Admin: 4 revisions imported

2016-04-06T20:14:17Z

4 revisions imported

New page

This code is part of the [http://wiki.bestpractical.com/view/LDAP LDAP integration overlay]; you'll also need [[LdapSiteConfigSettings]] and [[LdapUserLocalOverlay]].

Note: Previous versions included an HTML comment at the top of the callback; this breaks the rt command line tool, so it's been removed. If you're having issues with the rt command and getting an error that looks like this:

rt: Malformed RT response from [...]

... you should drop the HTML comment from the head of this file and try it again.

Put this in <code>${RTHOME}/local/html/Callbacks/LDAP/autohandler/Auth</code>:

<nowiki><%init>

# If the user is logging in, let's authenticate; if they can auth but don't load
# (e.g. they don't have an account but external auth succeeds), we'll autocreate
# their account.
unless ($session{'CurrentUser'}) {
if (defined ($user) && defined ($pass) ) {
$session{'CurrentUser'} = RT::CurrentUser->new();
$session{'CurrentUser'}->Load($user);

unless ($session{'CurrentUser'}->Id) {
my $UserObj = RT::User->new($RT::SystemUser);
my ($val, $msg) = $UserObj->SetName($user);

if ($UserObj->IsPassword($pass)) {
### If there were a standard param to check for whether or not we
### should autocreate users, we'd check it here.
my ($val, $msg) =
$UserObj->Create(%{ref($RT::AutoCreate) ? $RT::AutoCreate : {}},
Name => $user,
Gecos => $user,
);
$RT::Logger->info("Autocreated authenticated user " . $UserObj->Name .
" (" . $UserObj->Id . ")\n");
}

$session{'CurrentUser'}->Load($user) if $UserObj->Id;
}
}

if ($session{'CurrentUser'} && $session{'CurrentUser'}->Id) {
$session{'CurrentUser'}->UserObj->UpdateFromLdap();

if ($session{'CurrentUser'}->UserObj->Disabled) {
delete $session{'CurrentUser'};
}
}
# we don't want to leave unauthenticated sessions active do we?
# thanks to Walter Duncan for sealing a gaping hole here.
if ($session{'CurrentUser'} &&
$session{'CurrentUser'}->Id &&
$session{'CurrentUser'}->IsPassword($pass)
) {
$RT::Logger->info("Successful login for $user from " .
"$ENV{'REMOTE_ADDR'}");
} else {
delete $session{'CurrentUser'};
}
}
return;
</%init>

<%ARGS>
$user => undef
$pass => undef
$menu => undef
</%ARGS>
</nowiki>

----

For rt-3.4.5, I needed to split update & disable from actual login authorization. Otherwise we leave an active unauthenticated session lying around bypassing all authentication on existing local RT accounts. --wcd

41.232.58.138: Adding categories

2012-01-30T02:20:21Z

Adding categories

New page

LdapAutocreateAuthCallback - Revision history

Admin: 4 revisions imported

41.232.58.138: Adding categories