<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#44546A;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A">For your ‘server’ try using IP rather than hostname.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A">Second for the ‘user’ field try using the DN name for your AD Binding user…{cn=some_user,ou=some_ou,dc=some_domain,dc=com<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A">Hope this helps..<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A">Jeff<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#44546A"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> rt-users-bounces@lists.bestpractical.com [mailto:rt-users-bounces@lists.bestpractical.com]
<b>On Behalf Of </b>Mathew Snyder<br>
<b>Sent:</b> Thursday, October 17, 2013 1:19 PM<br>
<b>To:</b> rt-users@lists.bestpractical.com<br>
<b>Subject:</b> [rt-users] I need help with the RT-Authen-ExternalAuth LDAP settings, please<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">These are the settings I've started with:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Set($ExternalSettings, {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'AD' => {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'type' => 'ldap',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'server' => '<a href="http://domain_controller.example.com">domain_controller.example.com</a>',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'base' => 'dc=example,dc=com',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'user' => 'rtuser',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'pass' => '********',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'filter' => '(ObjectClass=*)',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'tls' => 0,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'ssl_version' => 3,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'net_ldap_args' => [ version => 3 ],<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'attr_match_list' => [<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'EmailAddress',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> ],<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'attr_map' => {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'Name' => 'sAMAccountName',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'EmailAddress' => 'mail',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 'RealName' => 'cn',<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> },<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">They aren't working. Whenever someone attempts an initial login with just their username (which should create their RT account) the following error is logged:<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">Oct 17 15:02:29 zen-rt RT: [23131] Use of uninitialized value in string eq at /opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm line 613.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Oct 17 15:02:29 zen-rt RT: [23131] RT::Authen::ExternalAuth::CanonicalizeUserInfo returning Disabled: , EmailAddress: , Gecos: user, Name: user, Privileged:<o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">Oct 17 16:14:01 zen-rt RT: [24382] Couldn't create user user: Could not set user info<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Oct 17 16:14:01 zen-rt RT: [24382] FAILED LOGIN for user from 192.168.236.102<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">When initial logins are attempted with either example\username or
<a href="http://example.com">example.com</a>\username only the FAILED LOGIN line is displayed.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We also have our Openfire Jabber server authenticating successfully. Those settings are<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.autoFollowAliasReferrals = true<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.autoFollowReferrals = false<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.baseDN = dc=example,dc=com<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.connectionPoolEnabled = true<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.debugEnabled = false<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.emailField = mail<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.encloseDNs = true<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.groupDescriptionField = description<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.groupMemberField = member<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.groupNameField = cn<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.groupSearchFilter = (objectClass=group)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.host = <a href="http://domain_controller.example.com">domain_controller.example.com</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.ldapDebugEnabled = false<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.nameField = cn<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.port = 389<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.searchFilter = (objectClass=*)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">ldap.usernameField = sAMAccountName<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I know they don't match up exactly in terms of what Openfire calls the settings vs. what RT does, but I'm hoping someone can help me sort out what should be plugged in where on the RT side. For example, I don't know what the group_attr
or group_attr_value setting should contain (if anything) in the RT_SiteConfig.pm file. Basically, anything from the "group" settings.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-Mathew<br>
<br>
"When you do things right, people won't be sure you've done anything at all." - God; Futurama<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">"<span style="font-size:10.0pt;font-family:"Arial","sans-serif";background:white">We'll get along much better once you accept that you're wrong and neither am I." - Me</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>