Users not authenticating

marcob

Hello,
suddenly two users in my osTicket can't authenticate, apparently for no reason. The error is "Access denied". Their user is present in the Users panel and no changes were made. They are synced with LDAP. I even tried the "Make user change password" option, but with no avail. Other users can log in no problem.
What could be the issue?
Thank you in advance for your help

KevinTheJedi

Daedalus01 You are correct; it's only one way and it's not really a "sync" in the normal sense. Just simply gets the user info on initial register and that's it. If something changes in AD afterwards it does not get updated in osTicket.

marcob Have them clear all cache/cookies/sessions and retest. Sometimes the system/browser gets hung up on the sessions and prevents logins.

Cheers.

Daedalus01

Check to make sure the user accounts in LDAP are not locked out. If they are locked out of LDAP, then they will not be able to log into the ticket system since their accounts are sync'd.

I'm not sure if the change password function would work or not since I don't believe the LDAP auth module in OsTickets has a write-back feature. I could be wrong though. I think its a one-way sync.

marcob

Ok, many thanks, I'll try. Anyway, when a user changes password through Windows, even his osticket account does, automatically.

marcob

Nothing, the user still gets "Access denied" even in Incognito. Where can I check the LDAP settings? Do I have to check in the control panel from the webpage or do I have to check something in the Linux machine?

KevinTheJedi

marcob

Well yea because it was updated in AD; however that change (nor any other) does not get relayed to the user account in osTicket.

In the Admin Panel under Manage > Plugins.

Cheers.

Daedalus01

marcob I am not sure what LDAP system you are using ( Windows AD or some other LDAP implementation), but you could point the LDAP auth plugin to one server specifically and have the user try to login. After they get the deny, you can then go examine the Authentication logs on that server and see what its spitting out that might point you to where the issue is. If it's Windows Active Directory, the logs are pretty clear themselves, but it might have a event ID that you might have to go look up the meaning.

marcob

Ok, many thanks again. I'll check and keep you updated!

marcob

Hello again,
I tried checking the Authentication logs, but with no avail.
I tried resetting the ntp time and the kerberos tickets on the pc, even tried exiting and rejoining the domain.
Nothing, access denied.
My hyphotesis is that several other users aren't able authenticating, but they don't know it, because most of them opens tickets through email.
Do you suggest to maybe reset the whole LDAP connection?

KevinTheJedi

marcob

Wouldn't hurt to try it.

Also, if you see any attempts within the AD logs when you attempt to authenticate that means it's not hitting AD and is likely blocked or the connection failed at the server level - maybe the plugin information is outdated/incorrect.

Cheers.

marcob

Ok, thank you again!!