[rt-users] RT::Authen::ExternalAuth - prevents creation of users

[Robin Winslow]

Hi.

I've had a lot of woe with trying to use this module. First off, I
didn't expect that simply installing the module would effect our
current RT functionality without even doing anything.

All I did was:
> cpan -i RT::Authen::ExternalAuth

This made an error message come up when trying to log into RT:
RT::User::UpdateFromExternal Unimplemented in HTML::Mason::Commands.
(/usr/share/request-tracker3.6/html/Callbacks/ExternalAuth/autohandler/Auth
line 73)

However, I just had to refresh and it let me log in. And once I added
the ExternalAuth config variables to RT_SiteConfig.pm these problems
went away.
$ExternalAuthPriority
and
$ExternalSettings

This seemed to work to start with: if someone logged in, it would
authenticate against ActiveDirectory (my external auth source) and
then it would create a user internally (with no permissions) and log
them in.

However, later (not sure what I did) it stopped allowed me to create
new users - meaning the over process didn't work, and new requests
couldn't be sent to RT, as creating users is an important part of it.
I agonised over what was causing this for ages.

Eventually I started afresh on a new box, running Ubuntu. I followed
debian package install instructions - to install rt-3.6.
After I had it working fine. Then all I did was install ExternalAuth
and restarted apache and it did the same error with preventing users
being created.

I have decided to completely remove RT and start again and try to use
the NTLM module instead, but I just thought I'd let you know of these
errors.

Suggestions:
> Please put a warning on http://wiki.bestpractical.com/view/ExternalAuth that the mere installation of the module may break your RT.
> If you can, set it up to be installed via aptitude (or apt-get) because then it can at least be removed easily.
> Please please please stop if from changing your RT configuration merely by installing it. You should be able to install it without worry, and then activate/de-activate it independently.

Regards.
Robin.