LDAP filter option in plugin

cjohnsonuk

I want to be able to filter the users that can authenticate to the helpdesk using a filter based on their group membership in AD. Pretty much every other app we use with LDAP auth has this option. I've got the groups set up ready but on enabling the plugin in osTicket I was surprised to find no option to add a filter, at least not an obvious one, and with the plugins all delivered as .phar files no easy way to see if one can be squeezed in.

I've done a quick search of this forum but my search foo has failed me this time.

Any pointers appreciated.

Thanks

KevinTheJedi

cjohnsonuk

I think you can configure the search base in the plugin to only search through a specific group. In your AD you can then filter the users to that specific group.

Cheers.

cjohnsonuk

My understanding it that the search base is an container/ organisational unit / OU in which all the users are created. Our users are in many locations dependant on their roles and departments so that the OUs can be used to apply security policies. I've had to choose a search base higher up the tree to make sure all users are within that base. Only certain departments are helpdesk users / agents. Ideally this will be LDAP filter based so control of the users can be carried out by someone with delegated access to just the AD user group called helpdesk_users

cjohnsonuk

So looking into this I went to google and ended up here:
https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html
and found a search filter to pull out members of a group which would look like this
(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=cn=CaptainPlanet,ou=users,dc=company,dc=com))
So I tweaked it to match a group I made in my AD and pasted it into a new LDAP plugin instance to give it a whirl but despite the config value field allowing up to 65k characters the form field for the LDAP search base is limited to just 70 characters, not enough for my specific requirements or even the example search filter. Looks like its back to raw code hacking again.

Feature request : 1 can we have an LDAP search filter as well as a search base and 2 can we have the field in the plugin accept strings that aren't arbitrarily limited.

KevinTheJedi

cjohnsonuk

We can add this as a feature request for v2.0. It will not be implemented in the current, legacy codebase. We are trying to shift our focus solely on v2.0 when we have 1.17.x stabilized.

Cheers.

cjohnsonuk

I looked in the code and there is an element in a variable already defined for a search filter in LDAP search format 😃 separate to the search base element of the same array. However its not used in any subsequent code 🙁 . There are some links in the comments in the code I'll take a look at. I'll post back here if I manage to make any progress.

ntozier

Any word on how you made out with this?