<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I turned on logging on the Domain Controller and tried to auto-create a user by email. There weren’t any indications on the DC of an LDAP inquiry, so I’m wondering if I’m missing a perl module. Whereas command-line ldapsearch completes successfully and I see logging on the DC. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I don’t see anything indicative in /var/log/messages other than the errors I included below. Thanks for any suggestions.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Mike<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com] <b>On Behalf Of </b>mjames@guesswho.com<br><b>Sent:</b> Monday, November 14, 2011 4:28 PM<br><b>To:</b> rt-users@lists.bestpractical.com<br><b>Subject:</b> [rt-users] LDAP authentication problem<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi, I know there are tons of questions on the list about getting LDAP authentication to work. And I have done it before at other employers, so I’m even more frustrated… <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here’s what I’ve got:<o:p></o:p></p><p class=MsoNormal>RT 4.0.2 on CentOS 5.7 <o:p></o:p></p><p class=MsoNormal>RT-Authen-ExternalAuth-0.09.tar.gz<o:p></o:p></p><p class=MsoNormal>Active Directory on Server 2008 R2<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I set up the /opt/rt4/local/plugins/RT-Authen-ExternalAuth/etc/RT_SiteConfig.pm file with the LDAP parameters that I thought would work. Also, I can do a successful ldapsearch from the command line against the AD server with the same credentials.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here’s an ldapsearch run from the CLI on my RT server. This returns a successful result from the domain controller.<o:p></o:p></p><p class=MsoNormal>[root@host ~]# ldapsearch -h dc-01.mydomain.com -x -b "dc=mydomain,dc=com" -D "cn=mike james,cn=users,dc=mydomain,dc=com" -w 'mypasswd' “<a href="mailto:mail=anyuser@mydomain.com">mail=anyuser@mydomain.com</a>”<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here’s the LDAP portion of my config file. I got the d_filter from a google search. It was mentioned in a couple of places as being the correct string for disabled users.<o:p></o:p></p><p class=MsoNormal># AN EXAMPLE LDAP SERVICE<o:p></o:p></p><p class=MsoNormal> 'My_LDAP' => { ## GENERIC SECTION<o:p></o:p></p><p class=MsoNormal> 'type' => 'ldap',<o:p></o:p></p><p class=MsoNormal> 'server' => 'dc-01.mydomain.com',<o:p></o:p></p><p class=MsoNormal> 'user' => 'cn=mike james,cn=users,dc=mydomain,dc=com',<o:p></o:p></p><p class=MsoNormal> 'pass' => 'mypasswd',<o:p></o:p></p><p class=MsoNormal> 'base' => 'dc=mydomain,dc=com',<o:p></o:p></p><p class=MsoNormal> 'filter' => '(objectClass=*)',<o:p></o:p></p><p class=MsoNormal> 'd_filter' => '(userAccountControl:1.2.840.113556.1.4.803:=2))',<o:p></o:p></p><p class=MsoNormal> 'tls' => 0,<o:p></o:p></p><p class=MsoNormal> 'ssl_version' => 3,<o:p></o:p></p><p class=MsoNormal> 'net_ldap_args' => [ version => 3 ],<o:p></o:p></p><p class=MsoNormal> 'attr_match_list' => [ 'Name',<o:p></o:p></p><p class=MsoNormal style='text-indent:.5in'> 'EmailAddress'<o:p></o:p></p><p class=MsoNormal> ],<o:p></o:p></p><p class=MsoNormal> # The mapping of RT attributes on to LDAP attributes<o:p></o:p></p><p class=MsoNormal> 'attr_map' => { 'Name' => 'sAMAccountName',<o:p></o:p></p><p class=MsoNormal> 'EmailAddress' => 'mail',<o:p></o:p></p><p class=MsoNormal> 'RealName' => 'cn'<o:p></o:p></p><p class=MsoNormal> }<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>All requests for new tickets are being rejected, and it’s making me crazy. Any ideas?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: Use of uninitialized value in join or string at /usr/lib/perl5/site_perl/5.8.8/Log/Dispatch.pm line 23. (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:458)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: RT::Authen::ExternalAuth::CanonicalizeUserInfo returning Comments: Autocreated on ticket submission, Disabled: 0, EmailAddress: <a href="mailto:mjames@mydomain.com">mjames@mydomain.com</a>, Name: <a href="mailto:mjames@mydomain.com">mjames@mydomain.com</a>, Password: , Privileged: 0, RealName: (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:536)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: User creation failed in mailgateway: Could not set user info (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:244)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: Couldn't load user 'mjames@mydomain.com'.giving up (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:1016)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: User 'mjames@mydomain.com' could not be loaded in the mail gateway (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:244)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: RT could not load a valid user, and RT's configuration does not allow for the creation of a new user for this email (<a href="mailto:mjames@mydomain.com">mjames@mydomain.com</a>). You might need to grant 'Everyone' the right 'CreateTicket' for the queue general. (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:244)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: RT could not load a valid user, and RT's configuration does not allow for the creation of a new user for your email. (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:244)<o:p></o:p></p><p class=MsoNormal>Nov 14 15:07:46 x-tracker-01 RT: Could not record email: Could not load a valid user (/opt/rt4/share/html/REST/1.0/NoAuth/mail-gateway:75)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks, Mike<o:p></o:p></p></div></body></html>