[rt-users] ExternalAuth workaround? while waiting for 0.9

[Kenneth Marshall]

On Thu, Jul 29, 2010 at 09:36:33AM -0400, Mike Johnson wrote:
> Greetings all,
> 
> Has anyone that is using ExternalAuth developed a workaround for the "new
> user" creation issue with ExternalAuth?
> 
> The issue was outlined in another rt-user message(I can't seem to find
> now).  It relates to when non-privleged users are created through the
> creation of a ticket from an email, and then they login using LDAP.  The
> email generates a user with username and email address as their email
> address.  ExternalAuth throws an error when it attempts to create the new
> user, as a user already exists with the same email address.
> 
> I need ExternalAuth to find the user that has the same email address, and
> change that user's info to the info it grabs from LDAP.
> 
> If I was a perl programmer, I'd figure out how to customize it myself, but
> unfortunately, I'm just stepping into that world... most perl stuff i use,
> I've "borrowed" from the web :P
> Has anyone developed a workaround?
> 
> The only thing I can think of, is taking all LDAP users, and loading them
> into RT with their info, and everytime a new user is created in LDAP, they
> get created in RT... but that seems like a fair amount of work....
> 
> Thanks!
> 
> -- 
> Mike Johnson
> Datatel Programmer/Analyst
> Northern Ontario School of Medicine
> 955 Oliver Road
> Thunder Bay, ON   P7B 5E1
> Phone: (807) 766-7331
> Email: mike.johnson at nosm.ca


Hi Mike,

We use a customized version of the CanonicalizeEmailAddress() function
which looks up the E-mail address in the LDAP directory and maps it to
their primary E-mail address before creating the account. Then it does
not conflict with the ExternalAuth process which will then pull the
same information. Here is our version which should give you some ideas:


sub CanonicalizeEmailAddress {
    my $self = shift;
    my $email = shift;

    # Leave some addresses intact
    if ( $email =~ /[\w-]+\@mysafe1.rice.edu$/ ) {
        return ($email);
    }
    if ( $email =~ /[\w-]+\@mysafe2.rice.edu$/ ) {
        return ($email);
    }

    # Example: the following rule would treat all email
    # coming from a subdomain as coming from second level domain
    # foo.com
    if ( my $match   = RT->Config->Get('CanonicalizeEmailAddressMatch') and
         my $replace = RT->Config->Get('CanonicalizeEmailAddressReplace') )
    {
        $email =~ s/$match/$replace/gi;
    }
    $email .= '@rice.edu' if ($email =~ /^[\w-]+$/);

    #
    # Now we should have an Email address that is of the form addr at rice.edu
    # Use LDAP to map this to the primary vanity Email alias.

    my $params = ( Name => undef,
                   EmailAddress => undef);

    my $ldap = new Net::LDAP($RT::LdapServer)
      or $RT::Logger->critical("CanonicalizeEmailAddress: Cannot connect to LDAP\n"),
        return ($email);

    my $mesg = $ldap->bind();

    if ($mesg->code != LDAP_SUCCESS) {
      $RT::Logger->critical("CanonicalizeEmailAddress: Unable to bind to $RT::LdapServer: ",
        ldap_error_name($mesg->code), "\n");

      return ($email);
    }

    # First check to see if the E-mail address uniquely characterizes the
    # user. If so, update the information with the LDAP query results.
    my $filter = "(mailAlternateAddress=$email)";
    $mesg = $ldap->search(base   => $RT::LdapBase,
                          filter => $filter,
                          attrs  => [ $RT::LdapMailAttr ]);

    if ($mesg->code != LDAP_SUCCESS and $mesg->code != LDAP_PARTIAL_RESULTS)  {
      $RT::Logger->critical("Unable to search in LDAP: ", ldap_error_name($mesg->code), "\n");

      return ($email);
    }

    # The search succeeded with just one match
    if ($mesg->count == 1) {
      $email = ($mesg->first_entry->get_value($RT::LdapMailAttr))[0];
    }

    $mesg = $ldap->unbind();
    if ($mesg->code != LDAP_SUCCESS) {
      $RT::Logger->critical("Could not unbind from LDAP: ", ldap_error_name($mesg->code), "\n");

    }
    undef $ldap;
    undef $mesg;
    return ($email);
}


You will also need these somewhere ahead of there use:

use Net::LDAP;
use Net::LDAP::Constant qw(LDAP_SUCCESS LDAP_PARTIAL_RESULTS);
use Net::LDAP::Util qw (ldap_error_name);
use Net::LDAP::Filter;

We have them at the top under "use strict".

Cheers,
Ken