LDAP-Active Directory external authentification search/authentificate users in a subtree

RT Users
1

Hello,

I have set up a new Request Tracker server, that uses the
RT::Authen::*ExternalAuth
*extension.
Everything is working fine, and i am able to authenticate users account
from the Active Directory into RT, the problem is that i have is that my
organisation has a complicated structure, with many OU, and the ldap
search for users from what i could figure it out is made having as a scope
just one level, what would i need is to have as a scope a whole Subtree.

So let me give you an example.

My base is in my RT_SiteConfig.pm file is : dc=mydomain, dc=local
I am able to log into Request Tracker with a user account contain in
CN=Users, DC=mydomain, DC=local

But i am unable to log into Request Tracker with a user account contain in

OU=Users,OU=DepartmentName,DC=mydomain,DC=local

Many thanks for your future responses, or hints, i really appreciate them.

2

I have set up a new Request Tracker server, that uses
the RT::Authen::*ExternalAuth *extension.
Everything is working fine, and i am able to authenticate users account
from the Active Directory into RT, the problem is that i have is that my
organisation has a complicated structure, with many OU, and the ldap
search for users from what i could figure it out is made having as a
scope just one level, what would i need is to have as a scope a whole
Subtree.

The whole subtree is searched. Here’s the line of code:

and the documentation for the default it’s relying on:

You should post your entire config, and error messages, etc.

3

It searches from the base down (subtree). Sadly, it looks like his “base”
are not under a single container. (limit less, correct me if I
misunderstood).

You might be able to defined more auth services, each one identical,
except with different bases, to auth against.

Thanks,
Jok
| Joachim Thuau | IT Systems Engineer - Linux / SpaceX |On 8/21/12 8:11 AM, “Thomas Sibley” trs@bestpractical.com wrote:

On 08/21/2012 05:58 AM, Limit Less wrote:

I have set up a new Request Tracker server, that uses
the RT::Authen::*ExternalAuth *extension.
Everything is working fine, and i am able to authenticate users account
from the Active Directory into RT, the problem is that i have is that my
organisation has a complicated structure, with many OU, and the ldap
search for users from what i could figure it out is made having as a
scope just one level, what would i need is to have as a scope a whole
Subtree.

The whole subtree is searched. Here’s the line of code:

rt-authen-externalauth/lib/RT at master · bestpractical/rt-authen-externalauth · GitHub
/Authen/ExternalAuth/LDAP.pm#L57

and the documentation for the default it’s relying on:

Net::LDAP - metacpan.org

You should post your entire config, and error messages, etc.

4

Hello everybody and thanks for your suggestions,
The actual problem was that i was using to authenificate against RT normal
user format from Active Directory, and Request Tracker ask for the
pre-Windows 2000 username format, and in my situation the two are different.
The problems is solved.
Anyway is there a possibility to force RT to use the normal user format?

Many Thanks,On Tue, Aug 21, 2012 at 5:34 PM, Joachim Thuau JThuau@spacex.com wrote:

It searches from the base down (subtree). Sadly, it looks like his “base”
are not under a single container. (limit less, correct me if I
misunderstood).

You might be able to defined more auth services, each one identical,
except with different bases, to auth against.

Thanks,
Jok

| Joachim Thuau | IT Systems Engineer - Linux / SpaceX |

On 8/21/12 8:11 AM, “Thomas Sibley” trs@bestpractical.com wrote:

On 08/21/2012 05:58 AM, Limit Less wrote:

I have set up a new Request Tracker server, that uses
the RT::Authen::*ExternalAuth *extension.
Everything is working fine, and i am able to authenticate users account
from the Active Directory into RT, the problem is that i have is that my
organisation has a complicated structure, with many OU, and the ldap
search for users from what i could figure it out is made having as a
scope just one level, what would i need is to have as a scope a whole
Subtree.

The whole subtree is searched. Here’s the line of code:

rt-authen-externalauth/lib/RT at master · bestpractical/rt-authen-externalauth · GitHub

/Authen/ExternalAuth/LDAP.pm#L57

and the documentation for the default it’s relying on:

Net::LDAP - metacpan.org

You should post your entire config, and error messages, etc.

5

Hello everybody and thanks for your suggestions,
The actual problem was that i was using to authenificate against RT
normal user format from Active Directory, and Request Tracker ask for
the pre-Windows 2000 username format, and in my situation the two are
different.
The problems is solved.
Anyway is there a possibility to force RT to use the normal user format?

Can you show us an example of the difference in the usernames?