<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Century Gothic";
panose-1:2 11 5 2 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We’re running RT 3.8.8 and using RT-Authen-ExternalAuth 0.08 to authenticate against Active Directory. Any <i>new</i> AD account I create can logon to RT, and have corresponding account created in RT, if it is in the necessary security group, but older accounts, mine included, pass the password test, but fail at the group membership test, and fail to logon. The RT account, however, does get created. The log entries look like this…<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Jan 5 15:12:29 RT388 RT: AD_GROUP2 AUTH FAILED: <i>my-name</i> (/opt/rt3/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:127)<o:p></o:p></p><p class=MsoNormal>Jan 5 15:12:29 RT388 RT: FAILED LOGIN for <i>my-name</i> from 192.168.1.1 (/opt/rt3/bin/../lib/RT/Interface/Web.pm:424)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>As I said above, older accounts (3 years plus) which are members of the group being tested fail to fully authenticate, while new accounts which are members of the same group, authenticate properly. In fact, If I comment out the group test from RT_SiteConfig.pm, I can logon to RT with my <i>old</i> account.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I don’t know if this is pertinent, but we upgraded to Exchange 2007 a few months back, and I wonder if the AD schema changes could be affecting things? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Century Gothic","sans-serif";color:black'>Lyle.</span><span style='font-size:8.0pt;font-family:"Century Gothic","sans-serif";color:black'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>