[Resolved] Agent Welcome Finally Working, Yet Agents Can't Sign-In w/ AD Auth

ZoshMan

The last few weeks I have FULL-TIME been ramping up a LAMP stack and trying to get osTicket ready for a 01/01/2020 deployment. This is the final issue I have before it's for the most part ready to go...

After referring to this GitHub issue page and adding a few lines to the staff.inc.php, I now have the Agent Welcome Email working correctly. I'll go to create a new agent, and immediately they get an email informing them they've been added as an agent with an included Password Reset link.

However, whenever my agent will go to login, something appears to be broken. When he opens the page, there is red text that says something like "Enter a username or email". Whether he uses his email or username, and clicks Login, the page loads for a split second, the red text disappears, and nothing else happens on the screen. He isn't admitted into the agent interface.

I presume this may have something to do with me selecting AD or LDAP for the Authentication Backend. However, my AD settings save without error and I don't see any problem in my configuration. Screenshot from Manage > Plugins > LDAP Auth & Lookup (which is enabled):

Screenshot of our AD OU structure to verify my Search Base setting is correct (yes, I've inherited a jank AD structure):

So, why might this be happening? If the LDAP Authentication & Lookup plugin can provide password-less authentication for our end-users then I'd certainly like to leverage that. The less steps my end-users have to make, the better. The following screenshots concern my installation and relevant logs:

Any advice, suggestions, or direction of any kind would be much appreciated!

ramrajone

ZoshMan
Does your LDAP Plugin have any errors?
I notice your user name has space and it also doesn't have domain\userName, not sure if needed
Also, I assume Plugin is enabled correct?
One more thing, you should check to see your AD account is not locked.

ntozier

ramrajone I notice your user name has space and it also doesn't have domain\userName, not sure if neede

I noticed this to. I don't know if the plugin support usernames with spaces in them.

ramrajone One more thing, you should check to see your AD account is not locked.

I believe in this he means check the "bh admin" account and the account that you are trying to log into osTicket with are not locked.

ZoshMan

ramrajone Nope, not that I can see. I checked all of my logs in var/log/apache2/, and the System Logs within the osTicket admin panel doesn't seem to ever mention anything about the LDAP/Auth plugin. It is certainly enabled and has been so.

ntozier I did go ahead and remove the space and also added the distinguished domain prefix. This is our domain super admin and we can always login to it using no space anyway. When I first setup the plugin it seemed like it wouldn't accept the account with the space, which is why I added it.

New search user:

Super admin in AD:

I restarted the server after saving that change in osTicket. I deleted my agent, and re-set him up again, but the same behavior is STILL occurring! He opens his welcome email, navigates to his osticket link, and it still doesn't do anything when he tries to login with either username or email. Any ideas?

ramrajone

ZoshMan
For your search Base, can you try
OU=Users,OU=Blockhouse,DC=blockhouse,DC=com
When you create a new Agent are you setting a password? I don't think the plugin can change or reset the password, it only reads AD.
Also, try using FQDN for LDAP Servers

ZoshMan

ramrajone I'll give that a try. When I'm creating him I'm not touching the Set Password button at all. When he opens the welcome email's link though, it only asks for a username or email?

Dunno if this is relevant, but I noticed on his Chrome's console that this prints out as soon as clicks into the Username/Email box.

ramrajone

ZoshMan
I am not sure about that error, it might be a good test to try another browser
Also, just for a test, could you create a new user in your AD and try to add that as Agent to see if that works
I also wonder if in Agent password has some character not support?

ZoshMan

ramrajone I did try to setup a new test agent through Firefox, although the TypeError error doesn't occur, the same phenomena where after opening the Agent Welcome email link and inputting the new agent's username/email, nothing happens after hitting login. The red text simply disappears nothing else happens. If I try to login at .../scp/ my test agent still can't login.

Rich_C No! UID suggestion definitely doesn't happen when setting up a new agent, I didn't even know this was the functionality if the plugin is working. Not sure why plugin is apparently not binding correctly, my AD server is always on and not blocking any ports. I'll try to mess with my Search Base some more I suppose? And I will also try to setup WireShark capture, although I've never configured WireShark myself before.

KevinTheJedi Would this be my whole problem then? I pasted in the checkbox code from issue #2870. If I undo that change to my staff.inc.php and instead add your 4 lines of code to my staff.php will this allow my new agents to login? I've been trying to use the Active Directory or LDAP Auth Backend the whole time, as show in my initial screenshots.

Thanks everyone for the follow-ups! I'm hoping the solution is right around the corner at this point.

Rich_C

I will be honest the first question I have is simple - when you type in the agent's name into the new agent screen does the UID appear in the drop down. To me this will confirm if the LDAP plugin is working and that the BIND works.

My second suggestion is to go to wireshark and download the portable version. Install it and capture a fixed amount of traffic. Ensure you capture the test login of your agents. I suggest running a filter on the capture to ONLY include packets with the IP of your osTicket Web server.

Feel free to PM me as I'd be happy to assist in getting to the bottom of this.

KevinTheJedi

@ZoshMan

Please read my comment on the same issue you referenced here:

https://github.com/osTicket/osTicket/issues/2870#issuecomment-569781519

This comment includes a link to the official fix as well as an explanation on when an Agent is supposed to receive a Welcome Email.

If you create an Agent and want them to login via LDAP it's best to set the Authentication Backend to the Active Directory or LDAP option so that the system knows to authenticate the Agent via AD.

Cheers.

KevinTheJedi

@ZoshMan

Yes, undo the original changes and implement the changes referenced in the oficial fix. This should make it to where the backend is LDAP/AD so it should NOT send a Welcome Email and the Agent can simply go to https://example.com/scp/login.php (or simply https://example.com/scp/) to login with their LDAP/AD credentials.

Cheers.

ZoshMan

KevinTheJedi
Apologies for the short hiatus here, .NET framework ended up breaking and had to reinstall Windows, all the while being flooded with issues and requests.

I rolled back the previous change to the .../staff/staff.inc.php and implemented your new change to .../scp/staff.php and the email no longer sends for LDAP/AD Auth, but I STILL can't get my agents to login leveraging our AD... Not sure how else to get this LDAP plugin to work... I downloaded Microsoft's PortQueryUI tool and verified my AD DC is in-fact listening on TCP/UDP port 389, however it doesn't seem like my osTicket LAMP server can bind.

In the plugin settings, what is the proper syntax to get the port number applied?

KevinTheJedi

@ZoshMan

You will need to clone the plugins repo locally, apply this patch, rebuild the LDAP plugin, install the newly built plugin, and that should fix the issue.

If you do not know how to build plugins or if you can't for some reason, then you should wait for the patch to be applied and a new build of the plugin to be released. OR you can just downgrade PHP to below v7.2 as this issue was introduced with v7.2 and above.

Cheers.

ZoshMan

KevinTheJedi Thanks for that. Yesterday I cloned that repo to my home directory and carefully made your changes to the auth.php and config.php files. After setting my php.ini's phar.readonly to off and also installing and enabling PHP-curl, I was able to build the plugin into a phar file. I deleted my old phar, and copied this newly built one into osTicket and installed it. I can bind the server to my desired port now.

However, I still can't find any indication the plugin is working. It saved my settings and is enabled. I also made sure to enabled it for staff and clients. I guess I should be also asking what is the proper functionality of this plugin? Because to me it sounds like it should be authenticating users against AD instead of using a pre-set password.

KevinTheJedi

@ZoshMan

Yes, once you install the plugin you enable authentication for agents and/or users at the bottom of the plugin settings. If enabled for Agents, Agents will be able to login using their AD credentials. If enabled for Users, Users will be able to login using their AD credentials.

Cheers.

ZoshMan

KevinTheJedi Hey disregard my last message, AD Auth is WORKING & FUNCTIONAL!!! 🙂 New agents I create can get right in with their Windows logon and the same goes for clients/end-users as well!! Thanks very much for your time through this. Your code fixed my issue, my recent issue was that I either didn't set a password for my search user OR didn't define my search user by domain/user.

Just wanted one clarification, when a new client logs in, does osTicket pull their email from the user's AD Profile Email? Found here:

Or is this field being pulled in using another method?

KevinTheJedi

@ZoshMan

If they don't already have a User account with the same email address then it will pull from AD, otherwise it will use existing information from the system.

Cheers.

KevinTheJedi

@ZoshMan

By the way, kudos to you man for figuring out how to build plugins! That's awesome. 🎉

Cheers.

ZoshMan

KevinTheJedi Hahah I was also a little proud that I was able to do that considering I've never worked with PHP before and I only just started learning Linux to build this LAMP stack for osTicket. Went off of nothing but problem-solving! I was just about to report back here that I couldn't build the plugin before I realized from the stack trace that it was trying to call a Curl function but Curl doesn't come packaged with PHP by default. Nothing a simple apt-get couldn't fix. So yeah, your platform has certainly inspired a ton of learning over here and I can't wait to get this deployed so I can bunker down and start learning PHP to customize this platform even further.

One LAST question... Will that HTTP-Passthrough plugin work in tandem with ldap-auth to automatically login my end-users to the client portal upon first visit? The less steps a senior citizen or otherwise computer-illiterate person has to perform to do something, the better! If that plugin will not accomplish this SSO-functionality, is there something else from the community that does?

KevinTheJedi

@ZoshMan

Considering the amount people that do know PHP very well and still can't build phar archives...that's actually amazing lol You sound a bit like me, if I don't know something I'll do it over and over using documentation, problem solving, and good ole process of elimination until I understand it lol

HTTPassthru will take authentication from the server level and auto login users/agents to the system. For Apache this is called Apache SSO and there are many guides online on how to configure this. Once you have that configured you just need to install/enable the HTTPassthru plugin and it should start using server level credentials.

Cheers.

ZoshMan

KevinTheJedi THANK YOU!!! I'd consider this whole thread and the issues herein done & done.