LDAP connection failed: Page 2

LDAP connection failed

DiscoTurtle

PHP-FPM switched to TCP: Configuration of PHP-FPM to listen on TCP port 127.0.0.1:9000 instead of a Unix socket, and correction of associated start-up errors.

Apache configured for PHP-FPM (TCP): Set up a dedicated VirtualHost for osTicket (osticket.conf) with SetHandler ‘proxy:fcgi://127.00.1:9000’ so that Apache communicates correctly with PHP-FPM.

Permissions and SELinux corrected: Adjusted file owners (apache:apache) and permissions, and fixed SELinux contexts (httpd_sys_content_t) to ensure Apache access and execution by PHP-FPM. Activation of httpd_can_network_connect for Apache network connections.

Reliable URL access: Harmonisation of the VirtualHost DocumentRoot with the access URL, enabling http://IPserver/info.php and then http://IPserver/ (for osTicket) to function correctly.

Validated operation: info.php is displayed, osTicket is accessible, and the LDAP plugin is activated and configured.
The link works, but when you try to connect with an account from the directory, the request to register an account appears but cannot be successful: Impossible to register the account. See messages below.
no message is displayed.

DiscoTurtle

It actually works, you just need to fill in some information (phone number, email) about the user.
Bypass possible if directory fields are empty?

A priori, only end users (customers) can authenticate with accounts from an LDAP directory and not managers (agents).
Is this a limitation of this plugin?

KevinTheJedi

DiscoTurtle

No, both can login via LDAP if setup right. You also need to make sure the Agents’ Authentication Backend is set to Use Any.

Cheers.

KevinTheJedi

DiscoTurtle

Also, I’ve seen the user registration thing hanging up with needing to fill out fields only twice before. Such a long time ago i don’t remember what the cause nor fix was. It’s an edge-case and I don’t remember if the cause was the environment or what. But it should just auto-register users without them needing to fill anything out.

Cheers.

DiscoTurtle

Users who connect via LDAP are not visible in the administration portal, agents section.
How can I define team members using this access channel?

KevinTheJedi

DiscoTurtle

You can’t. Agents need Departments configured, roles and permissions, etc. You can not automatically create Agents from any external source.

Cheers.

DiscoTurtle

We'd love to see a solution for authenticating users who don't have the email and phone fields filled in the LDAP directory so that they can connect.

KevinTheJedi

DiscoTurtle

Like I said in a previous comment above, it shouldn't happen normally. Normally, any person that doesn't exist as a User in osTicket that authenticates using LDAP (via the Client Portal) should have a User account auto-created and auto-registered without needing to do anything. The issue you are experiencing is an edge-case that I can't remember what the root issue was (wether it was environment related or what). You would need to debug the core code and plugin to see what's going on.

Cheers.

DiscoTurtle

Can you guide us through the debugging process?

KevinTheJedi

DiscoTurtle

Quick question, is the Phone Number field on the Contact information Form set to Optional? There used to be an issue back in the day where if it was required it would hang up the auto-registration process with LDAP.

I unfortunately don't have much time. I do this in my free time and as you can imagine with v2.0 we are absolutely 100% busy 24/7. It's faster to take it on your own and come back with the results. You'd simply go through the auth flow. I can leave you with this for now, the auth on the LDAP side starts here:

https://github.com/osTicket/osTicket-plugins/blob/develop/auth-ldap/authentication.php#L184

You can see at the bottom lookupAndSync() is called where it tries to do the auth/creation. Here is where it sends the create request if the user doesn't exist:

https://github.com/osTicket/osTicket-plugins/blob/develop/auth-ldap/authentication.php#L405

Cheers.

DiscoTurtle

Yes, the telephone number label is defined as optional in the contact information form.
On the subject of forms, there's a bug in the type: choice.
If you want to have several choices, key:value on the first line, key:value on the second, etc., doesn't give you a list.

KevinTheJedi

DiscoTurtle

Because the key is the same...keys (behaving like keys anywhere else) need to be unique.

Cheers.

DiscoTurtle

The help available in the "?" symbol is fairly limited and does not specify that key:value, key2:value, etc. should be named.
For a new usage query, a new topic must be created?

KevinTheJedi

DiscoTurtle

What do you mean? If you have another question about the software? If so, then yes you would create your own.

Cheers.

« Previous Page