[rt-users] AD integration for external auth

[Yan Seiner]

I'm coming back to RT after a few years.  I am trying to set up external 
auth against our AD server.

I have a working implementation for mediawiki, so I know that it's 
possible on our system.  As far as possible I've duplicated the options 
from mediawiki/php to rt/perl, but I am still missing something 
important as all login attempts get rejected with a NoUser.

The only thing that I find different (and I'm searching my memory from a 
few years ago when I set up mediawiki) there is a line where the user 
name is pre-pended with the domain for AD:

$wgLDAPSearchStrings = array( 'HPM' => "HPM\\USER-NAME" );

And I can't find anything like that in the RT config.

Does anyone have a working AD external auth they can share?

Thanks.

Here's the logfile snippet:

[4835] [Tue Jul  7 15:17:14 2015] [debug]: Attempting to use external 
auth service: My_LDAP 
(/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:424)
[4835] [Tue Jul  7 15:17:14 2015] [debug]: Calling UserExists with 
$username (yans) and $service (My_LDAP) 
(/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:465)
[4835] [Tue Jul  7 15:17:14 2015] [debug]: UserExists params:
username: yans , service: My_LDAP 
(/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:439)
[4835] [Tue Jul  7 15:17:14 2015] [debug]: LDAP Search ===  Base: 
ou=Staff,dc=hpm,dc=net == Filter: 
(&(objectClass=inetOrgPerson)(sAMAccountName=yans)) == Attrs: 
cn,co,telephoneNumber,l,postalCode,streetAddress,st,sAMAccountName,mail 
(/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:469)
[4835] [Tue Jul  7 15:17:14 2015] [debug]: User Check Failed :: ( 
My_LDAP ) yans User not found 
(/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:483)
[4835] [Tue Jul  7 15:17:14 2015] [debug]: Autohandler called 
ExternalAuth. Response: (0, No User) 
(/opt/rt4/local/plugins/RT-Authen-ExternalAuth/html/Elements/DoAuth:11)
[4835] [Tue Jul  7 15:17:14 2015] [error]: FAILED LOGIN for yans from 
10.10.30.51 (/opt/rt4/sbin/../lib/RT/Interface/Web.pm:810)

And here's the setup in RTSiteConfig.pm:

Plugin('RT::Authen::ExternalAuth');
Set($ExternalAuthPriority,  [ 'My_LDAP' ]);
Set($ExternalInfoPriority,  [ 'My_LDAP' ]);
Set($ExternalSettings, {
      'My_LDAP'       =>  {
      'type'             =>  'ldap',
      'server'           =>  'file_print.hpm.net',
                 # By not passing 'user' and 'pass' we are using an 
anonymous
                 # bind, which some servers to not allow
      'base'             =>  'dc=hpm,dc=net',
      'filter'           =>  '(objectClass=inetOrgPerson)',
                 # Users are allowed to log in via email address or account
                 # name
      'attr_match_list'  => [
            'Name',
#           'EmailAddress',
            ],
                 # Import the following properties of the user from LDAP 
upon
                 # login
                 'attr_map' => {
                     'Name'         => 'sAMAccountName',
                     'EmailAddress' => 'mail',
                     'RealName'     => 'cn',
                     'WorkPhone'    => 'telephoneNumber',
                     'Address1'     => 'streetAddress',
                     'City'         => 'l',
                     'State'        => 'st',
                     'Zip'          => 'postalCode',
                     'Country'      => 'co',
                 },
             },
         } );