Re: [rt-users] External Auth (LDAP) and Mail Attribute

Okay I think I see what my problem is.

In the log is see “== Attrs: displayName,mail,cn,cn,cn” and when I try and select the attributes like that from the AD it doesn’t find them. They are separated by ; I believe with windows AD.

That’s a debugging convention, not the literal command sent.
The filter is right above it in the logs.

The usual next step is to run ldapsearch manually with the filter and see what you get back

-kevin

Okay I ran;

ldapsearch -h server-x -b “dc=server,dc=tld” -D “CN=user,OU=Group User Accounts,OU=Groups ,DC=server,DC=tld” -W “(&(cn=userIwant))” displayName mail cn

and it displays correctly the following:

cn: userIwant
displayName: Name
mail: userIwant@server.tld

I have tried changing line 304 in LDAP.pm to join with spaces, but that doesn’t work.

Line 304 is a debug line.

It has absolutely no bearing on the operation of the search and
return.

The actual search is run a few lines later.

-kevin

Kevin_Falcone · November 15, 2011, 5:43pm

-----Original Message-----
From: rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com] On Behalf Of Kevin Falcone
Sent: Tuesday, November 15, 2011 12:05 PM
To: rt-users@lists.bestpractical.com
Subject: Re: [rt-users] External Auth (LDAP) and Mail Attribute

Okay I think I see what my problem is.

In the log is see “== Attrs: displayName,mail,cn,cn,cn” and when I try and select the attributes like that from the AD it doesn’t find them. They are separated by ; I believe with windows AD.

That’s a debugging convention, not the literal command sent.
The filter is right above it in the logs.

The usual next step is to run ldapsearch manually with the filter and see what you get back

-kevin

Okay I ran;

ldapsearch -h server-x -b “dc=server,dc=tld” -D “CN=user,OU=Group User Accounts,OU=Groups ,DC=server,DC=tld” -W “(&(cn=userIwant))” displayName mail cn

and it displays correctly the following:

cn: userIwant
displayName: Name
mail: userIwant@server.tld

I have tried changing line 304 in LDAP.pm to join with spaces, but that doesn’t work.

Line 304 is a debug line.

It has absolutely no bearing on the operation of the search and
return.

The actual search is run a few lines later.

Also - to be clear, you’re concentrating on the part of the code that
checks to see if a user exists. You’re not looking at the later
queries that actually sync the data.

-kevin

Thomas_Misilo · November 15, 2011, 8:21pm

Also - to be clear, you’re concentrating on the part of the code that checks to see if a user exists. You’re not looking at the later queries that actually sync the data.

-kevin

Okay, I have looked through and checked everything but I cannot any errors in rt.log

I see this line: [Tue Nov 15 20:19:22 2011] [debug]: Authentication successful. Now updating user information and attempting login. (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:179) but it doesn’t talk about any of my mappings.

Thanks,

Tom

Kevin_Falcone · November 16, 2011, 4:53pm

Also - to be clear, you’re concentrating on the part of the code that checks to see if a user exists. You’re not looking at the later queries that actually sync the data.

-kevin

Okay, I have looked through and checked everything but I cannot any errors in rt.log

I see this line: [Tue Nov 15 20:19:22 2011] [debug]: Authentication successful. Now updating user information and attempting login. (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:179) but it doesn’t talk about any of my mappings.

Unfortunately, we haven’t seen a full config or log so it’s really
hard to comment on what’s happening.

-kevin

Thomas_Misilo · November 16, 2011, 5:28pm

Also - to be clear, you’re concentrating on the part of the code that checks to see if a user exists. You’re not looking at the later queries that actually sync the data.

-kevin

Okay, I have looked through and checked everything but I cannot any
errors in rt.log

I see this line: [Tue Nov 15 20:19:22 2011] [debug]: Authentication successful. Now updating user information and attempting login. (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:179) but it doesn’t talk about any of my mappings.

Unfortunately, we haven’t seen a full config or log so it’s really hard to comment on what’s happening.

-kevin

Full Config:

Any configuration directives you include here will override

RT’s default configuration file, RT_Config.pm

To include a directive here, just copy the equivalent statement

from RT_Config.pm and change the value. We’ve included a single

sample value below.

This file is actually a perl module, so you can include valid

perl code, as well.

The converse is also true, if this file isn’t valid perl, you’re

going to run into trouble. To check your SiteConfig file, use

this comamnd:

perl -c /path/to/your/etc/RT_SiteConfig.pm

You must restart your webserver after making changes to this file.

Set( $rtname, ‘Evans Library’);
Set($Organization, “url.tld”);
Set($WebDomain, “url.tld”);
Set($WebPort, 80);
Set($WebPath, “/rt”);
Set($DatabaseHost, “sqlserver.tld”);
Set($DatabaseRTHost, “url.tld”);
Set($DatabaseUser, “rt4”);
Set($DatabasePassword, q{hello});
Set($DatabaseName, q{rt4});
Set($OwnerEmail, ‘owner@url.tld’);

Set($LogToSyslog, “debug”);
Set($LogToScreen, “debug”);
Set($LogToFile, “debug”);

Set($CanonicalizeOnCreate, 1);

Set($ValidateUserEmailAddresses, 1);
Set($AutoCreateNonExternalUsers, 1);
Set($ExternalAuthPriority, [ ‘AD’
]
);

Set($ExternalAuthPriority, [ ‘AD’
]
);

Set($ExternalSettings, {
‘AD’ => {
‘type’ => ‘ldap’,
‘server’ => ‘ad.tld’,
‘user’ => ‘CN=user,OU=Group User Accounts,OU=Groups,DC=ad,DC=tld’,
‘pass’ => ‘bindingpassword’,
‘base’ => ‘DC=ad,DC=tld’,
# The filter to use to match RT-Users
‘filter’ => ‘(objectClass=*)’,
‘d_filter’ => ‘(userAccountControl:1.2.840.113556.1.4.803:=2)’,
# Should we try to use TLS to encrypt connections?
‘tls’ => 0,
# SSL Version to provide to Net::SSLeay if using SSL
‘ssl_version’ => 3,
# What other args should I pass to Net::LDAP->new($host,@args)?
‘net_ldap_args’ => [ version => 3 ],
# Does authentication depend on group membership? What group name?
#‘group’ => ‘Internal Site Access’,
# What is the attribute for the group object that determines membership?
#‘group_attr’ => ‘memberOf’,
## RT ATTRIBUTE MATCHING SECTION
# The list of RT attributes that uniquely identify a user
# This example shows what you can specify.. I recommend reducing this
# to just the Name and EmailAddress to save encountering problems later.
‘attr_match_list’ => [ ‘Name’,
‘EmailAddress’
],
# The mapping of RT attributes on to LDAP attributes
‘attr_map’ => { ‘Name’ => ‘sAMAccountName’,
‘EmailAddress’ => ‘mail’,
‘Organization’ => ‘physicalDeliveryOfficeName’,
‘RealName’ => ‘displayName’,
‘ExternalContactInfoId’ => ‘dn’,
‘ExternalAuthId’ => ‘sAMAccountName’,
‘Gecos’ => ‘sAMAccountName’,
‘WorkPhone’ => ‘telephoneNumber’
}
}});

Set( @Plugins, (qw(RT::Authen::ExternalAuth)) );

1;

Logs:

[Wed Nov 16 17:26:07 2011] [debug]: You’ve enabled GraphViz, but we couldn’t load the module: Can’t locate GraphViz.pm in @INC (@INC contains: /opt/rt4/sbin/../local/lib /opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib /opt/rt4/sbin/../lib /usr/lib/perl5/site_perl /usr/share/perl5/site_perl /usr/lib/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/core_perl /usr/share/perl5/core_perl . /etc/httpd) at /opt/rt4/sbin/../lib/RT/Config.pm line 558. (/opt/rt4/sbin/../lib/RT/Config.pm:559)
[Wed Nov 16 17:26:07 2011] [debug]: The RTAddressRegexp option is not set in the config. Not setting this option results in additional SQL queries to check whether each address belongs to RT or not. It is especially important to set this option if RT recieves emails on addresses that are not in the database or config. (/opt/rt4/sbin/../lib/RT/Config.pm:454)
[Wed Nov 16 17:26:09 2011] [debug]: You’ve enabled GraphViz, but we couldn’t load the module: Can’t locate GraphViz.pm in @INC (@INC contains: /opt/rt4/sbin/../local/lib /opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib /opt/rt4/sbin/../lib /usr/lib/perl5/site_perl /usr/share/perl5/site_perl /usr/lib/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib/perl5/core_perl /usr/share/perl5/core_perl . /etc/httpd) at /opt/rt4/sbin/../lib/RT/Config.pm line 558. (/opt/rt4/sbin/../lib/RT/Config.pm:559)
[Wed Nov 16 17:26:09 2011] [debug]: The RTAddressRegexp option is not set in the config. Not setting this option results in additional SQL queries to check whether each address belongs to RT or not. It is especially important to set this option if RT recieves emails on addresses that are not in the database or config. (/opt/rt4/sbin/../lib/RT/Config.pm:454)
[Wed Nov 16 17:26:18 2011] [debug]: ExternalInfoPriority not defined. User information (including user enabled/disabled cannot be externally-sourced (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:40)
[Wed Nov 16 17:26:18 2011] [debug]: Attempting to use external auth service: AD (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:64)
[Wed Nov 16 17:26:18 2011] [debug]: SSO Failed and no user to test with. Nexting (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:92)
[Wed Nov 16 17:26:18 2011] [debug]: Autohandler called ExternalAuth. Response: (0, No User) (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/html/Elements/DoAuth:11)
[Wed Nov 16 17:26:18 2011] [debug]: ExternalInfoPriority not defined. User information (including user enabled/disabled cannot be externally-sourced (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:40)
[Wed Nov 16 17:26:18 2011] [debug]: Attempting to use external auth service: AD (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:64)
[Wed Nov 16 17:26:18 2011] [debug]: SSO Failed and no user to test with. Nexting (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:92)
[Wed Nov 16 17:26:18 2011] [debug]: Autohandler called ExternalAuth. Response: (0, No User) (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/html/Elements/DoAuth:11)
[Wed Nov 16 17:26:24 2011] [debug]: ExternalInfoPriority not defined. User information (including user enabled/disabled cannot be externally-sourced (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:40)
[Wed Nov 16 17:26:24 2011] [debug]: Attempting to use external auth service: AD (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:64)
[Wed Nov 16 17:26:24 2011] [debug]: Calling UserExists with $username (iamuser) and $service (AD) (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:105)
[Wed Nov 16 17:26:24 2011] [debug]: UserExists params:
username: iamuser , service: AD (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:274)
[Wed Nov 16 17:26:24 2011] [debug]: LDAP Search === Base: DC=AD,DC=tld == Filter: (&(objectClass=)(sAMAccountName=iamuser)) == Attrs: telephoneNumber,displayName,dn,physicalDeliveryOfficeName,mail,sAMAccountName,sAMAccountName,sAMAccountName (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:304)
[Wed Nov 16 17:26:24 2011] [debug]: Password validation required for service - Executing… (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:155)
[Wed Nov 16 17:26:24 2011] [debug]: Trying external auth service: AD (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:16)
[Wed Nov 16 17:26:24 2011] [debug]: LDAP Search === Base: DC=AD,DC=tld == Filter: (&(sAMAccountName=iamuser)(objectClass=)) == Attrs: dn (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:43)
[Wed Nov 16 17:26:24 2011] [debug]: Found LDAP DN: CN=iamuser,OU=People,DC=AD,DC=tld (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:75)
[Wed Nov 16 17:26:24 2011] [info]: RT::Authen::ExternalAuth::LDAP::GetAuth External Auth OK ( AD ): iamuser (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:139)
[Wed Nov 16 17:26:24 2011] [debug]: LDAP password validation result: 1 (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:334)
[Wed Nov 16 17:26:24 2011] [debug]: Password Validation Check Result: 1 (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:159)
[Wed Nov 16 17:26:24 2011] [debug]: Authentication successful. Now updating user information and attempting login. (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:179)
[Wed Nov 16 17:26:24 2011] [info]: Successful login for iamuser from 163.118.10.111 (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:219)
[Wed Nov 16 17:26:24 2011] [debug]: Autohandler called ExternalAuth. Response: (1, Successful login) (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/html/Elements/DoAuth:11)

Kevin_Falcone · November 16, 2011, 5:49pm

Set($ExternalAuthPriority, [ ‘AD’
]
);

Set($ExternalAuthPriority, [ ‘AD’
]
);

Those are the same config setting twice, you haven’t set InfoPriority
so it’ll never sync data.

-kevin

Thomas_Misilo · November 16, 2011, 5:53pm

Set($ExternalAuthPriority, [ ‘AD’
]
);

Set($ExternalAuthPriority, [ ‘AD’
]
);

Those are the same config setting twice, you haven’t set InfoPriority so it’ll never sync data.

-kevin

Thanks Kevin. Didn’t even realize I copied the same line twice.

Everything seems to be working great now!

Tom