Still mystified by auth ldap for users

ealtman

Hello,
Here is my information:

We've been using the auth ldap plugin successfully for several years to authorize agents. With the latest upgrade I've been working on trying to enable users to use it too, and I've read everybody's issues with that -- the fact that the database doesn't sync, etc. No suggested fixes worked for me, so I stripped the install down to nothing. I still can't make it work.

I have tried several methods --

Having the first-time user register through the client portal - creates a password which would seem to get in the way of the LDAP login/
Having the admin create the user -- there is one window in this process that allows you to specify that they can login using the auth-ldap instance that you've set up, but I can't ever find that again.
Having an unregistered user try to log in straight from the client portal using LDAP credentials.

I think that the problem we're having is that the agents login using their LDAP user name -- we have a separate ID called the UID that is not the same as the canonical email (my canonical email is elizabeth.altman@domain.tld but my UID is not elizabeth.altman, although it is all part of the LDAP record). Could that be the issue? There is no place in the user table to specify a username for regular users to login via LDAP. We're using AD for our LDAP directory, by the way. The search base is o=csun.

Any help, including which logs I can look at to understand the failure, appreciated.

-Elizabeth

KevinTheJedi

ealtman

When you login on the client portal using your AD email/uid and password (for an account that doesn’t exist in osTicket yet) what happens?

Cheers.

ealtman

I get an Access Denied message with both, but no log entry.

KevinTheJedi

ealtman

So do you use standard AD attributes? If not, that's typically a problem. It should match these attributes:

https://github.com/osTicket/osTicket-plugins/blob/develop/auth-ldap/authentication.php#L31-L42

Cheers.

ealtman

I couldn't get a direct answer out of our Azure manager, but I told him the search base I was using and he suggested I use the full QDN, which fixed the login for nonexistent users. I will keep testing. One more question - can I be a user AND an agent, or would I have to use a different LDAP/AD identity for each?
Answering my own question -- it looks like Elizabeth Altman can exist in the user table and ealtman can exist in the staff table, both using the same email and both logging in with auth_ldap.

KevinTheJedi

ealtman

Yes, with legacy osTicket users and agents are completely separate. You can use the same login information it’ll just be for two accounts. Or if desired you can use separate information.

Just to note, in v2.0 we have combined the users and agents so that agents are really just an extension of users so this will all change once we release v2.0. But for now it’s all separate.

Cheers.