NtlmAuthentication

From Request Tracker Wiki
Jump to navigation Jump to search

NTLM Authentication - a.k.a. Single sign-on

RT 3.4.6 on Apache 2.2 with mod_perl on FC4

Here are some notes from my setup of RT 3.4.6, running on Apache 2.2 with mod_perl on FC4.

I followed the excellent guidance provided by Nathan Mehl at http://blank.org/memory/output/rt-ad-sso.html.

First, I installed Apache 2, mod_perl and RT 3.4.6 and got it all working, then...

Install mod_ntlm2

Downloaded mod_ntlm2-0.1.tgz from http://modntlm.sourceforge.net/

cd /usr/local/src

gunzip <mod_ntlm2-0.1.tgz | tar -xvf -
cd mod_ntlm2-0.1
PATH=$PATH:/usr/local/apache2/bin

There are some declarations in smbval/smblib.inc.c that the compiler doesn't like, so change it as follows:

diff -r mod_ntlm2-0.1/smbval/smblib.inc.c mod_ntlm2-0.1-fixed/smbval/smblib.inc.c

25,26c25,26
< static int SMBlib_errno;
< static int SMBlib_SMB_Error;

> int SMBlib_errno;

> int SMBlib_SMB_Error;
35c35
< static SMB_State_Types SMBlib_State;

> SMB_State_Types SMBlib_State;

If you don't do this, you may see errors like the following when you compile:

In file included from mod_ntlm.c:107:

smbval/smblib.inc.c: At top level:
smbval/smblib.inc.c:25: error: static declaration of 'SMBlib_errno' follows non-static declaration
smbval/smblib-priv.h:668: error: previous declaration of 'SMBlib_errno' was here
smbval/smblib.inc.c:26: error: static declaration of 'SMBlib_SMB_Error' follows non-static declaration
smbval/smblib-priv.h:669: error: previous declaration of 'SMBlib_SMB_Error' was here
smbval/smblib.inc.c:35: error: static declaration of 'SMBlib_State' follows non-static declaration
smbval/smblib-priv.h:665: error: previous declaration of 'SMBlib_State' was here

Also, it seems APXS (or the GNU libtools) have changed since the Makefile was written, so change Makefile as follows:

diff -r mod_ntlm2-0.1/Makefile mod_ntlm2-0.1-fixed/Makefile

20c20
<       $(APXS) -i -a -n 'ntlm' mod_ntlm.so

> $(APXS) -i -a -n 'ntlm' mod_ntlm.la

diff -r mod_ntlm2-0.1/mod_ntlm.c mod_ntlm2-0.1-fixed/mod_ntlm.c
590c590,596
<     apr_pool_sub_make(&sp,p,NULL);

> /*

>      * apr_pool_sub_make(&sp,p,NULL);
>      *
>      * This function call is not longer available with apache 2.2
>      * Try replacing it with apr_pool_create_ex()
>      */
>     apr_pool_create_ex(&sp,p,NULL,NULL);

If you don't, you may see errors like the following when you try to make the package:

cp mod_ntlm.so /usr/local/apache2/modules/mod_ntlm.so

cp: cannot stat `mod_ntlm.so': No such file or directory
apxs:Error: Command failed with rc=65536

Finally, I had to change mod_ntlm.c to work with Apache 2.2:

diff mod_ntlm2-0.1/mod_ntlm.c mod_ntlm2-0.1-fixed/mod_ntlm.c

590c590,596
<     apr_pool_sub_make(&sp,p,NULL);

> /*

>      * apr_pool_sub_make(&sp,p,NULL);
>      *
>      * This function call is not longer available with apache 2.2
>      * Try replacing it with apr_pool_create_ex()
>      */
>     apr_pool_create_ex(&sp,p,NULL,NULL);

Without this change, you may see errors like the following when you stop Apache (after installing and configuring, which follows):

httpd: Syntax error on line 55 of /usr/local/apache2/conf/httpd.conf: Cannot load /usr/local/apache2/modules/mod_ntlm.so into server: /usr/local/apache2/modules/mod_ntlm.so: undefined symbol: apr_pool_sub_make

Finally, you should be ready to make and install the package...

make

make install

Configure RT

Add to /opt/rt3/etc/RT_SiteConfig.pm:

Set($WebExternalAuth , '1');

Set($WebFallbackToInternalAuth , '1');
Set($WebExternalGecos , undef);
Set($WebExternalAuto , '1');

Change VirtualHost definition in /usr/local/apache2/conf/extra/httpd-vhosts.conf:

<VirtualHost *:80>

       ServerName rt.mydomain.com
       AddDefaultCharset UTF-8
       DocumentRoot /opt/rt3/share/html
    &lt;Directory "/opt/rt3/share/html"&gt;
        AuthName "Request Tracker"
        AuthType NTLM
        NTLMAuth on
        NTLMAuthoritative on
        NTLMDomain lhl.co.nz
        NTLMServer dc1.mydomain.com
        NTLMBackup dc2.mydomain.com
        require valid-user
    &lt;/Directory&gt;

#    RedirectMatch permanent (.*)/$ http://rt.mydomain.com/$1/index.html

    # this line applies to Apache2+mod_perl2 only
    # Below line might be incorrect, I had to use:
    #     PerlModule Apache2::compat
    # mod_perl 2.0.1 from FC4 Linux
    #PerlModule Apache2 Apache::compat
    PerlModule Apache2::compat

    PerlModule Apache::DBI
    PerlRequire /opt/rt3/bin/webmux.pl

    &lt;Location /&gt;
           SetHandler perl-script
           PerlHandler RT::Mason
    &lt;/Location&gt;

        ErrorLog logs/rt.lhl.co.nz-error_log
        CustomLog logs/rt.lhl.co.nz-access_log common

&lt;/VirtualHost&gt;


</nowiki>

Create /opt/rt3/lib/User_Local.pm as:

# BEGIN LICENSE BLOCK

   #
   # Copyright (c) 2004 Petter Reinholdtsen <pere@hungry.com>
   #
   # (Except where explictly superceded by other copyright notices)
   #
   # This work is made available to you under the terms of Version 2 of
   # the GNU General Public License. A copy of that license should have
   # been provided with this software, but in any event can be snarfed
   # from www.gnu.org.
   #
   # This work is distributed in the hope that it will be useful, but
   # WITHOUT ANY WARRANTY; without even the implied warranty of
   # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   # General Public License for more details.
   #
   # Unless otherwise specified, all modifications, corrections or
   # extensions to this work which alter its source code become the
   # property of Best Practical Solutions, LLC when submitted for
   # inclusion in the work.
   #
   #
   # END LICENSE BLOCK
# LDAP integration in RT 3.  These overrides provide LDAP
# authentication and user info syncronizing.
#
# Written by Petter Reinholdtsen &lt;pere@hungry.com&gt; based on Code from
# Marcelo Bartsch &lt;bartschm_cl@hotmail.com&gt;, Stewart James
# &lt;stewart.james@vu.edu.au&gt; and Carl Makin &lt;carl@xena.IPAustralia.gov.au&gt;.
#
# Copy this file into rt3/local/lib/RT/User_Local.pm to active it.


# Modification Originally by Marcelo Bartsch &lt;bartschm_cl@hotmail.com&gt;
# Update by Stewart James &lt;stewart.james@vu.edu.au for rt3.
# Update with TLS support and more flexible LDAP code by Petter Reinholdtsen.
# Drop this file in /opt/rt3/lib/RT/User_Local.pm
# Drop something like below in yout RT_SiteConfig.pm
#
# Set($LDAPExternalAuth, 1); # Enable LDAP auth
# Set($LdapServer, "ldap.domain.com");
# Set($LdapCAFile, "/site/w3-sertifikater/w3_cacert.pem");
# Set($LdapAuthStartTLS, 1); # Need to use TLS or ldaps to check passwords
# Set($LdapUser, ""); # Can search without username and password
# Set($LdapAuthPass, "");
# Set($LdapAuthBase, "ou=users,dc=domain,dc=com");
# Set($LdapAuthUidAttr, "uid");
# Set($LdapAuthFilter, "(objectclass=posixAccount)");


no warnings qw(redefine);

# {{{ sub LookupExternalUserInfo

=item LookupExternalUserInfo

 LookupExternalUserInfo is a site-definable method for synchronizing
 incoming users with an external data source.

 This routine takes a tuple of EmailAddress and FriendlyName
   EmailAddress is the user's email address, ususally taken from
       an email message's From: header.
   RealName is a freeform string, ususally taken from the "comment"
       portion of an email message's From: header.

 It returns (FoundInExternalDatabase, ParamHash);

   FoundInExternalDatabase must be set to 1 before return if the user
   was found in the external database.

   ParamHash is a Perl parameter hash which can contain at least the
   following fields. These fields are used to populate RT's users
   database when the user is created

     EmailAddress is the email address that RT should use for this user.
     Name is the 'Name' attribute RT should use for this user.
         'Name' is used for things like access control and user lookups.
     RealName is what RT should display as the user's name when displaying
         'friendly' names

=cut

sub LookupExternalUserInfo {
  my %UserInfo = ();
  $UserInfo{'EmailAddress'} = shift;
  $UserInfo{'RealName'} = shift;
  $UserInfo{'RealName'} =~ s/\"//g;

  my $FoundInExternalDatabase = 0;

  # Name is the RT username you want to use for this user.
  my %LdapUserInfo = LdapUserFindByMailaddr($UserInfo{'EmailAddress'});
  if ($LdapUserInfo{'Name'}) {
      $FoundInExternalDatabase = 1;
      $RT::Logger-&gt;info("LookupExternalUserInfo: Mapping '".
                        $UserInfo{'EmailAddress'} .
                        "' to '" .
                        $LdapUserInfo{'Name'} . "'");
      foreach my $key (keys %LdapUserInfo) {
          $UserInfo{$key} = $LdapUserInfo{$key};
      }
  } else {
      $RT::Logger-&gt;info("LookupExternalUserInfo: Fail to find username for '".
                        $UserInfo{'EmailAddress'}."'");
  }

  return ($FoundInExternalDatabase, %UserInfo);
}

# }}}

# {{{ sub CanonicalizeUserInfo

sub CanonicalizeUserInfo {
    my $self    = shift;
    my $argsref = shift;
    my $success = 1;

    my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
        LookupExternalUserInfo( $argsref-&gt;{'EmailAddress'},
                                $argsref-&gt;{'RealName'} );
    if ($UserFoundInExternalDatabase) {
        for my $key (keys %ExternalUserInfo) {
            $argsref-&gt;{$key} = $ExternalUserInfo{$key};
        }
    }

    return ($success);
}

# }}}

# {{{ sub SetPasswordExternal

=head2 SetPasswordExternal

Takes a string, and try to set this string as the users password in an
external system, if the user is listed in the external system.

Returns 1 if the password was set successfully, undef if it failed,
and -1 if the user is unknown to the external system.

This hook is called from SetPassword.

=cut

sub SetPasswordExternal {
    my $self     = shift;
    my $password = shift;

    # Not allowed to set password for users in LDAP
    if ($RT::LDAPExternalAuth) {
        my $ldap = LdapConnect();
        my $mesg;
        if ( $mesg = LdapFindUser( $ldap, $self-&gt;Name )
             &amp;&amp; defined $mesg &amp;&amp; $mesg-&gt;count ) {
            LdapDisconnect($ldap);
            return ( undef,
                     $self-&gt;loc("LDAP users must change password in LDAP") );
        }
        LdapDisconnect($ldap);
    }
    return (-1, "No such user in LDAP");
}

# }}}

# {{{ sub SetPassword

=head2 SetPassword

Takes a string. Checks the string's length and sets this user's password
to that string.

Override for function in User_Overlay.pm, with modification for LDAP
authentication.

=cut

sub SetPassword {
    my $self     = shift;
    my $password = shift;

    unless ( $self-&gt;CurrentUserCanModify('Password') ) {
        return ( 0, $self-&gt;loc('Permission Denied') );
    }

    my ($code, $msg) = $self-&gt;SetPasswordExternal($password);
    return ($code, $msg) unless (-1 == $code);

    if ( !$password ) {
        return ( 0, $self-&gt;loc("No password set") );
    }
    elsif ( length($password) &lt; $RT::MinimumPasswordLength ) {
        return ( 0, $self-&gt;loc("Password too short") );
    }
    else {
        $password = $self-&gt;_GeneratePassword($password);
        return ( $self-&gt;SUPER::SetPassword( $password));
    }

}

# }}}

# {{{ sub IsPasswordExternal

=head2 IsPasswordExternal

Returns true if the passed in value is this user's password.  Return
undef if the password don't match.  Return -1 if the user is unknown
in the external system.

This hook is called from IsPassword.

=cut

sub IsPasswordExternal {
    my $self  = shift;
    my $value = shift;
        # Let LDAP be authorative for users in LDAP, and only fall
        # through for users without LDAP entry.
        if ($RT::LDAPExternalAuth) {
            return IsLdapPassword($self-&gt;Name, $value);
        }
}

# }}}

# {{{ sub IsPassword

=head2 IsPassword

Check the users password using LDAP.  Override for function in
User_Overlay.pm, with modification for LDAP authentication.

=cut

sub IsPassword {
        my $self  = shift;
        my $value = shift;

        #TODO there isn't any apparent way to legitimately ACL this

        # RT does not allow null passwords
        if ( ( !defined($value) ) or ( $value eq '' ) ) {
                return (undef);
        }

        if ( $self-&gt;PrincipalObj-&gt;Disabled ) {
                $RT::Logger-&gt;info(
                        "Disabled user " . $self-&gt;Name . " tried to log in" );
                return (undef);
        }

        if ( ($self-&gt;__Value('Password') eq '') ||
                ($self-&gt;__Value('Password') eq undef) )  {
                return(undef);
        }

        my $code = $self-&gt;IsPasswordExternal($value);
        return ($code) unless (-1 == $code);

        # is it an MD5 password
        if ($self-&gt;__Value('Password') eq $self-&gt;_GeneratePassword($value)) {
                return(1);
        }

        # if it's recognized by crypt, we say ok too.
        if ($self-&gt;__Value('Password') eq crypt($value,
                                                $self-&gt;__Value('Password'))) {
            return (1);
        }

        # no password check has succeeded. get out
        return (undef);
}

# }}}

# {{{ sub LdapUserFindByMailaddr

=head2 LdapUserFindByMailaddr

Lookup user owning a given email address on UiO, returning the
username or undef if not known or the search failed.

The following configure options are used by this function in addition
to the ones used by LdapConnect().

 $RT::LdapMailBase
 $RT::LdapMailFilter
 $RT::LdapMailScope
 $RT::LdapMailSearchAttr
 $RT::LdapMailMap

=cut

# Example search
#   ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm

sub LdapUserFindByMailaddr {
    my $mailaddr = shift;
    my %UserInfo = ();
    $ldap = LdapConnect();
    my $filter = "(&amp;($RT::LdapMailSearchAttr=$mailaddr)$RT::LdapMailFilter)";
    my @attr = keys %RT::LdapMailResultMap;
    $RT::Logger-&gt;info( "LdapUserFindByMailaddr: Looking for ",
                           join(" ", @attr), " filter=", $filter );
    $mesg = $ldap-&gt;search(
                          base       =&gt; $RT::LdapMailBase,
                          scope      =&gt; $RT::LdapMailScope,
                          filter     =&gt; $filter,
                          attributes =&gt; [@attr],
                          );
    if ( ($mesg-&gt;code != LDAP_SUCCESS) and
         ($mesg-&gt;code != LDAP_PARTIAL_RESULTS) ) {
        $RT::Logger-&gt;critical("LdapUserFindByMailaddr: Search failed: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        LdapDisconnect($ldap);
        return undef;
    }

    if (1 != $mesg-&gt;count) {
        LdapDisconnect($ldap);
        return undef;
    }

    while( my $entry = $mesg-&gt;shift_entry) {
        foreach my $attr (keys %RT::LdapMailResultMap) {
            foreach my $value ($entry-&gt;get_value($attr)) {
                $UserInfo{$RT::LdapMailResultMap{$attr}} = $value;
            }
        }
    }
    LdapDisconnect($ldap);
    return %UserInfo;
}

# {{{ sub LdapConnect

=head2 LdapConnect

Connect to the LDAP databsae.

The following configure options are used by this function:

  $RT::LdapServer
  $RT::LdapUser
  $RT::LdapPass

=cut

sub LdapConnect {
    use Net::LDAP qw(LDAP_SUCCESS LDAP_PARTIAL_RESULTS);
    use Net::LDAP::Util qw (ldap_error_name);

    my $mesg;
    my $ldap = Net::LDAP-&gt;new($RT::LdapServer,
                              version =&gt; 3);

    unless ($ldap) {
        $RT::Logger-&gt;critical("IsLdapPassword: Cannot connect to",
                              "LDAP server ", $RT::LdapServer);
        return undef;
    }

    # I seem to have problems if I try and bind with a NULL username
    # by hand So this now checks to see if we are really going to bind
    # with a username.
    if (defined($RT::LdapUser) &amp;&amp; $RT::LdapUser ne '') {
        $mesg = $ldap-&gt;bind($RT::LdapUser,
                            password =&gt; $RT::LdapPass );
    } else {
        # This bind is redundant with LDAP protocol version 3
        $mesg = $ldap-&gt;bind;
    }
    if ($mesg-&gt;code != LDAP_SUCCESS) {
        $RT::Logger-&gt;critical("IsLdapPassword: Cannot bind to LDAP: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        return undef;
    }
    return $ldap;
}

# }}}

# {{{ sub LdapDisconnect

=head2 LdapDisconnect

Disconnect from the LDAP database.

=cut

sub LdapDisconnect {
    my $ldap = shift;
    my $mesg = $ldap-&gt;unbind();
    if ($mesg-&gt;code != LDAP_SUCCESS) {
        $RT::Logger-&gt;critical("LdapDisconnect: unbind failed: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
    }
}

# }}}

# {{{ sub LdapFindUser

=head2 LdapFindUser

Locate info on a giver user given the username.

Configure options used by this function:

  $RT::LdpaAuthBase
  $RT::LdpaAuthFilter
  $RT::LdpaAuthUidAttr

=cut

sub LdapFindUser {
    my $ldap = shift;
    my $username = shift;

    my $filter;
    if ($RT::LdapAuthFilter) {
        $filter = "(&amp;(" .$RT::LdapAuthUidAttr . "=$username)$RT::LdapAuthFilter)";
    } else {
        $filter = "(" .$RT::LdapAuthUidAttr . "=$username)";
    }

    $RT::Logger-&gt;debug("IsLdapPassword: First search filter '$filter'");
    my $mesg = $ldap-&gt;search(base   =&gt; $RT::LdapAuthBase,
                             filter =&gt; $filter,
                             attrs  =&gt; ['dn']);
    if (!(($mesg-&gt;code == LDAP_SUCCESS) or
          ($mesg-&gt;code == LDAP_PARTIAL_RESULTS)))
    {
        $RT::Logger-&gt;debug("IsLdapPassword: Could not search for $filter: ",
                           "retval=", $mesg-&gt;code, " ",
                           ldap_error_name($mesg-&gt;code));
        return undef;
    }
    return $mesg;
}

# }}}

# {{{ sub IsLdapPassword

=head2 IsLdapPassword

Takes a username and password as argument, and check if the password
is correct for the given user.  Return undef if password check failed,
-1 if the user is unknown, and 1 if the password check succeeded.

=cut

sub IsLdapPassword {
    my $username = shift;
    my $value    = shift;

    $RT::Logger-&gt;debug("IsLdapPassword: executing");
    my $ldap = LdapConnect();
    return undef unless $ldap;

    my $mesg = LdapFindUser($ldap, $username);
    unless ($mesg) {
        LdapDisconnect($ldap);
        return undef;
    }
    $RT::Logger-&gt;debug("IsLdapPassword: First search produced ",
                       $mesg-&gt;count, " results");
    if (! $mesg-&gt;count)
    {
        $RT::Logger-&gt;info("IsLdapPassword: AUTH FAILED $username");
        LdapDisconnect($ldap);
        return -1;
    }
    $ldap-&gt;start_tls( verify =&gt; 'require',
                      cafile =&gt; $RT::LdapCAFile ) if ($RT::LdapAuthStartTLS);

    my $userdn = $mesg-&gt;first_entry-&gt;dn;
    $RT::Logger-&gt;debug("IsLdapPassword: Trying to bind using DN=$userdn");
    my $mesg2 = $ldap-&gt;bind($userdn,
                            password =&gt; $value );
    if ($mesg2-&gt;code != LDAP_SUCCESS) {
        $RT::Logger-&gt;critical("IsLdapPassword: Unable to bind as $userdn: ",
                              "retval=", $mesg2-&gt;code, " ",
                              ldap_error_name($mesg2-&gt;code));
        LdapDisconnect($ldap);
        return undef;
    }
    else
    {
        $RT::Logger-&gt;info("IsLdapPassword: AUTH OK $username ($userdn) base:",
                          $RT::LdapAuthBase);
        LdapDisconnect($ldap);
        return 1;
    }
}

# }}}

1;


</nowiki>

Add configuration to /opt/rt3/etc/RT_SiteConfig.pm:

Set($LDAPExternalAuth, '1'); # Enable LDAP auth

Set($LdapServer,                "dc1.mydomain.com");
Set($LdapCAFile,                undef);
Set($LdapUser,                  'cn=LDAP User,CN=Users,dc=lhl,dc=co,dc=nz');
Set($LdapPass,                  'Password');
Set($LdapAuthStartTLS,          '1'); # Need to use TLS or ldaps to check passwords
Set($LdapAuthBase,              "cn=LHL Users,dc=lhl,dc=co,dc=nz");
Set($LdapAuthUidAttr,           'sAMAccountName');
Set($LdapAuthFilter,            '(objectClass=user)');
Set($LdapMailBase,              'cn=LHL Users,dc=lhl,dc=co,dc=nz');
Set($LdapMailFilter,            '(objectClass=user)');
Set($LdapMailScope,             'sub');
Set($LdapMailSearchAttr,        'mail');
%RT::LdapMailResultMap = (
       'sAMAccountName'        => 'Name',
       'mail'                  => 'EmailAddress',
       'cn'                    => 'RealName',
       );

Create /opt/rt3/lib/RT/Interface/Web_Local.pm as:

# BEGIN LICENSE BLOCK

   #
   # Copyright (c) 2005 Nathan Mehl <rt-ad-sso@memory.blank.org>
   # (Except where explictly superceded by other copyright notices)
   # portions Copyright (c) 2004 Petter Reinholdtsen <pere@hungry.com>
   # portions Copyright (c) 2004 Jesse Vincent <jesse@fsck.com>
   #
   # This work is made available to you under the terms of Version 2 of
   # the GNU General Public License. A copy of that license should have
   # been provided with this software, but in any event can be snarfed
   # from www.gnu.org.
   #
   # This work is distributed in the hope that it will be useful, but
   # WITHOUT ANY WARRANTY; without even the implied warranty of
   # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   # General Public License for more details.
   #
   # Unless otherwise specified, all modifications, corrections or
   # extensions to this work which alter its source code become the
   # property of Best Practical Solutions, LLC when submitted for
   # inclusion in the work.
   #
   #
   # END LICENSE BLOCK
package RT::Interface::Web;

no warnings qw(redefine);

# {{{ WebExternalAutoInfo

=head2 WebExternalAutoInfo($user);

Returns a hash of user attributes, used when WebExternalAuto is set.

=cut

sub WebExternalAutoInfo {
    my $user = shift;

    my %user_info;

    $user_info{'Privileged'} = 0;

    $RT::Logger-&gt;debug( "WebExternalAutoInfo: Looking for ", $user );
    my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
        LookupExternalUsername( $user );

    # populate user fields from the ldap directory
    if ($UserFoundInExternalDatabase) {
        $user_info{'RealName'} = $ExternalUserInfo{'RealName'} if defined $ExternalUserInfo{'RealName'};
        $user_info{'Name'} = $ExternalUserInfo{'Name'} if defined $ExternalUserInfo{'Name'};
        $user_info{'EmailAddress'} = $ExternalUserInfo{'EmailAddress'} if defined $ExternalUserInfo{'EmailAddress'};
    } elsif ($^O !~ /^(?:riscos|MacOS|MSWin32|dos|os2)$/) {
        # Populate fields with information from Unix /etc/passwd
        my ($comments, $realname) = (getpwnam($user))[5, 6];
        $user_info{'Comments'} = $comments if defined $comments;
        $user_info{'RealName'} = $realname if defined $realname;
    }
    elsif ($^O eq 'MSWin32' and eval 'use Net::AdminMisc; 1') {
        # Populate fields with information from NT domain controller
    }

    # and return the wad of stuff
    return {%user_info};
}

# }}}

sub LookupExternalUsername {
  my %UserInfo = ();
  $UserInfo{'Name'} = shift;
  $UserInfo{'Name'} =~ s/\"//g;

  my $FoundInExternalDatabase = 0;

  $RT::Logger-&gt;debug( "LookupExternalUsername: Looking for ", $UserInfo{'Name'} );
  # Name is the RT username you want to use for this user.
  my %LdapUserInfo = LdapUserFindByUsername($UserInfo{'Name'});
  if ($LdapUserInfo{'Name'}) {
      $FoundInExternalDatabase = 1;
      $RT::Logger-&gt;debug("LookupExternalUsername: Mapping '".
                        $UserInfo{'Name'} .
                        "' to '" .
                        $LdapUserInfo{'EmailAddress'} . "'");
      foreach my $key (keys %LdapUserInfo) {
          $UserInfo{$key} = $LdapUserInfo{$key};
      }
  } else {
      $RT::Logger-&gt;debug("LookupExternalUsername: Fail to find username for '".
                        $UserInfo{'Name'}."'");
  }

  return ($FoundInExternalDatabase, %UserInfo);
}

sub LdapUserFindByUsername {
    my $username = shift;
    my %UserInfo = ();

    my $ldap = RT::User::LdapConnect();
    my $filter = "(&amp;($RT::LdapAuthUidAttr=$username)$RT::LdapMailFilter)";
    my @attr = keys %RT::LdapMailResultMap;
    $RT::Logger-&gt;debug( "LdapUserFindByUsername: Looking for ",
                           join(" ", @attr), " filter=", $filter );
    my $mesg = $ldap-&gt;search(
                          base       =&gt; $RT::LdapMailBase,
                          scope      =&gt; $RT::LdapMailScope,
                          filter     =&gt; $filter,
                          attributes =&gt; [@attr],
                          );
    if ( ($mesg-&gt;code != LDAP_SUCCESS) and
         ($mesg-&gt;code != LDAP_PARTIAL_RESULTS) ) {
        $RT::Logger-&gt;critical("LdapUserFindByUsername: Search failed: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        RT::User::LdapDisconnect($ldap);
        return undef;
    }

    if (1 != $mesg-&gt;count) {
        $RT::Logger-&gt;critical("LdapUserFindByUsername: Search returned 0 results: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        RT::User::LdapDisconnect($ldap);
        return undef;
    }

    while( my $entry = $mesg-&gt;shift_entry) {
        foreach my $attr (keys %RT::LdapMailResultMap) {
            foreach my $value ($entry-&gt;get_value($attr)) {
                $UserInfo{$RT::LdapMailResultMap{$attr}} = $value;
            }
        }
    }
    RT::User::LdapDisconnect($ldap);
    return %UserInfo;
}

1;



</nowiki>

After running this for a while, I found users were entering logins instead of email addresses, and lookup in AD was failing, so I changed User_Local.pm as follows, to try lookup by username if lookup by email address fails:

[root@hotel RT]# diff -C 5 -b User_Local.pm.old User_Local.pm

   *** User_Local.pm.old   2007-03-23 13:05:02.000000000 +1200
   --- User_Local.pm       2007-03-23 13:13:23.000000000 +1200
   ***************
   *** 20,41 ****
   --- 20,45 ----
     # inclusion in the work.
     #
     #
     # END LICENSE BLOCK
+
  # LDAP integration in RT 3.  These overrides provide LDAP
  # authentication and user info syncronizing.
  #
  # Written by Petter Reinholdtsen &lt;pere@hungry.com&gt; based on Code from
  # Marcelo Bartsch &lt;bartschm_cl@hotmail.com&gt;, Stewart James
  # &lt;stewart.james@vu.edu.au&gt; and Carl Makin &lt;carl@xena.IPAustralia.gov.au&gt;.
  #
  # Copy this file into rt3/local/lib/RT/User_Local.pm to active it.

+
  # Modification Originally by Marcelo Bartsch &lt;bartschm_cl@hotmail.com&gt;
  # Update by Stewart James &lt;stewart.james@vu.edu.au for rt3.
  # Update with TLS support and more flexible LDAP code by Petter Reinholdtsen.
+ # Update to handle logins presented as email addresses.
+ #
  # Drop this file in /opt/rt3/lib/RT/User_Local.pm
  # Drop something like below in yout RT_SiteConfig.pm
  #
  # Set($LDAPExternalAuth, 1); # Enable LDAP auth
  # Set($LdapServer, "ldap.domain.com");
***************
*** 45,54 ****
--- 49,59 ----
  # Set($LdapAuthPass, "");
  # Set($LdapAuthBase, "ou=users,dc=domain,dc=com");
  # Set($LdapAuthUidAttr, "uid");
  # Set($LdapAuthFilter, "(objectclass=posixAccount)");

+
  no warnings qw(redefine);

  # {{{ sub LookupExternalUserInfo

  =item LookupExternalUserInfo
***************
*** 85,96 ****
--- 90,110 ----
    $UserInfo{'RealName'} = shift;
    $UserInfo{'RealName'} =~ s/\"//g;

    my $FoundInExternalDatabase = 0;

+   $RT::Logger-&gt;info("LookupExternalUserInfo: looking up EmailAddress: '"
+       . $UserInfo{'EmailAddress'} . "', RealName: '"
+       . $UserInfo{'RealName'} . "'" );
+
    # Name is the RT username you want to use for this user.
    my %LdapUserInfo = LdapUserFindByMailaddr($UserInfo{'EmailAddress'});
+   # The EmailAddress may actually be a username, so if lookup by
+   # email address fails, try lookup by username
+   unless($LdapUserInfo{'Name'}) {
+       %LdapUserInfo = LdapUserFindByName($UserInfo{'EmailAddress'});
+   }
    if ($LdapUserInfo{'Name'}) {
        $FoundInExternalDatabase = 1;
        $RT::Logger-&gt;info("LookupExternalUserInfo: Mapping '".
                          $UserInfo{'EmailAddress'} .
                          "' to '" .
***************
*** 113,122 ****
--- 127,140 ----
  sub CanonicalizeUserInfo {
      my $self    = shift;
      my $argsref = shift;
      my $success = 1;

+   $RT::Logger-&gt;info("CanonicalizeUserInfo: "
+       . "EmailAddress: '" . $argsref-&gt;{'EmailAddress'}
+       . "', RealName: '" . $argsref-&gt;{'RealName'} . "'" );
+
      my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
          LookupExternalUserInfo( $argsref-&gt;{'EmailAddress'},
                                  $argsref-&gt;{'RealName'} );
      if ($UserFoundInExternalDatabase) {
          for my $key (keys %ExternalUserInfo) {
***************
*** 275,284 ****
--- 293,379 ----
          return (undef);
  }

  # }}}

+ # {{{ sub LdapUserFindByName
+
+ =head2 LdapUserFindByName
+
+ Lookup user owning a given name on OU, returning the
+ username or undef if not known or the search failed.
+
+ The following configure options are used by this function in addition
+ to the ones used by LdapConnect().
+
+  $RT::LdapNameBase
+  $RT::LdapNameFilter
+  $RT::LdapNameScope
+  $RT::LdapNameSearchAttr
+  $RT::LdapNameResultMap
+
+ For example:
+
+  Set($LdapNameBase,              'dc=mydomain,dc=co,dc=nz');
+  Set($LdapNameFilter,            '(objectClass=user)');
+  Set($LdapNameScope,             'sub');
+  Set($LdapNameSearchAttr,        'sAMAccountName');
+  %RT::LdapNameResultMap = (
+         'sAMAccountName'        =&gt; 'Name',
+         'mail'                  =&gt; 'EmailAddress',
+         'cn'                    =&gt; 'RealName',
+         );
+
+
+ =cut
+
+ # Example search
+ #   ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm
+
+ sub LdapUserFindByName {
+     my $name = shift;
+     my %UserInfo = ();
+     $ldap = LdapConnect();
+     my $filter = "(&amp;($RT::LdapNameSearchAttr=$name)$RT::LdapNameFilter)";
+     my @attr = keys %RT::LdapNameResultMap;
+     $RT::Logger-&gt;info( "LdapUserFindByName: Looking for ",
+                            join(" ", @attr), " filter=", $filter );
+     $mesg = $ldap-&gt;search(
+                           base       =&gt; $RT::LdapNameBase,
+                           scope      =&gt; $RT::LdapNameScope,
+                           filter     =&gt; $filter,
+                           attributes =&gt; [@attr],
+                           );
+     if ( ($mesg-&gt;code != LDAP_SUCCESS) and
+          ($mesg-&gt;code != LDAP_PARTIAL_RESULTS) ) {
+         $RT::Logger-&gt;critical("LdapUserFindByName: Search failed: ",
+                               "retval=", $mesg-&gt;code, " ",
+                               ldap_error_name($mesg-&gt;code));
+         LdapDisconnect($ldap);
+         return undef;
+     }
+
+     if (1 != $mesg-&gt;count) {
+         $RT::Logger-&gt;critical("LdapUserFindByName: Search failed: ",
+                               "\$mesg-&gt;count=", $mesg-&gt;count);
+         LdapDisconnect($ldap);
+         return undef;
+     }
+
+     while( my $entry = $mesg-&gt;shift_entry) {
+         foreach my $attr (keys %RT::LdapNameResultMap) {
+             foreach my $value ($entry-&gt;get_value($attr)) {
+                 $UserInfo{$RT::LdapNameResultMap{$attr}} = $value;
+             }
+         }
+     }
+     LdapDisconnect($ldap);
+     return %UserInfo;
+ }
+
+ # }}}
+
  # {{{ sub LdapUserFindByMailaddr

  =head2 LdapUserFindByMailaddr

  Lookup user owning a given email address on UiO, returning the
***************
*** 422,431 ****
--- 517,530 ----

  sub LdapFindUser {
      my $ldap = shift;
      my $username = shift;

+   $RT::Logger-&gt;info("LdapFindUser: "
+       . "ldap: '" . $ldap
+       . "', username: '" . $username . "'" );
+
      my $filter;
      if ($RT::LdapAuthFilter) {
          $filter = "(&amp;(" .$RT::LdapAuthUidAttr . "=$username)$RT::LdapAuthFilter)";
      } else {
          $filter = "(" .$RT::LdapAuthUidAttr . "=$username)";



</nowiki>

Or, if you just want to cut and paste the final form:

# BEGIN LICENSE BLOCK

   #
   # Copyright (c) 2004 Petter Reinholdtsen <pere@hungry.com>
   #
   # (Except where explictly superceded by other copyright notices)
   #
   # This work is made available to you under the terms of Version 2 of
   # the GNU General Public License. A copy of that license should have
   # been provided with this software, but in any event can be snarfed
   # from www.gnu.org.
   #
   # This work is distributed in the hope that it will be useful, but
   # WITHOUT ANY WARRANTY; without even the implied warranty of
   # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   # General Public License for more details.
   #
   # Unless otherwise specified, all modifications, corrections or
   # extensions to this work which alter its source code become the
   # property of Best Practical Solutions, LLC when submitted for
   # inclusion in the work.
   #
   #
   # END LICENSE BLOCK
# LDAP integration in RT 3.  These overrides provide LDAP
# authentication and user info syncronizing.
#
# Written by Petter Reinholdtsen &lt;pere@hungry.com&gt; based on Code from
# Marcelo Bartsch &lt;bartschm_cl@hotmail.com&gt;, Stewart James
# &lt;stewart.james@vu.edu.au&gt; and Carl Makin &lt;carl@xena.IPAustralia.gov.au&gt;.
#
# Copy this file into rt3/local/lib/RT/User_Local.pm to active it.


# Modification Originally by Marcelo Bartsch &lt;bartschm_cl@hotmail.com&gt;
# Update by Stewart James &lt;stewart.james@vu.edu.au for rt3.
# Update with TLS support and more flexible LDAP code by Petter Reinholdtsen.
# Update to handle logins presented as email addresses.
#
# Drop this file in /opt/rt3/lib/RT/User_Local.pm
# Drop something like below in yout RT_SiteConfig.pm
#
# Set($LDAPExternalAuth, 1); # Enable LDAP auth
# Set($LdapServer, "ldap.domain.com");
# Set($LdapCAFile, "/site/w3-sertifikater/w3_cacert.pem");
# Set($LdapAuthStartTLS, 1); # Need to use TLS or ldaps to check passwords
# Set($LdapUser, ""); # Can search without username and password
# Set($LdapAuthPass, "");
# Set($LdapAuthBase, "ou=users,dc=domain,dc=com");
# Set($LdapAuthUidAttr, "uid");
# Set($LdapAuthFilter, "(objectclass=posixAccount)");


no warnings qw(redefine);

# {{{ sub LookupExternalUserInfo

=item LookupExternalUserInfo

 LookupExternalUserInfo is a site-definable method for synchronizing
 incoming users with an external data source.

 This routine takes a tuple of EmailAddress and FriendlyName
   EmailAddress is the user's email address, ususally taken from
       an email message's From: header.
   RealName is a freeform string, ususally taken from the "comment"
       portion of an email message's From: header.

 It returns (FoundInExternalDatabase, ParamHash);

   FoundInExternalDatabase must be set to 1 before return if the user
   was found in the external database.

   ParamHash is a Perl parameter hash which can contain at least the
   following fields. These fields are used to populate RT's users
   database when the user is created

     EmailAddress is the email address that RT should use for this user.
     Name is the 'Name' attribute RT should use for this user.
         'Name' is used for things like access control and user lookups.
     RealName is what RT should display as the user's name when displaying
         'friendly' names

=cut

sub LookupExternalUserInfo {
  my %UserInfo = ();
  $UserInfo{'EmailAddress'} = shift;
  $UserInfo{'RealName'} = shift;
  $UserInfo{'RealName'} =~ s/\"//g;

  my $FoundInExternalDatabase = 0;

  $RT::Logger-&gt;info("LookupExternalUserInfo: looking up EmailAddress: '"
        . $UserInfo{'EmailAddress'} . "', RealName: '"
        . $UserInfo{'RealName'} . "'" );

  # Name is the RT username you want to use for this user.
  my %LdapUserInfo = LdapUserFindByMailaddr($UserInfo{'EmailAddress'});
  # The EmailAddress may actually be a username, so if lookup by
  # email address fails, try lookup by username
  unless($LdapUserInfo{'Name'}) {
      %LdapUserInfo = LdapUserFindByName($UserInfo{'EmailAddress'});
  }
  if ($LdapUserInfo{'Name'}) {
      $FoundInExternalDatabase = 1;
      $RT::Logger-&gt;info("LookupExternalUserInfo: Mapping '".
                        $UserInfo{'EmailAddress'} .
                        "' to '" .
                        $LdapUserInfo{'Name'} . "'");
      foreach my $key (keys %LdapUserInfo) {
          $UserInfo{$key} = $LdapUserInfo{$key};
      }
  } else {
      $RT::Logger-&gt;info("LookupExternalUserInfo: Fail to find username for '".
                        $UserInfo{'EmailAddress'}."'");
  }

  return ($FoundInExternalDatabase, %UserInfo);
}

# }}}

# {{{ sub CanonicalizeUserInfo

sub CanonicalizeUserInfo {
    my $self    = shift;
    my $argsref = shift;
    my $success = 1;

  $RT::Logger-&gt;info("CanonicalizeUserInfo: "
        . "EmailAddress: '" . $argsref-&gt;{'EmailAddress'}
        . "', RealName: '" . $argsref-&gt;{'RealName'} . "'" );

    my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
        LookupExternalUserInfo( $argsref-&gt;{'EmailAddress'},
                                $argsref-&gt;{'RealName'} );
    if ($UserFoundInExternalDatabase) {
        for my $key (keys %ExternalUserInfo) {
            $argsref-&gt;{$key} = $ExternalUserInfo{$key};
        }
    }

    return ($success);
}

# }}}

# {{{ sub SetPasswordExternal

=head2 SetPasswordExternal

Takes a string, and try to set this string as the users password in an
external system, if the user is listed in the external system.

Returns 1 if the password was set successfully, undef if it failed,
and -1 if the user is unknown to the external system.

This hook is called from SetPassword.

=cut

sub SetPasswordExternal {
    my $self     = shift;
    my $password = shift;

    # Not allowed to set password for users in LDAP
    if ($RT::LDAPExternalAuth) {
        my $ldap = LdapConnect();
        my $mesg;
        if ( $mesg = LdapFindUser( $ldap, $self-&gt;Name )
             &amp;&amp; defined $mesg &amp;&amp; $mesg-&gt;count ) {
            LdapDisconnect($ldap);
            return ( undef,
                     $self-&gt;loc("LDAP users must change password in LDAP") );
        }
        LdapDisconnect($ldap);
    }
    return (-1, "No such user in LDAP");
}

# }}}

# {{{ sub SetPassword

=head2 SetPassword

Takes a string. Checks the string's length and sets this user's password
to that string.

Override for function in User_Overlay.pm, with modification for LDAP
authentication.

=cut

sub SetPassword {
    my $self     = shift;
    my $password = shift;

    unless ( $self-&gt;CurrentUserCanModify('Password') ) {
        return ( 0, $self-&gt;loc('Permission Denied') );
    }

    my ($code, $msg) = $self-&gt;SetPasswordExternal($password);
    return ($code, $msg) unless (-1 == $code);

    if ( !$password ) {
        return ( 0, $self-&gt;loc("No password set") );
    }
    elsif ( length($password) &lt; $RT::MinimumPasswordLength ) {
        return ( 0, $self-&gt;loc("Password too short") );
    }
    else {
        $password = $self-&gt;_GeneratePassword($password);
        return ( $self-&gt;SUPER::SetPassword( $password));
    }

}

# }}}

# {{{ sub IsPasswordExternal

=head2 IsPasswordExternal

Returns true if the passed in value is this user's password.  Return
undef if the password don't match.  Return -1 if the user is unknown
in the external system.

This hook is called from IsPassword.

=cut

sub IsPasswordExternal {
    my $self  = shift;
    my $value = shift;
        # Let LDAP be authorative for users in LDAP, and only fall
        # through for users without LDAP entry.
        if ($RT::LDAPExternalAuth) {
            return IsLdapPassword($self-&gt;Name, $value);
        }
}

# }}}

# {{{ sub IsPassword

=head2 IsPassword

Check the users password using LDAP.  Override for function in
User_Overlay.pm, with modification for LDAP authentication.

=cut

sub IsPassword {
        my $self  = shift;
        my $value = shift;

        #TODO there isn't any apparent way to legitimately ACL this

        # RT does not allow null passwords
        if ( ( !defined($value) ) or ( $value eq '' ) ) {
                return (undef);
        }

        if ( $self-&gt;PrincipalObj-&gt;Disabled ) {
                $RT::Logger-&gt;info(
                        "Disabled user " . $self-&gt;Name . " tried to log in" );
                return (undef);
        }

        if ( ($self-&gt;__Value('Password') eq '') ||
                ($self-&gt;__Value('Password') eq undef) )  {
                return(undef);
        }

        my $code = $self-&gt;IsPasswordExternal($value);
        return ($code) unless (-1 == $code);

        # is it an MD5 password
        if ($self-&gt;__Value('Password') eq $self-&gt;_GeneratePassword($value)) {
                return(1);
        }

        # if it's recognized by crypt, we say ok too.
        if ($self-&gt;__Value('Password') eq crypt($value,
                                                $self-&gt;__Value('Password'))) {
            return (1);
        }

        # no password check has succeeded. get out
        return (undef);
}

# }}}

# {{{ sub LdapUserFindByName

=head2 LdapUserFindByName

Lookup user owning a given name on OU, returning the
username or undef if not known or the search failed.

The following configure options are used by this function in addition
to the ones used by LdapConnect().

 $RT::LdapNameBase
 $RT::LdapNameFilter
 $RT::LdapNameScope
 $RT::LdapNameSearchAttr
 $RT::LdapNameResultMap

For example:

 Set($LdapNameBase,              'dc=mydomain,dc=co,dc=nz');
 Set($LdapNameFilter,            '(objectClass=user)');
 Set($LdapNameScope,             'sub');
 Set($LdapNameSearchAttr,        'sAMAccountName');
 %RT::LdapNameResultMap = (
        'sAMAccountName'        =&gt; 'Name',
        'mail'                  =&gt; 'EmailAddress',
        'cn'                    =&gt; 'RealName',
        );


=cut

# Example search
#   ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm

sub LdapUserFindByName {
    my $name = shift;
    my %UserInfo = ();
    $ldap = LdapConnect();
    my $filter = "(&amp;($RT::LdapNameSearchAttr=$name)$RT::LdapNameFilter)";
    my @attr = keys %RT::LdapNameResultMap;
    $RT::Logger-&gt;info( "LdapUserFindByName: Looking for ",
                           join(" ", @attr), " filter=", $filter );
    $mesg = $ldap-&gt;search(
                          base       =&gt; $RT::LdapNameBase,
                          scope      =&gt; $RT::LdapNameScope,
                          filter     =&gt; $filter,
                          attributes =&gt; [@attr],
                          );
    if ( ($mesg-&gt;code != LDAP_SUCCESS) and
         ($mesg-&gt;code != LDAP_PARTIAL_RESULTS) ) {
        $RT::Logger-&gt;critical("LdapUserFindByName: Search failed: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        LdapDisconnect($ldap);
        return undef;
    }

    if (1 != $mesg-&gt;count) {
        $RT::Logger-&gt;critical("LdapUserFindByName: Search failed: ",
                              "\$mesg-&gt;count=", $mesg-&gt;count);
        LdapDisconnect($ldap);
        return undef;
    }

    while( my $entry = $mesg-&gt;shift_entry) {
        foreach my $attr (keys %RT::LdapNameResultMap) {
            foreach my $value ($entry-&gt;get_value($attr)) {
                $UserInfo{$RT::LdapNameResultMap{$attr}} = $value;
            }
        }
    }
    LdapDisconnect($ldap);
    return %UserInfo;
}

# }}}

# {{{ sub LdapUserFindByMailaddr

=head2 LdapUserFindByMailaddr

Lookup user owning a given email address on UiO, returning the
username or undef if not known or the search failed.

The following configure options are used by this function in addition
to the ones used by LdapConnect().

 $RT::LdapMailBase
 $RT::LdapMailFilter
 $RT::LdapMailScope
 $RT::LdapMailSearchAttr
 $RT::LdapMailMap

=cut

# Example search
#   ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm

sub LdapUserFindByMailaddr {
    my $mailaddr = shift;
    my %UserInfo = ();
    $ldap = LdapConnect();
    my $filter = "(&amp;($RT::LdapMailSearchAttr=$mailaddr)$RT::LdapMailFilter)";
    my @attr = keys %RT::LdapMailResultMap;
    $RT::Logger-&gt;info( "LdapUserFindByMailaddr: Looking for ",
                           join(" ", @attr), " filter=", $filter );
    $mesg = $ldap-&gt;search(
                          base       =&gt; $RT::LdapMailBase,
                          scope      =&gt; $RT::LdapMailScope,
                          filter     =&gt; $filter,
                          attributes =&gt; [@attr],
                          );
    if ( ($mesg-&gt;code != LDAP_SUCCESS) and
         ($mesg-&gt;code != LDAP_PARTIAL_RESULTS) ) {
        $RT::Logger-&gt;critical("LdapUserFindByMailaddr: Search failed: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        LdapDisconnect($ldap);
        return undef;
    }

    if (1 != $mesg-&gt;count) {
        LdapDisconnect($ldap);
        return undef;
    }

    while( my $entry = $mesg-&gt;shift_entry) {
        foreach my $attr (keys %RT::LdapMailResultMap) {
            foreach my $value ($entry-&gt;get_value($attr)) {
                $UserInfo{$RT::LdapMailResultMap{$attr}} = $value;
            }
        }
    }
    LdapDisconnect($ldap);
    return %UserInfo;
}

# {{{ sub LdapConnect

=head2 LdapConnect

Connect to the LDAP databsae.

The following configure options are used by this function:

  $RT::LdapServer
  $RT::LdapUser
  $RT::LdapPass

=cut

sub LdapConnect {
    use Net::LDAP qw(LDAP_SUCCESS LDAP_PARTIAL_RESULTS);
    use Net::LDAP::Util qw (ldap_error_name);

    my $mesg;
    my $ldap = Net::LDAP-&gt;new($RT::LdapServer,
                              version =&gt; 3);

    unless ($ldap) {
        $RT::Logger-&gt;critical("IsLdapPassword: Cannot connect to",
                              "LDAP server ", $RT::LdapServer);
        return undef;
    }

    # I seem to have problems if I try and bind with a NULL username
    # by hand So this now checks to see if we are really going to bind
    # with a username.
    if (defined($RT::LdapUser) &amp;&amp; $RT::LdapUser ne '') {
        $mesg = $ldap-&gt;bind($RT::LdapUser,
                            password =&gt; $RT::LdapPass );
    } else {
        # This bind is redundant with LDAP protocol version 3
        $mesg = $ldap-&gt;bind;
    }
    if ($mesg-&gt;code != LDAP_SUCCESS) {
        $RT::Logger-&gt;critical("IsLdapPassword: Cannot bind to LDAP: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
        return undef;
    }
    return $ldap;
}

# }}}

# {{{ sub LdapDisconnect

=head2 LdapDisconnect

Disconnect from the LDAP database.

=cut

sub LdapDisconnect {
    my $ldap = shift;
    my $mesg = $ldap-&gt;unbind();
    if ($mesg-&gt;code != LDAP_SUCCESS) {
        $RT::Logger-&gt;critical("LdapDisconnect: unbind failed: ",
                              "retval=", $mesg-&gt;code, " ",
                              ldap_error_name($mesg-&gt;code));
    }
}

# }}}

# {{{ sub LdapFindUser

=head2 LdapFindUser

Locate info on a giver user given the username.

Configure options used by this function:

  $RT::LdpaAuthBase
  $RT::LdpaAuthFilter
  $RT::LdpaAuthUidAttr

=cut

sub LdapFindUser {
    my $ldap = shift;
    my $username = shift;

  $RT::Logger-&gt;info("LdapFindUser: "
        . "ldap: '" . $ldap
        . "', username: '" . $username . "'" );

    my $filter;
    if ($RT::LdapAuthFilter) {
        $filter = "(&amp;(" .$RT::LdapAuthUidAttr . "=$username)$RT::LdapAuthFilter)";
    } else {
        $filter = "(" .$RT::LdapAuthUidAttr . "=$username)";
    }

    $RT::Logger-&gt;debug("IsLdapPassword: First search filter '$filter'");
    my $mesg = $ldap-&gt;search(base   =&gt; $RT::LdapAuthBase,
                             filter =&gt; $filter,
                             attrs  =&gt; ['dn']);
    if (!(($mesg-&gt;code == LDAP_SUCCESS) or
          ($mesg-&gt;code == LDAP_PARTIAL_RESULTS)))
    {
        $RT::Logger-&gt;debug("IsLdapPassword: Could not search for $filter: ",
                           "retval=", $mesg-&gt;code, " ",
                           ldap_error_name($mesg-&gt;code));
        return undef;
    }
    return $mesg;
}

# }}}

# {{{ sub IsLdapPassword

=head2 IsLdapPassword

Takes a username and password as argument, and check if the password
is correct for the given user.  Return undef if password check failed,
-1 if the user is unknown, and 1 if the password check succeeded.

=cut

sub IsLdapPassword {
    my $username = shift;
    my $value    = shift;

    $RT::Logger-&gt;debug("IsLdapPassword: executing");
    my $ldap = LdapConnect();
    return undef unless $ldap;

    my $mesg = LdapFindUser($ldap, $username);
    unless ($mesg) {
        LdapDisconnect($ldap);
        return undef;
    }
    $RT::Logger-&gt;debug("IsLdapPassword: First search produced ",
                       $mesg-&gt;count, " results");
    if (! $mesg-&gt;count)
    {
        $RT::Logger-&gt;info("IsLdapPassword: AUTH FAILED $username");
        LdapDisconnect($ldap);
        return -1;
    }
    $ldap-&gt;start_tls( verify =&gt; 'require',
                      cafile =&gt; $RT::LdapCAFile ) if ($RT::LdapAuthStartTLS);

    my $userdn = $mesg-&gt;first_entry-&gt;dn;
    $RT::Logger-&gt;debug("IsLdapPassword: Trying to bind using DN=$userdn");
    my $mesg2 = $ldap-&gt;bind($userdn,
                            password =&gt; $value );
    if ($mesg2-&gt;code != LDAP_SUCCESS) {
        $RT::Logger-&gt;critical("IsLdapPassword: Unable to bind as $userdn: ",
                              "retval=", $mesg2-&gt;code, " ",
                              ldap_error_name($mesg2-&gt;code));
        LdapDisconnect($ldap);
        return undef;
    }
    else
    {
        $RT::Logger-&gt;info("IsLdapPassword: AUTH OK $username ($userdn) base:",
                          $RT::LdapAuthBase);
        LdapDisconnect($ldap);
        return 1;
    }
}

# }}}

1;

</nowiki>