<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","serif";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:263193604;
mso-list-type:hybrid;
mso-list-template-ids:1438963116 -1502021032 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:20.25pt;
text-indent:-.25in;
font-family:"Calibri","serif";
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>If all are trying to accomplish is utilizing AD as your source of authentication – then you just need the ExtAuth plugin setup. This will allow you enable all of your AD users to authenticate (you can filter against any AD attribute, OU, etc to set parameters from AD). <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>At the same time you can configure RT to handle all the security configuration and just enable AD authentication. This would allow any AD credential to authenticate, but as a non-privileged user. In this setup you would manage anything RT security related in the RT interface (RT groups, RT group permissions, RT Users, RT Users permission, etc)<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We use AD for authentication, and RT’s security to manage what they can do via groups/ or AD groups. It’s the best of both worlds and you don’t have to worry about NTLM/SSO headaches. ExtAuth will feed RT user attributes too out of the box (full name, address, phone, etc.)<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>-Andy<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com] <b>On Behalf Of </b>Elliott, Kevin C (DOR)<br><b>Sent:</b> Friday, June 07, 2013 4:48 PM<br><b>To:</b> rt-users@lists.bestpractical.com<br><b>Subject:</b> [rt-users] Configure RT for Intergration with Active Directory<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hello all.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I’m working with a brand new Request Tracker 4.07 install on Debian 7.0.0 (Wheezy) and I have some very general questions about configuring Request Tracker for integration with Active Directory. I would like our Window clients to be able to access Request Tracker using the SSO functionality of Internet Explorer, have their Request Tracker accounts created and relevant details pulled from Active Directory’s LDAP. The more seamless this is the better.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have a very basic high-level conceptual understanding of how this is all supposed to fit together but am a bit lost on the specifics. Please bear with me. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If I understand this correctly I need to do three things:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoListParagraph style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Configure External Authentication for Request Tracker<o:p></o:p></p><p class=MsoListParagraph style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Configure NTLM /SSO, either in Apache via mod_ntlm, mod_ntlm_winbind or mod_pam<o:p></o:p></p><p class=MsoListParagraph style='margin-left:20.25pt;text-indent:-.25in;mso-list:l0 level1 lfo2'><![if !supportLists]><span style='mso-list:Ignore'>-<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Configure an LDAP overlay so that authenticated RT users get their information fields populated with the relevant data<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># External Authentication: <a href="http://requesttracker.wikia.com/wiki/ExternalAuthentication">http://requesttracker.wikia.com/wiki/ExternalAuthentication</a> #<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>There seem to be two common ways to do this – either use WebExternalAuth which pushes the authentication requirement to Apache or use the RT::Authen::ExternalAuth module and have RT do the authentication directly. Which one should I use? I kind of get the impression that RT::Authen::ExternalAuth is someone what out of date and that WebExternalAuth is the recommend way to handle authentication. Is this correct? What criteria should I use to make the determination between the two methods?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># Configure NTLM /SSO, either in Apache via mod_ntlm, mod_ntlm_winbind, mod_kerb or mod_pam #<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is really more a question about the RT ecosystem but presuming I’m using WebExternalAuth correctly I then need to use an Apache module so Apache can make the determination as to whether or not a client is authenticated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Lots of advice points to mod_ntlm, which as far as I can tell does *<b>not</b>* require Samba and can directly do the NTLM challenge/response. On the other hand it seems like people recommend the use of Samba’s t ntml_auth helper as more up to date way to handle NTLM authentication. I imagine you could also use mod_kerb if you have Kerberos setup or mod_pam if Samba is functioning appropriately.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Again, I’m not really sure what authentication I should have Apache2 attempt to do for my clients nor how to configure the SSO cookies.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># LDAP Overlays - <a href="http://requesttracker.wikia.com/wiki/LdapSummary">http://requesttracker.wikia.com/wiki/LdapSummary</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>There’s lots of information here but I can’t pick out which stuff is relevant and up to date. The ExternalAuth plug again seems to be popular. The AutoCreateFromExternalUserInfo and AutoCreateAndCanonicalizeUserInfo Wiki page appear to do just what I want but are preferenced by warning saying that they’re out of date.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Where can I find the relevant documentation to pull information about Active Directory Users with LDAP and have it auto-populate their RT user’s fields.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Some assistance in finding the right documentation on how to accomplish Active Directory integration would be very helpful.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>---<o:p></o:p></p><p class=MsoNormal>Kevin Elliott<o:p></o:p></p><p class=MsoNormal>Networking Specialist II<o:p></o:p></p><p class=MsoNormal>Alaska Department of Revenue, ASD-IT<o:p></o:p></p><p class=MsoNormal>(907) 465-2314<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>