<div dir="ltr">RT 4.2.2<div>RT::Authen::ExternalAuth 0.17<br><div>MySQL 5.1.71-1</div><div>httpd 2.2.15-29</div><div>CentOS 6.5</div><div><br></div><div>We have RT-Authen-ExternalAuth working with the organization's AD server (LDAP). All personnel on the domain are able to log in with their AD account and their RT account is automatically created. This is working flawlessly.</div>
<div><br></div><div>Generally, external users sending an email to create a ticket are having their unprivileged accounts created as expected. However, there seems to be an intermittent issue preventing others from having the same result. There doesn't appear to be any rhyme or reason to it.</div>
<div><br></div><div>Relevant RT_SiteConfig.pm configuration:</div><div><br></div><div><div>Set($AutoCreate,{Privileged=>0});</div><div>Set($AutoCreateNonExternalUsers, 1);<br></div><div><br></div><div>Set($ExternalSettings, {</div>
<div> 'AD' => {</div><div> 'type' => 'ldap',</div><div> 'server' => 'dc1.example.local',</div><div> 'user' => 'RTuser',</div>
<div> 'pass' => 'xxxxxxxx',</div><div> 'base' => 'dc=example,dc=local',</div><div> 'filter' => '(objectClass=person)',</div>
<div> 'attr_match_list' => [</div><div> 'Name',</div><div> 'EmailAddress',</div><div> 'RealName',</div><div> ],</div><div> 'attr_map' => {</div>
<div> 'Name' => 'sAMAccountName',</div><div> 'EmailAddress' => 'mail',</div><div> 'RealName' => 'cn',</div><div> },</div><div>
},</div><div>} );</div></div><div><br></div><div>Relevant RT log example:</div><div><br></div><div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Converting 'cp1252' to 'utf-8' for text/plain - Subjectless message (/opt</div>
<div>/rt4/sbin/../lib/RT/I18N.pm:295)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Converting 'cp1252' to 'utf-8' for text/html - Subjectless message (/opt/</div><div>rt4/sbin/../lib/RT/I18N.pm:295)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Encode::Guess guessed encoding: ascii (/opt/rt4/sbin/../lib/RT/I18N.pm:59</div><div>5)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Encode::Guess guessed encoding: ascii (/opt/rt4/sbin/../lib/RT/I18N.pm:59</div>
<div>5)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Going to create user with address '<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>' (/opt/rt4/sbin/../lib/RT/Interface/Email/Auth/MailFrom.pm:100)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: RT::Authen::ExternalAuth::CanonicalizeUserInfo called by RT::Authen::ExternalAuth /opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm 702 with: Comments: Autocreated on ticket submission, Disabled: , EmailAddress: <a href="mailto:user.example@gmail.com">user.example@gmail.com</a>, Name: <a href="mailto:user.example@gmail.com">user.example@gmail.com</a>, Password: , Privileged: , RealName: User Example (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:599)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Attempting to get user info using this external service: AD (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:607)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Attempting to use this canonicalization key: Name (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:621)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: LDAP Search === Base: dc=example,dc=local == Filter: (&(objectClass=person)(sAMAccountName=<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>)) == Attrs: cn,mail,sAMAccountName (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:357)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Attempting to use this canonicalization key: EmailAddress (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:621)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: LDAP Search === Base: dc=example,dc=local == Filter: (&(objectClass=person)(mail=<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>)) == Attrs: cn,mail,sAMAccountName (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:357)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: Attempting to use this canonicalization key: RealName (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:621)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [debug]: LDAP Search === Base: dc=example,dc=local == Filter: (&(objectClass=person)(cn=User Example)) == Attrs: cn,mail,sAMAccountName (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:357)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [info]: RT::Authen::ExternalAuth::CanonicalizeUserInfo returning Comments: Autocreated on ticket submission, Disabled: , EmailAddress: <a href="mailto:user@example.com">user@example.com</a>, Name: user, Password: , Privileged: , RealName: User Example (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:685)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [crit]: User could not be created: User creation failed in mailgateway: Name in use (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:245)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [warning]: Couldn't load user '<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>'.giving up (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:875)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [crit]: User could not be loaded: User '<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>' could not be loaded in the mail gateway (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:245)</div>
<div>[15816] [Fri Feb 7 05:29:01 2014] [error]: Could not load a valid user: RT could not load a valid user, and RT's configuration does not allow</div><div>for the creation of a new user for this email (<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>).</div>
<div><br></div><div>You might need to grant 'Everyone' the right 'CreateTicket' for the</div><div>queue provisioning. (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:245)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [error]: Could not load a valid user: RT could not load a valid user, and RT's configuration does not allow</div>
<div>for the creation of a new user for your email. (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:245)</div><div>[15816] [Fri Feb 7 05:29:01 2014] [error]: Could not record email: Could not load a valid user (/opt/rt4/share/html/REST/1.0/NoAuth/mail-gateway:75)</div>
</div><div><br></div><div>The Everyone group already has the CreateTicket and ReplyToTicket rights on all of the queues that have been configured.</div><div><br></div><div>One thing that stands out is [15816] [Fri Feb 7 05:29:01 2014] [crit]: User could not be created: User creation failed in mailgateway: Name in use (/opt/rt4/sbin/../lib/RT/Interface/Email.pm:245). However, if I search on the user's email address as the name it says nothing can be found.</div>
<div><br></div><div>I also noticed that the queue being referenced is 'provisioning'. It actually is 'Provisioning'. Is case important?</div><div><br></div><div><div>-Mathew<br><br>"When you do things right, people won't be sure you've done anything at all." - God; Futurama<div>
<br></div><div>"<span style="background-color:rgb(255,255,255);font-family:arial,sans-serif;font-size:13px;line-height:18px">We'll get along much better once you accept that you're wrong and neither am I." - Me</span></div>
</div>
</div></div></div>