Chapter 11. LDAP Integration

OTRS is capable of using an LDAP directory as source in several places. The following HowTo describes the use of an Active Directory server together with OTRS. The example may serve for the basic understanding of binding against an LDAP server, too.

Active Directory

This section will explain how to integrate OTRS with Microsoft's Active Directory using its LDAP features to provide authentication for both helpdesk staff and users, as well as information for the customer user backend.

We make the assumption that OTRS is running on a Linux server and that you know how to work with Microsoft Active Directory and its admin tools.

Naming of particular products or brands should not be seen as endorsements.

You are strongly recommended to take a backup of your system before major installation and backups at regular intervals.

Preparations

The only non standard requirement for the OTRS server is that the Perl module Net::LDAP is installed. This module can be downloaded from http://ldap.perl.org/

It is also a good idea to first create a user in OTRS using the standard DB authentication mechanism. If you configure LDAP/AD authentication before you have created any users, you won't be able to log on. Create a user that you give admin rights to and which corresponds to the username listed in Active Directory.

In order to use the LDAP facility of OTRS against Windows Active Directory, one would have to have at least one Active Directory (hereby referred to as AD) Controller. The AD controller must also be a Global Catalog server in order to allow authentication against the AD tree.

One can use Active Directory running on both Windows 2000 and Windows 2003.

Details needed during configuration of OTRS and LDAP.

  • Hostname of your AD server

  • Base DN of your Active Directory tree

  • Username and password that will handle LDAP lookups (AD does not allow anonymous LDAP lookups)

Configuration

Configuration of Active Directory

Create a new user in AD using "AD Users and Computers". The user will only need to be a normal user with "Domain User" membership. If a domain policy exists which enforces a password change on a regular basis, configure this users Account settings to "Password Never Expires".

OTRS LDAP options

OTRS provides three different ways of using LDAP.

  • Authenticate Agent users

  • Authenticate Customer users

  • Get customer User information

The two customer modules are best used together, or a lot of manual work is needed. This howto will only cover the two used together.

Agent Authentication

Use your favorite editor to edit the Config.pm file of your OTRS installation. This file is usually located at <OTRS_HOME>/Kernel/Config.pm.

Start by adding:

Example 11-1. Kernel/Config.pm - AuthModule

   $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';

This will change the authentication module and use LDAP.

Next, add the following three lines:

Example 11-2. Kernel/Config.pm - AuthModule::LDAP settings

   $Self->{'AuthModule::LDAP::Host'} = '[AD_server]'; 
   $Self->{'AuthModule::LDAP::BaseDN'} = '[base_dn]';
   $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';

Replace [AD_server] with the hostname or IP address of your AD domain controller.. i.e.: w2kad.example.com.

Replace [base_dn] with the Distinguish Name of your AD forest. This follows the syntax of "dc=example, dc=com".

An easy way to find the [base_dn] is by looking at the name which "AD Users and Computers" shows when you view the AD tree structure. It will show the domainname as "example.com" or "subdomain.example.com" according to how your AD forest was first set up. To transfer that to a Base DN syntax, the above examples will become "dc=example, dc=com" and "dc=subdomain, dc=example, dc=com".

If you still can't find your base DN of your AD forest, you can use tools like LDIFDE (found on your AD controller) or ADSI Edit (found on the W2K Support Kit CD/Resource Kit CD).

As Active Directory uses a different account object than a normal LDAP tree, we have to use specify "sAMAccountName" for the UID object throughout the configuration.

Next you will need to specify the login account used to communicate with the AD. This is done by configuring the following settings:

Example 11-3. Kernel/Config.pm - AuthModule::LDAP::SearchUser settings

  $Self->{'AuthModule::LDAP::SearchUserDN'} = '[user_dn]';
  $Self->{'AuthModule::LDAP::SearchUserPw'} = '[password]';

Replace [user_dn] with the full DN of your selected AD/OTRS config user. Follow standard LDAP syntax. The full DN will differ depending on which container you have added the user using "AD Users and Computers". If you placed it in the existing "Users" container, the syntax will be "cn=FirstName Lastname, cn=Users, [base_dn]". If one is unsure about the complete DN for this user, run LDIFDE.EXE on your AD controller and search for the user.

Replace [password] with the password you selected for this account.

Customer Authentication

The configuration of the authentication module for customers (end users) is specified by the following parameters:

Example 11-4. Kernel/Config.pm - Customer::AuthModule LDAP settings

  $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
  $Self->{'Customer::AuthModule::LDAP::Host'} = '[AD_server]';
  $Self->{'Customer::AuthModule::LDAP::BaseDN'} = '[base_dn]';
  $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';
  $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = '[user_dn]';
  $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '[password]';

Replace [AD_server] with the full hostname or IP address of your AD domain controller.. i.e.: w2kad.example.com.

Replace [base_dn] with the DN of where your customer users are location in the AD tree. If all customer users are located under a "People" container, specify that as the base_dn for Customer Auth, ie. "ou=People, dc=example, dc=com". If you have users in multiple containers, you may want to add multiple LDAP sources. Feel free to use $Self->{CustomerUser1} throughout $Self->{CustomerUser10}.

Replace [user_dn] with your selected OTRS/AD user and [password] with its corresponding password.

Get Customer User Information

The customer user information configuration consists of a configuration setting similar to this:

Example 11-5. Kernel/Config.pm - CustomerUser::LDAP settings

  $Self->{CustomerUser} = {
    Module => 'Kernel::System::CustomerUser::LDAP',
    Params => {
      Host => '[AD_server]',
      BaseDN => '[base_dn]',
      SSCOPE => 'sub',
      UserDN => '[user_dn]',
      UserPw => '[password]',
    },
    CustomerKey => 'sAMAccountName',
    CustomerID => '[customer_id]',
    CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],
    CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],
    CustomerUserPostMasterSearchFields => ['mail'],
    CustomerUserNameFields => ['givenname', 'sn'],
    Map => [
      # note: Login, Email and CustomerID needed!
      # var, frontend, storage, shown, required, storage-type
#       [ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],
      [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
      [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
      [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
      [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],
      [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],
#       [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],
#       [ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],
#       [ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],
    ],
  };

Replace [AD_server] with the name or IP address of your AD controller.

Replace [base_dn] with the location of your users using LDAP syntax, ie. "ou=People, dc=example, dc=com".

Replace [user_dn] and [password] as usual.

Replace [customer_id] with the id you want to show your users as: A usual selection here is 'mail' or 'o'.

CustomerUserListFields can be changed to specify how you want the Customers listed when creating/working tickets. With the default setting above, the customer will be listed as: "username Lastname email@address"

If you want to only list email addresses, just remove the other two entries and leave "'mail'". You can also add other fields to this list if you know the LDAP attribute name of the fields.

CustomerUserSearchFields has the same options as CustomerUserListFields. When creating a new ticket and using the "Search Customer" function, the listed fields will be searched according to your criteria. Add the attribute 'o' here to allow entering an organization's name to list all customer user from that organization, provided the information is present in LDAP/AD.

Tips & Tricks

Control who's let in

Prevent customer users and agents from logging on to the front-end when you have a large AD structure where agents and end users are located in the same OU's. You do so by creating a posixGroup somewhere and fill it with either the UID or the DN of the wanted members.

Example 11-6. Kernel/Config.pm - GroupDN for Agents

  $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsallow_A, ou=posixGroups, dc=example, dc=com';
  $Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
 #$Self->{'AuthModule::LDAP::UserAttr'} = 'UID';
  $Self->{'AuthModule::LDAP::UserAttr'} = 'DN';

Example 11-7. Kernel/Config.pm - GroupDN for Customers

  $Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'cn=otrsallow_C, ou=posixGroups, dc=example, dc=com';
  $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
 #$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';
  $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';

Config Example

This is a complete example of how OTRS can be configured to authenticate both agents and customers, as well as provide info on customers via LDAP. The database settings are maintained.

Settings used:

  • Windows AD Controller: w2kad.example.com

  • Windows OTRS Lookup User: otrs (Full Name: OTRS Service)

  • Windows OTRS user Password: secret

  • Windows OTRS Lookup user DN: cn=OTRS Service, ou=People, dc=example, dc=com

  • Windows Domain: example.com

  • Windows LDAP Base DN: dc=example, dc=com

  • Windows Users Container: People

  • Windows Users LDAP DN: ou=People, dc=example, dc=com

  • Windows Agents LDAP DN: ou=People, dc=example, dc=com

Example 11-8. Kernel/Config.pm - AuthModule LDAP settings

  #------------------------------------------------------------------------
  # Start of Example Config
  $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
  $Self->{'AuthModule::LDAP::Host'} = 'w2kad.example.com';
  $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example, dc=com';
  $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';

  $Self->{'AuthModule::LDAP::SearchUserDN'} = '';
  $Self->{'AuthModule::LDAP::SearchUserPw'} = 'secret';


  # This is an example configuration for an LDAP auth. backend.
  # (take care that Net::LDAP is installed!)
  $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
  $Self->{'Customer::AuthModule::LDAP::Host'} = 'w2kad.example.com';
  $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'ou=People, dc=example, dc=com';
  $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';

  # The following is valid but would only be necessary if the
  # anonymous user do NOT have permission to read from the LDAP tree
  $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'cn=OTRS Service, ou=People, dc=example, dc=com';
  $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'secret';

  # CustomerUser
  # (customer user database backend and settings)
    $Self->{CustomerUser} = {
        Name => 'Datenbank',
        Module => 'Kernel::System::CustomerUser::DB',
        Params => { Table => 'customer_user',
            # to use an external database
#           DSN => 'DBI:odbc:yourdsn',
#           DSN => 'DBI:mysql:database=customerdb;host=customerdbhost',
#           User => '', Password => '',
        },
        # customer uniq id
        CustomerKey => 'login',
        CustomerID => 'customer_id',
        CustomerValid => 'valid_id',
        CustomerUserListFields => ['first_name', 'last_name', 'email'],
#       CustomerUserListFields => ['login', 'first_name', 'last_name', 'customer_id', 'email'],
        CustomerUserSearchFields => ['login', 'last_name', 'customer_id'],
        CustomerUserSearchPrefix => '',
        CustomerUserSearchSuffix => '*',
        CustomerUserSearchListLimit => 250,
        CustomerUserPostMasterSearchFields => ['email'],
        CustomerUserNameFields => ['salutation', 'first_name', 'last_name'],
#       ReadOnly => 1,
        Map => [
            # note: Login, Email and CustomerID needed!
            # var, frontend, storage, shown, required, storage-type, http-link
            [ 'UserSalutation', 'Salutation', 'salutation', 1, 0, 'var' ],
            [ 'UserFirstname', 'Firstname', 'first_name', 1, 1, 'var' ],
            [ 'UserLastname', 'Lastname', 'last_name', 1, 1, 'var' ],
            [ 'UserLogin', 'Login', 'login', 1, 1, 'var' ],
            [ 'UserPassword', 'Password', 'pw', 0, 1, 'var' ],
            [ 'UserEmail', 'Email', 'email', 0, 1, 'var' ],
            [ 'UserCustomerID', 'CustomerID', 'customer_id', 0, 1, 'var' ],
            [ 'UserComment', 'Comment', 'comments', 1, 0, 'var' ],
            [ 'ValidID', 'Valid', 'valid_id', 0, 1, 'int' ],
        ],
    };

  # CustomerUser1
  # (customer user ldap backend and settings)
  $Self->{CustomerUser1} = {
    Module => 'Kernel::System::CustomerUser::LDAP',
    Params => {
      # ldap host
      Host => 'w2kad.example.com',
      # ldap base dn
      BaseDN => 'ou=People, dc=example, dc=com',
      # search scope (one|sub)
      SSCOPE => 'sub',
      # The following is valid but would only be necessary if the
      # anonymous user does NOT have permission to read from the LDAP tree
      UserDN => 'cn=OTRS Service, ou=People, dc=example, dc=com',
      UserPw => 'secret',
      AlwaysFilter => '',
      SourceCharset => 'utf-8',
      DestCharset => 'iso-8859-1',
    },
    # customer uniq id
    CustomerKey => 'sAMAccountName',
    # customer #
    CustomerID => 'mail',
    CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],
    CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],
    CustomerUserSearchPrefix => '',
    CustomerUserSearchSuffix => '*',
    CustomerUserSearchListLimit => 250,
    CustomerUserPostMasterSearchFields => ['mail'],
    CustomerUserNameFields => ['givenname', 'sn'],
    Map => [
      # note: Login, Email and CustomerID needed!
      # var, frontend, storage, shown, required, storage-type
      #[ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],
      [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],
      [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],
      [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],
      [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],
      [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],
      [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],
      #[ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],
      #[ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],
    ],
  };
  # End example config
  #------------------------------------------------------------------------