<div dir="ltr"><br><div class="gmail_extra"><br clear="all"><div>-Mathew<br><br>"When you do things right, people won't be sure you've done anything at all." - God; Futurama<div><br></div><div>"<span style="background-color:rgb(255,255,255);font-family:arial,sans-serif;font-size:13px;line-height:18px">We'll get along much better once you accept that you're wrong and neither am I." - Me</span></div>
</div>
<br><br><div class="gmail_quote">On Mon, Feb 10, 2014 at 1:13 AM, Gerald Vogt <span dir="ltr"><<a href="mailto:vogt@spamcop.net" target="_blank">vogt@spamcop.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On 10.02.2014 09:29, Mathew Snyder wrote:<br>
> A user who sends in an email for the first time should generate an<br>
> unprivileged account which sets the username as the email address. It<br>
> doesn't exist so it should be created.<br>
<br>
</div>The user has been created with e-mail address <a href="mailto:user@example.com">user@example.com</a> mapping<br>
to user name "user".<br>
<br>
Now the user sends e-mail from e-mail address <a href="mailto:user.example@gmail.com">user.example@gmail.com</a><br>
which you map to the same user "user" with LDAP. That's not supported.<br>
That would mean the same LDAP user has two e-mail addresses.<br>
<br>
You match users in LDAP using either of these attributes:<br>
<div class=""><br>
'attr_match_list' => [<br>
'Name',<br>
'EmailAddress',<br>
'RealName',<br>
],<br>
<br>
</div>If you don't have the gmail address in LDAP then it's probably the real<br>
name which matches. With your configuration you can only have one RT<br>
account for each real name. Thus if there is another "Mathew Snyder"<br>
with a different e-mail address it gets rejected because again.<br>
<br>
You don't want RealName in attr_match_list unless you are sure that each<br>
real name will only match to a single person with a single e-mail address.<br></blockquote><div><br></div><div>I asked the person that is doing most of the grunt work to look into this. Rather than comment out the RealName setting under attr_match_list he commented it out under attr_map. This seems to have ad the same effect as it no longer creates a second account with the same real name as another that is in LDAP.</div>
<div><br></div><div>I'm not entirely sure why RT should care about a person's actual name. The username is really all that is relevant. This seems to be a failure on the designers part, as far as I'm concerned.</div>
<div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
-Gerald<br>
<div class=""><br>
<br>
<br>
<br>
><br>
> On Feb 9, 2014 9:09 PM, "Gerald Vogt" <<a href="mailto:vogt@spamcop.net">vogt@spamcop.net</a><br>
</div><div class="">> <mailto:<a href="mailto:vogt@spamcop.net">vogt@spamcop.net</a>>> wrote:<br>
><br>
> On 10.02.2014 06:46, Mathew Snyder wrote:<br>
> ...<br>
> > [15816] [Fri Feb 7 05:29:01 2014] [debug]: Going to create user with<br>
> > address '<a href="mailto:user.example@gmail.com">user.example@gmail.com</a> <mailto:<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>><br>
</div>> <mailto:<a href="mailto:user.example@gmail.com">user.example@gmail.com</a> <mailto:<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>>>'<br>
<div class="">> > (/opt/rt4/sbin/../lib/RT/Interface/Email/Auth/MailFrom.pm:100)<br>
> ...<br>
> > [15816] [Fri Feb 7 05:29:01 2014] [info]:<br>
> > RT::Authen::ExternalAuth::CanonicalizeUserInfo returning Comments:<br>
> > Autocreated on ticket submission, Disabled: , EmailAddress:<br>
> > <a href="mailto:user@example.com">user@example.com</a> <mailto:<a href="mailto:user@example.com">user@example.com</a>><br>
</div>> <mailto:<a href="mailto:user@example.com">user@example.com</a> <mailto:<a href="mailto:user@example.com">user@example.com</a>>>, Name: user,<br>
<div class="">> Password: ,<br>
> > Privileged: , RealName: User Example<br>
> ><br>
> (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:685)<br>
><br>
> If these logs are correct then the user has two or more email addresses<br>
</div>> in LDAP and <a href="mailto:user@example.com">user@example.com</a> <mailto:<a href="mailto:user@example.com">user@example.com</a>> is already in<br>
<div class="">> the RT database. The user<br>
> sends from the second address <a href="mailto:user.example@gmail.com">user.example@gmail.com</a><br>
</div>> <mailto:<a href="mailto:user.example@gmail.com">user.example@gmail.com</a>>. This is not<br>
<div class="HOEnZb"><div class="h5">> supported (yet).<br>
><br>
> Users with multiple email addresses in LDAP are not supported (even<br>
> though some docs say otherwise). We have just discussed this recently.<br>
> See this thread:<br>
><br>
> <a href="http://lists.bestpractical.com/pipermail/rt-users/2014-January/082549.html" target="_blank">http://lists.bestpractical.com/pipermail/rt-users/2014-January/082549.html</a><br>
><br>
> The user must use the email address in the RT database. Mails from any<br>
> other email address in LDAP is rejected because the user already exists<br>
> in the RT database.<br>
><br>
> You may try to manually create a second RT user with the second email<br>
> address and then use the MergeUser extension to merge the accounts.<br>
><br>
> -Gerald<br>
><br>
<br>
</div></div></blockquote></div><br></div></div>