LDAP active directory - authentification denied for client login

gestion4

Hello,
ii have installed the last version of osticket on windows server 2019 / iis / php7.
I have configured the ldap plugin and it seem work.
i have add an agent with authentification by ldap and it work.
but when i try to login a client that not work.
I have create a user after he sent an email, i have selected ldap authentification but he can't login , that said acces denied.
i have search on the web and i found this fix : https://github.com/osTicket/osTicket/pull/3456 but the line annotate(array('relevance' => new SqlCode(1))) don't exist.

sorry for my poor english

best regards

gestion4

Hello again,

need help because don't really understand how it's workand so what's wrong..

for information, it's for internal purpose,.there is only the ad user which will use it

thank you

ntozier

Did you enable the plugin for Users?

Does the Users account exist? (in osTicket and in LDAP/AD)

gestion4

ntozier

yes the plugin is enabled and the account exist is LDAP/AD.
in OS Ticket, i have register the account from a received mail, i have specified ldap auuthentification.

we are agree, the username need to be the same that the user logon name in AD? or it must be the email?

i have also tried to enable the passtru plugin but without succes.
i tried also this fix https://github.com/osTicket/osTicket/pull/3441/commits/5dcde97208398ead24cc74413019923c29fd372d , without succes too

my AD search base is "OU=RDSUsers,OU=RDS2K12,DC=scm,DC=local"
ou rdsusers is in rds2k12 OU , is it the right way?

gestion4

ntozier
yes , i have created a local user and that work (with email)

i have found php log, there is just some warning about zend extension php_opcache.dll , nothing about ldap/active directory

gestion4

ntozier

hello again,

there is no documentation about this plugin?

Is the username need do to be filled for osticket ad user?
actually it is the same in AD

thank you

ntozier

What flavor of LDAP are you using?
Are you seeing any errors?
How about on the LDAP server error logs?
Or PHP errors?

gestion4

I use Active directory
no error when i validate ldap configuration plugin.
in osticket i have invalid csrf token or failed login attempt (user)

i don't find php error log on iis..

ntozier

The error you are getting does not seem to be related to authentication via ldap. Can you log in as a user not using an AD account?

gestion4

ntozier

hello,
i really don't understand why that work for agent and not for users, it's crazy...

ntozier

Plugin doesn't really need much in the way of documentation. You configure it (and there are numerous posts here on the forums about how to do so) and it works.

The username is the samAccountName in AD.

We've been using this plugin on multiple sites where I work for years and had no issues.

gestion4

ntozier

thank, it's ok for this username = samaccountname.

i don't undestand why what work for agent and not for user...

if agent loggin work that mean that the ldap plugin configuration work, right?
so what's the difference between the two ?

ntozier

The only times I remember seeing this is from the following:

user does not have an account in osticket.
it was not enabled in the plugin config.

gestion4

ntozier

user authentification is checked on plugin configuration and i have created an account in osticket.
but may be it not created correctly, i don't see other thing.
so , i have selected ldap authenfication (and i verified in table users_account in database.
the last thing is the username,
you said username need to be the same as samaccountname in AD .
so it must be in the form of 'domaine\name' or just name?

ntozier

Just username. Because you supplied the domain in the plugin (Default Domain).

gestion4

ntozier
ok so it's righ...
here my config because i don't see...

ntozier

Are all your users located in RDS2K12?

gestion4

ntozier
yes, in a sub OU in rds2k12

ntozier

Then i have no idea why its not working. Can you consult the error logs (event Viewer) for AD and see anything there?

gestion4

ntozier

hello, i see nothing.
i will use osticket local account

yhank for your help