Can't get LDAP to work

ryangauer

Greetings, I'm brand new to osTicket, and I'm trying to get LDAP authentication to work, but after watching several youtube videos, and reading through forum posts, I'm still at a loss.

I am running osTicket 1.18.2 on IIS, with the LDAP and HTTP Passthru plugins installed (and a single instance created for both). I believe I have them configured correctly to connect to our Active Directory server, but when I try to log in using a test AD account, the user portal gives me "Access Denied". I've tried logging in with the email address, and the username, and the domain\username. All give the same result.

From what I've seen reading other posts, it should be possible to have a user sign in using their AD credentials and have osTicket auto-create/register their account, but I'm running into roadblocks. Is there a specific document I haven't found that walks through the setup step-by-step?

KevinTheJedi

ryangauer

No, LDAP is the only thing we don't have a guide/documentation on. It's straightforward to configure and it's so old at this point. Most people use OAuth2, SAML, or even AzureAD (which most federate through OAuth2/SAML) nowadays. With this being said, it should work as long as you input the right information in the plugin instance configuration. You also have to make sure the plugin and the plugin instance are both enabled.

Cheers.

ryangauer

They are both enabled. I'll look into the other options. Thanks.

ryangauer

I just tried setting up the OAuth2 plugin, and I think it's mostly working, except when I go to the agent login screen and choose "Sign in with Azure", it knocks me back to the user portal screen (without signing me in), and now it won't accept my admin credentials to log me in and make adjustments. I did set my account to be authenticated by the Microsoft OAuth backend provider. So, now I'm locked out.

KevinTheJedi

ryangauer

That's why you don't do that for admin lol Go to the db, go to the _staff table, set your backend to NULL, and you should be good to login as normal. As far as being redirected to the homepage that typically means the information from the IdP did not match an Agent's information. Users get auto-created however Agents have to exist beforehand. With either user type their email/username has to match what comes back from the IdP.

Cheers.

ryangauer

I checked (and doublechecked) that the field should be matching, but it's still not working. Is there a log file somewhere in osTicket I can look at to see what is being returned? I'm authenticating against microsoft.

KevinTheJedi

ryangauer

The only logs would be a failed login attempt log which wouldn't be helpful. You can inspect the requests in the browser and view the returned data. It might be encoded but you should be able to decode it using Base64.

Cheers.

ryangauer

Well, I'm at a loss (again). I tried looking at the responses, but couldn't make heads nor tails of what I was looking at. My admin account is the only one in osTicket, and when I try logging in with it, or with a different account, it just falls back to the home page. The User Identifier field is mapped to userPrincipalName, which it should be, and that's what I'm using to log in with...

I feel like I must be missing something obvious and simple, but it's escaping me.

KevinTheJedi

ryangauer

Try switching it to mail and see.

Cheers.

ryangauer

I changed it to mail, and it didn't make a difference. Still got booted to the home page without it signing in.

KevinTheJedi

ryangauer

Change it back to what it was originally then. Have you tried in an incognito window? If push comes to shove you can unpack the plugin and manually add debug statements to see what’s going on.

Cheers.

KevinTheJedi

ryangauer

For good measure I created a new app registration and tested login with a new User and Agent, etc. and all attempts were successful. What type of account are you using to authenticate? An outlook.com email or a custom, branded email? What type of app registration did you create (the Supported account types value you selected during creation)? Is it a "Single tenant", "Multi-tenant", "Multi-tenant and personal accounts", or "personal accounts only" app?

Cheers.

ryangauer

I finally got it to work. After several uninstall/reinstalls, it turns out I needed the curl cert in my php install.