LDAP Authentication connect multiple Active Directory domains

rocklee44

Hi all,
I'm using osTicket v1.17 with LDAP Authentication and Lookup 0.6.2 plugin, connecting to single Active Directory domain controller for myfirstdomain.com LDAP Authen, I added agents (IT members) manually , set "Authentication Backend" to "LDAP Authentication" , it works fine.
Now I want to add more agents (IT members) from myseconddomain.com (different forest). May I ?

I created second instance , input information and save successfully.
I added more agents (IT members) from myseconddomain.com , set "Authentication Backend" to second "LDAP Authentication".
But agents (IT members) from myseconddomain.com cannot login to osticket/scp , how can I troubleshoot ? where can I find logs about agents fail login ?
Please give me some advice, thank you very much.

KevinTheJedi

rocklee44

If you setup 2 instances then there should be 2 LDAP backends to choose from. For the second domain agents it appears you selected the wrong one.

Cheers.

Davokin

Hello everyone, I apologize for revisiting this old topic, but is there any way to differentiate this authentication method for multiple connected domains? In my case, both are named "Active Directory or LDAP"... It's always trial and error to determine the correct one.

In the database, the ost_staff table distinguishes these using "ldap.p1i3" and "ldap.p1i2".

Thank you already!

Best regards
Davokin

KevinTheJedi

Davokin

Should be the name of the plugin instance.

Cheers.

Davokin

KevinTheJedi Unfortunately, that is not the case, see image below - both LDAP instances have their own identifier... Is there anywhere I can find out which information is being transmitted from the LDAP plugin to the authentication directory? Perhaps I can fix the "error" myself.

Davokin

Another issue I've just encountered is that once I've added multiple LDAP connections, I can only find Active Directory users from the top entry when creating a new agent, no matter which of the two LDAP connections I select as the authentication method... This might also be related to the naming of the instances, which obviously isn't being transmitted properly.

Best regards,
Davokin

KevinTheJedi

Davokin

Then it’s either in the plugin class, instance class, or the actual plugin itself. I’d have to go through the code to see where exactly we do that at.

Cheers.

KevinTheJedi

Davokin

Looks like it comes from the $name property for each authentication backend. This is the $name for LDAP plugin:

https://github.com/osTicket/osTicket-plugins/blob/2bb771799a54dbacddfcf87851ca534e3b2af2dc/auth-ldap/authentication.php#L421

Ideally, we should attempt to get the name from the plugin instance and use the default $name as a backup if not set or not configured yet.

Cheers.

Davokin

KevinTheJedi
So if I understand correctly, this is not something I can do myself at short notice... Okay, but at least I know what to do!

Thanks for your effort

Best regards Davokin

KevinTheJedi

Davokin

Correct, it's an oversight that we need to look further into. It's still using the default name from the plugin (like we used to) instead of getting the Instance name. This part must've been overlooked when doing multi-instance plugins.

TLDR;
If you can't address this yourself then you'd have to wait for us to look into it and eventually make a pull request for it.

Cheers.

KevinTheJedi

Davokin

Here is the official pull request that addresses the issue:

https://github.com/osTicket/osTicket-plugins/pull/286

You can apply the changes manually (if you know how) or you can wait until the next set of osTicket releases and Plugin builds. 👍️

Cheers.