<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_quote"><div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="gmail_quote"><div><div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_quote"><div><div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>>> On Tue, Jun 12, 2012 at 5:38 AM, Asif Iqbal <<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>> wrote:<br>
>> > I am using external authentication against our corporate AD server<br>
>> > successfully, using the RT::Authen::ExternalAuth.<br>
>> ><br>
>> > But I like the authorization done against internal db for user account.<br>
>> ><br>
>> > Just because a user has a valid AD credential is not enough for him/her<br>
>> > to<br>
>> > be able to login to our RT. We like<br>
>> > to manage the login by creating the user account into internal db using<br>
>> > the<br>
>> > Web UI.<br>
>> ><br>
>> > So we still like the user to use their AD credential and no need to<br>
>> > remember<br>
>> > another password, and at the same time<br>
>> > only be able to login if the same username is available in internal db.<br>
>> ><br>
>> > Is that possible? Any suggestion/tip is appreciated.<br>
>><br>
>> Yes, it is possible, but not like you want it to be.<br>
>><br>
>> As far as I can see users need AD record anyway, just mark them<br>
>> somehow in AD and use this marking in ExternalAuth filter.<br>
>><br>
><br>
> I have no access to AD. It belongs to corporate group and will not be able<br>
> to manage a group.<br>
><br>
> There is no way to control the Authorization part locally?<br>
<br>
</div>Not out of the box. Patch external auth module and add option to avoid<br>
creation of new users.<br>
<div><div><br></div></div></blockquote><div><br></div></div></div><div>So I could just comment this section out to avoid user create as one option? I know, ugly.</div><div><br></div><div> <a href="http://paste.ubuntu.com/1039210/" target="_blank">http://paste.ubuntu.com/1039210/</a></div>
<div>
<div><br></div></div></div></blockquote><div><br></div></div></div><div>This seem to have worked.</div><div><br></div><div> <a href="http://paste.ubuntu.com/1039233/" target="_blank">http://paste.ubuntu.com/1039233/</a></div>
<div><div><br></div></div></div></blockquote><div><br></div><div><br></div></div></div><div>fixed some of the comments to reflect the intention</div><div><br></div><div><a href="http://paste.ubuntu.com/1039239/" target="_blank">http://paste.ubuntu.com/1039239/</a></div>
<div><div class="h5">
<div><br></div><div> </div></div></div></div></blockquote><div><br></div><div><br></div><div>I am getting this error after applying RT::Authen::ExternalAuth, and patched to disable the "user creation</div><div>part". This is the patch I applied <a href="http://paste.ubuntu.com/1039239/">http://paste.ubuntu.com/1039239/</a> .</div>
<div><br></div><div><br></div><div><div>[Sat Jun 16 04:03:50 2012] [info]: RT::Authen::ExternalAuth::CanonicalizeUserInfo returning Comments: Autocreated on ticket submission, Disabled: , EmailAddress: <a href="mailto:service@example.com">service@example.com</a>, Name: <a href="mailto:service@example.com">service@example.com</a>, Password: , Privileged: , RealName: Service Example (/opt/rt3/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:633)</div>
<div>[Sat Jun 16 04:03:50 2012] [crit]: User creation failed in mailgateway: Could not set user info (/opt/rt3/bin/../lib/RT/Interface/Email.pm:244)</div><div>[Sat Jun 16 04:03:50 2012] [warning]: Couldn't load user '<a href="mailto:service@example.com">service@example.com</a>'.giving up (/opt/rt3/bin/../lib/RT/Interface/Email.pm:806)</div>
<div>[Sat Jun 16 04:03:50 2012] [crit]: User '<a href="mailto:service@example.com">service@example.com</a>' could not be loaded in the mail gateway (/opt/rt3/bin/../lib/RT/Interface/Email.pm:244)</div><div>[Sat Jun 16 04:03:51 2012] [error]: RT could not load a valid user, and RT's configuration does not allow</div>
<div>for the creation of a new user for this email (<a href="mailto:service@example.com">service@example.com</a>).</div><div>You might need to grant 'Everyone' the right 'CreateTicket' for the</div><div>queue support. (/opt/rt3/bin/../lib/RT/Interface/Email.pm:244)</div>
<div>[Sat Jun 16 04:03:51 2012] [error]: RT could not load a valid user, and RT's configuration does not allow</div><div>for the creation of a new user for your email. (/opt/rt3/bin/../lib/RT/Interface/Email.pm:244)</div>
<div>[Sat Jun 16 04:03:51 2012] [error]: Could not record email: Could not load a valid user (/opt/rt3/share/html/REST/1.0/NoAuth/mail-gateway:75)</div></div><div><br></div><div><br></div><div>While I definitely don't want to create a user account while user trying to login, I am not sure if it is hurting</div>
<div>mailgateway. Will anyone still be able to create a ticket through email after applying the external auth</div><div>module (patched version)?</div></div><div><br></div>-- <br>Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu">pgp.mit.edu</a><br>
A: Because it messes up the order in which people normally read text.<br>Q: Why is top-posting such a bad thing?<br><br><br>