NtlmAuthentication
NTLM Authentication - a.k.a. Single sign-on
RT 3.4.6 on Apache 2.2 with mod_perl on FC4
Here are some notes from my setup of RT 3.4.6, running on Apache 2.2 with mod_perl on FC4.
I followed the excellent guidance provided by Nathan Mehl at http://blank.org/memory/output/rt-ad-sso.html.
First, I installed Apache 2, mod_perl and RT 3.4.6 and got it all working, then...
Install mod_ntlm2
Downloaded mod_ntlm2-0.1.tgz from http://modntlm.sourceforge.net/
cd /usr/local/src gunzip <mod_ntlm2-0.1.tgz | tar -xvf - cd mod_ntlm2-0.1 PATH=$PATH:/usr/local/apache2/bin
There are some declarations in smbval/smblib.inc.c that the compiler doesn't like, so change it as follows:
diff -r mod_ntlm2-0.1/smbval/smblib.inc.c mod_ntlm2-0.1-fixed/smbval/smblib.inc.c 25,26c25,26 < static int SMBlib_errno; < static int SMBlib_SMB_Error; --- > int SMBlib_errno; > int SMBlib_SMB_Error; 35c35 < static SMB_State_Types SMBlib_State; --- > SMB_State_Types SMBlib_State;
If you don't do this, you may see errors like the following when you compile:
In file included from mod_ntlm.c:107: smbval/smblib.inc.c: At top level: smbval/smblib.inc.c:25: error: static declaration of 'SMBlib_errno' follows non-static declaration smbval/smblib-priv.h:668: error: previous declaration of 'SMBlib_errno' was here smbval/smblib.inc.c:26: error: static declaration of 'SMBlib_SMB_Error' follows non-static declaration smbval/smblib-priv.h:669: error: previous declaration of 'SMBlib_SMB_Error' was here smbval/smblib.inc.c:35: error: static declaration of 'SMBlib_State' follows non-static declaration smbval/smblib-priv.h:665: error: previous declaration of 'SMBlib_State' was here
Also, it seems APXS (or the GNU libtools) have changed since the Makefile was written, so change Makefile as follows:
diff -r mod_ntlm2-0.1/Makefile mod_ntlm2-0.1-fixed/Makefile 20c20 < $(APXS) -i -a -n 'ntlm' mod_ntlm.so --- > $(APXS) -i -a -n 'ntlm' mod_ntlm.la diff -r mod_ntlm2-0.1/mod_ntlm.c mod_ntlm2-0.1-fixed/mod_ntlm.c 590c590,596 < apr_pool_sub_make(&sp,p,NULL); --- > /* > * apr_pool_sub_make(&sp,p,NULL); > * > * This function call is not longer available with apache 2.2 > * Try replacing it with apr_pool_create_ex() > */ > apr_pool_create_ex(&sp,p,NULL,NULL);
If you don't, you may see errors like the following when you try to make the package:
cp mod_ntlm.so /usr/local/apache2/modules/mod_ntlm.so cp: cannot stat `mod_ntlm.so': No such file or directory apxs:Error: Command failed with rc=65536
Finally, I had to change mod_ntlm.c to work with Apache 2.2:
diff mod_ntlm2-0.1/mod_ntlm.c mod_ntlm2-0.1-fixed/mod_ntlm.c 590c590,596 < apr_pool_sub_make(&sp,p,NULL); --- > /* > * apr_pool_sub_make(&sp,p,NULL); > * > * This function call is not longer available with apache 2.2 > * Try replacing it with apr_pool_create_ex() > */ > apr_pool_create_ex(&sp,p,NULL,NULL);
Without this change, you may see errors like the following when you stop Apache (after installing and configuring, which follows):
httpd: Syntax error on line 55 of /usr/local/apache2/conf/httpd.conf: Cannot load /usr/local/apache2/modules/mod_ntlm.so into server: /usr/local/apache2/modules/mod_ntlm.so: undefined symbol: apr_pool_sub_make
Finally, you should be ready to make and install the package...
make make install
Configure RT
Add to /opt/rt3/etc/RT_SiteConfig.pm:
Set($WebExternalAuth , '1'); Set($WebFallbackToInternalAuth , '1'); Set($WebExternalGecos , undef) Set($WebExternalAuto , '1');
Change VirtualHost definition in /usr/local/apache2/conf/extra/httpd-vhosts.conf:
<VirtualHost *:80>
ServerName rt.mydomain.com
AddDefaultCharset UTF-8
DocumentRoot /opt/rt3/share/html
<Directory "/opt/rt3/share/html">
AuthName "Request Tracker"
AuthType NTLM
NTLMAuth on
NTLMAuthoritative on
NTLMDomain lhl.co.nz
NTLMServer dc1.mydomain.com
NTLMBackup dc2.mydomain.com
require valid-user
</Directory>
# RedirectMatch permanent (.*)/$ http://rt.mydomain.com/$1/index.html
# this line applies to Apache2+mod_perl2 only
# Below line might be incorrect, I had to use:
# PerlModule Apache2::compat
# mod_perl 2.0.1 from FC4 Linux
#PerlModule Apache2 Apache::compat
PerlModule Apache2::compat
PerlModule Apache::DBI
PerlRequire /opt/rt3/bin/webmux.pl
<Location />
SetHandler perl-script
PerlHandler RT::Mason
</Location>
ErrorLog logs/rt.lhl.co.nz-error_log
CustomLog logs/rt.lhl.co.nz-access_log common
</VirtualHost>
Create /opt/rt3/lib/User_Local.pm as:
# BEGIN LICENSE BLOCK
#
# Copyright (c) 2004 Petter Reinholdtsen <pere@hungry.com>
#
# (Except where explictly superceded by other copyright notices)
#
# This work is made available to you under the terms of Version 2 of
# the GNU General Public License. A copy of that license should have
# been provided with this software, but in any event can be snarfed
# from www.gnu.org.
#
# This work is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# Unless otherwise specified, all modifications, corrections or
# extensions to this work which alter its source code become the
# property of Best Practical Solutions, LLC when submitted for
# inclusion in the work.
#
#
# END LICENSE BLOCK
# LDAP integration in RT 3. These overrides provide LDAP
# authentication and user info syncronizing.
#
# Written by Petter Reinholdtsen <pere@hungry.com> based on Code from
# Marcelo Bartsch <bartschm_cl@hotmail.com>, Stewart James
# <stewart.james@vu.edu.au> and Carl Makin <carl@xena.IPAustralia.gov.au>.
#
# Copy this file into rt3/local/lib/RT/User_Local.pm to active it.
# Modification Originally by Marcelo Bartsch <bartschm_cl@hotmail.com>
# Update by Stewart James <stewart.james@vu.edu.au for rt3.
# Update with TLS support and more flexible LDAP code by Petter Reinholdtsen.
# Drop this file in /opt/rt3/lib/RT/User_Local.pm
# Drop something like below in yout RT_SiteConfig.pm
#
# Set($LDAPExternalAuth, 1); # Enable LDAP auth
# Set($LdapServer, "ldap.domain.com");
# Set($LdapCAFile, "/site/w3-sertifikater/w3_cacert.pem");
# Set($LdapAuthStartTLS, 1); # Need to use TLS or ldaps to check passwords
# Set($LdapUser, ""); # Can search without username and password
# Set($LdapAuthPass, "");
# Set($LdapAuthBase, "ou=users,dc=domain,dc=com");
# Set($LdapAuthUidAttr, "uid");
# Set($LdapAuthFilter, "(objectclass=posixAccount)");
no warnings qw(redefine);
# {{{ sub LookupExternalUserInfo
=item LookupExternalUserInfo
LookupExternalUserInfo is a site-definable method for synchronizing
incoming users with an external data source.
This routine takes a tuple of EmailAddress and FriendlyName
EmailAddress is the user's email address, ususally taken from
an email message's From: header.
RealName is a freeform string, ususally taken from the "comment"
portion of an email message's From: header.
It returns (FoundInExternalDatabase, ParamHash);
FoundInExternalDatabase must be set to 1 before return if the user
was found in the external database.
ParamHash is a Perl parameter hash which can contain at least the
following fields. These fields are used to populate RT's users
database when the user is created
EmailAddress is the email address that RT should use for this user.
Name is the 'Name' attribute RT should use for this user.
'Name' is used for things like access control and user lookups.
RealName is what RT should display as the user's name when displaying
'friendly' names
=cut
sub LookupExternalUserInfo {
my %UserInfo = ();
$UserInfo{'EmailAddress'} = shift;
$UserInfo{'RealName'} = shift;
$UserInfo{'RealName'} =~ s/\"//g;
my $FoundInExternalDatabase = 0;
# Name is the RT username you want to use for this user.
my %LdapUserInfo = LdapUserFindByMailaddr($UserInfo{'EmailAddress'});
if ($LdapUserInfo{'Name'}) {
$FoundInExternalDatabase = 1;
$RT::Logger->info("LookupExternalUserInfo: Mapping '".
$UserInfo{'EmailAddress'} .
"' to '" .
$LdapUserInfo{'Name'} . "'");
foreach my $key (keys %LdapUserInfo) {
$UserInfo{$key} = $LdapUserInfo{$key};
}
} else {
$RT::Logger->info("LookupExternalUserInfo: Fail to find username for '".
$UserInfo{'EmailAddress'}."'");
}
return ($FoundInExternalDatabase, %UserInfo);
}
# }}}
# {{{ sub CanonicalizeUserInfo
sub CanonicalizeUserInfo {
my $self = shift;
my $argsref = shift;
my $success = 1;
my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
LookupExternalUserInfo( $argsref->{'EmailAddress'},
$argsref->{'RealName'} );
if ($UserFoundInExternalDatabase) {
for my $key (keys %ExternalUserInfo) {
$argsref->{$key} = $ExternalUserInfo{$key};
}
}
return ($success);
}
# }}}
# {{{ sub SetPasswordExternal
=head2 SetPasswordExternal
Takes a string, and try to set this string as the users password in an
external system, if the user is listed in the external system.
Returns 1 if the password was set successfully, undef if it failed,
and -1 if the user is unknown to the external system.
This hook is called from SetPassword.
=cut
sub SetPasswordExternal {
my $self = shift;
my $password = shift;
# Not allowed to set password for users in LDAP
if ($RT::LDAPExternalAuth) {
my $ldap = LdapConnect();
my $mesg;
if ( $mesg = LdapFindUser( $ldap, $self->Name )
&& defined $mesg && $mesg->count ) {
LdapDisconnect($ldap);
return ( undef,
$self->loc("LDAP users must change password in LDAP") );
}
LdapDisconnect($ldap);
}
return (-1, "No such user in LDAP");
}
# }}}
# {{{ sub SetPassword
=head2 SetPassword
Takes a string. Checks the string's length and sets this user's password
to that string.
Override for function in User_Overlay.pm, with modification for LDAP
authentication.
=cut
sub SetPassword {
my $self = shift;
my $password = shift;
unless ( $self->CurrentUserCanModify('Password') ) {
return ( 0, $self->loc('Permission Denied') );
}
my ($code, $msg) = $self->SetPasswordExternal($password);
return ($code, $msg) unless (-1 == $code);
if ( !$password ) {
return ( 0, $self->loc("No password set") );
}
elsif ( length($password) < $RT::MinimumPasswordLength ) {
return ( 0, $self->loc("Password too short") );
}
else {
$password = $self->_GeneratePassword($password);
return ( $self->SUPER::SetPassword( $password));
}
}
# }}}
# {{{ sub IsPasswordExternal
=head2 IsPasswordExternal
Returns true if the passed in value is this user's password. Return
undef if the password don't match. Return -1 if the user is unknown
in the external system.
This hook is called from IsPassword.
=cut
sub IsPasswordExternal {
my $self = shift;
my $value = shift;
# Let LDAP be authorative for users in LDAP, and only fall
# through for users without LDAP entry.
if ($RT::LDAPExternalAuth) {
return IsLdapPassword($self->Name, $value);
}
}
# }}}
# {{{ sub IsPassword
=head2 IsPassword
Check the users password using LDAP. Override for function in
User_Overlay.pm, with modification for LDAP authentication.
=cut
sub IsPassword {
my $self = shift;
my $value = shift;
#TODO there isn't any apparent way to legitimately ACL this
# RT does not allow null passwords
if ( ( !defined($value) ) or ( $value eq '' ) ) {
return (undef);
}
if ( $self->PrincipalObj->Disabled ) {
$RT::Logger->info(
"Disabled user " . $self->Name . " tried to log in" );
return (undef);
}
if ( ($self->__Value('Password') eq '') ||
($self->__Value('Password') eq undef) ) {
return(undef);
}
my $code = $self->IsPasswordExternal($value);
return ($code) unless (-1 == $code);
# is it an MD5 password
if ($self->__Value('Password') eq $self->_GeneratePassword($value)) {
return(1);
}
# if it's recognized by crypt, we say ok too.
if ($self->__Value('Password') eq crypt($value,
$self->__Value('Password'))) {
return (1);
}
# no password check has succeeded. get out
return (undef);
}
# }}}
# {{{ sub LdapUserFindByMailaddr
=head2 LdapUserFindByMailaddr
Lookup user owning a given email address on UiO, returning the
username or undef if not known or the search failed.
The following configure options are used by this function in addition
to the ones used by LdapConnect().
$RT::LdapMailBase
$RT::LdapMailFilter
$RT::LdapMailScope
$RT::LdapMailSearchAttr
$RT::LdapMailMap
=cut
# Example search
# ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm
sub LdapUserFindByMailaddr {
my $mailaddr = shift;
my %UserInfo = ();
$ldap = LdapConnect();
my $filter = "(&($RT::LdapMailSearchAttr=$mailaddr)$RT::LdapMailFilter)";
my @attr = keys %RT::LdapMailResultMap;
$RT::Logger->info( "LdapUserFindByMailaddr: Looking for ",
join(" ", @attr), " filter=", $filter );
$mesg = $ldap->search(
base => $RT::LdapMailBase,
scope => $RT::LdapMailScope,
filter => $filter,
attributes => [@attr],
);
if ( ($mesg->code != LDAP_SUCCESS) and
($mesg->code != LDAP_PARTIAL_RESULTS) ) {
$RT::Logger->critical("LdapUserFindByMailaddr: Search failed: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
LdapDisconnect($ldap);
return undef;
}
if (1 != $mesg->count) {
LdapDisconnect($ldap);
return undef;
}
while( my $entry = $mesg->shift_entry) {
foreach my $attr (keys %RT::LdapMailResultMap) {
foreach my $value ($entry->get_value($attr)) {
$UserInfo{$RT::LdapMailResultMap{$attr}} = $value;
}
}
}
LdapDisconnect($ldap);
return %UserInfo;
}
# {{{ sub LdapConnect
=head2 LdapConnect
Connect to the LDAP databsae.
The following configure options are used by this function:
$RT::LdapServer
$RT::LdapUser
$RT::LdapPass
=cut
sub LdapConnect {
use Net::LDAP qw(LDAP_SUCCESS LDAP_PARTIAL_RESULTS);
use Net::LDAP::Util qw (ldap_error_name);
my $mesg;
my $ldap = Net::LDAP->new($RT::LdapServer,
version => 3);
unless ($ldap) {
$RT::Logger->critical("IsLdapPassword: Cannot connect to",
"LDAP server ", $RT::LdapServer);
return undef;
}
# I seem to have problems if I try and bind with a NULL username
# by hand So this now checks to see if we are really going to bind
# with a username.
if (defined($RT::LdapUser) && $RT::LdapUser ne '') {
$mesg = $ldap->bind($RT::LdapUser,
password => $RT::LdapPass );
} else {
# This bind is redundant with LDAP protocol version 3
$mesg = $ldap->bind;
}
if ($mesg->code != LDAP_SUCCESS) {
$RT::Logger->critical("IsLdapPassword: Cannot bind to LDAP: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
return undef;
}
return $ldap;
}
# }}}
# {{{ sub LdapDisconnect
=head2 LdapDisconnect
Disconnect from the LDAP database.
=cut
sub LdapDisconnect {
my $ldap = shift;
my $mesg = $ldap->unbind();
if ($mesg->code != LDAP_SUCCESS) {
$RT::Logger->critical("LdapDisconnect: unbind failed: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
}
}
# }}}
# {{{ sub LdapFindUser
=head2 LdapFindUser
Locate info on a giver user given the username.
Configure options used by this function:
$RT::LdpaAuthBase
$RT::LdpaAuthFilter
$RT::LdpaAuthUidAttr
=cut
sub LdapFindUser {
my $ldap = shift;
my $username = shift;
my $filter;
if ($RT::LdapAuthFilter) {
$filter = "(&(" .$RT::LdapAuthUidAttr . "=$username)$RT::LdapAuthFilter)";
} else {
$filter = "(" .$RT::LdapAuthUidAttr . "=$username)";
}
$RT::Logger->debug("IsLdapPassword: First search filter '$filter'");
my $mesg = $ldap->search(base => $RT::LdapAuthBase,
filter => $filter,
attrs => ['dn']);
if (!(($mesg->code == LDAP_SUCCESS) or
($mesg->code == LDAP_PARTIAL_RESULTS)))
{
$RT::Logger->debug("IsLdapPassword: Could not search for $filter: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
return undef;
}
return $mesg;
}
# }}}
# {{{ sub IsLdapPassword
=head2 IsLdapPassword
Takes a username and password as argument, and check if the password
is correct for the given user. Return undef if password check failed,
-1 if the user is unknown, and 1 if the password check succeeded.
=cut
sub IsLdapPassword {
my $username = shift;
my $value = shift;
$RT::Logger->debug("IsLdapPassword: executing");
my $ldap = LdapConnect();
return undef unless $ldap;
my $mesg = LdapFindUser($ldap, $username);
unless ($mesg) {
LdapDisconnect($ldap);
return undef;
}
$RT::Logger->debug("IsLdapPassword: First search produced ",
$mesg->count, " results");
if (! $mesg->count)
{
$RT::Logger->info("IsLdapPassword: AUTH FAILED $username");
LdapDisconnect($ldap);
return -1;
}
$ldap->start_tls( verify => 'require',
cafile => $RT::LdapCAFile ) if ($RT::LdapAuthStartTLS);
my $userdn = $mesg->first_entry->dn;
$RT::Logger->debug("IsLdapPassword: Trying to bind using DN=$userdn");
my $mesg2 = $ldap->bind($userdn,
password => $value );
if ($mesg2->code != LDAP_SUCCESS) {
$RT::Logger->critical("IsLdapPassword: Unable to bind as $userdn: ",
"retval=", $mesg2->code, " ",
ldap_error_name($mesg2->code));
LdapDisconnect($ldap);
return undef;
}
else
{
$RT::Logger->info("IsLdapPassword: AUTH OK $username ($userdn) base:",
$RT::LdapAuthBase);
LdapDisconnect($ldap);
return 1;
}
}
# }}}
1;
Add configuration to /opt/rt3/etc/RT_SiteConfig.pm:
Set($LDAPExternalAuth, '1'); # Enable LDAP auth
Set($LdapServer, "dc1.mydomain.com");
Set($LdapCAFile, undef);
Set($LdapUser, 'cn=LDAP User,CN=Users,dc=lhl,dc=co,dc=nz');
Set($LdapPass, 'Password');
Set($LdapAuthStartTLS, '1'); # Need to use TLS or ldaps to check passwords
Set($LdapAuthBase, "cn=LHL Users,dc=lhl,dc=co,dc=nz");
Set($LdapAuthUidAttr, 'sAMAccountName');
Set($LdapAuthFilter, '(objectClass=user)');
Set($LdapMailBase, 'cn=LHL Users,dc=lhl,dc=co,dc=nz');
Set($LdapMailFilter, '(objectClass=user)');
Set($LdapMailScope, 'sub');
Set($LdapMailSearchAttr, 'mail');
%RT::LdapMailResultMap = (
'sAMAccountName' => 'Name',
'mail' => 'EmailAddress',
'cn' => 'RealName',
);
Create /opt/rt3/lib/RT/Interface/Web_Local.pm as:
# BEGIN LICENSE BLOCK
#
# Copyright (c) 2005 Nathan Mehl <rt-ad-sso@memory.blank.org>
# (Except where explictly superceded by other copyright notices)
# portions Copyright (c) 2004 Petter Reinholdtsen <pere@hungry.com>
# portions Copyright (c) 2004 Jesse Vincent <jesse@fsck.com>
#
# This work is made available to you under the terms of Version 2 of
# the GNU General Public License. A copy of that license should have
# been provided with this software, but in any event can be snarfed
# from www.gnu.org.
#
# This work is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# Unless otherwise specified, all modifications, corrections or
# extensions to this work which alter its source code become the
# property of Best Practical Solutions, LLC when submitted for
# inclusion in the work.
#
#
# END LICENSE BLOCK
package RT::Interface::Web;
no warnings qw(redefine);
# {{{ WebExternalAutoInfo
=head2 WebExternalAutoInfo($user);
Returns a hash of user attributes, used when WebExternalAuto is set.
=cut
sub WebExternalAutoInfo {
my $user = shift;
my %user_info;
$user_info{'Privileged'} = 0;
$RT::Logger->debug( "WebExternalAutoInfo: Looking for ", $user );
my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
LookupExternalUsername( $user );
# populate user fields from the ldap directory
if ($UserFoundInExternalDatabase) {
$user_info{'RealName'} = $ExternalUserInfo{'RealName'} if defined $ExternalUserInfo{'RealName'};
$user_info{'Name'} = $ExternalUserInfo{'Name'} if defined $ExternalUserInfo{'Name'};
$user_info{'EmailAddress'} = $ExternalUserInfo{'EmailAddress'} if defined $ExternalUserInfo{'EmailAddress'};
} elsif ($^O !~ /^(?:riscos|MacOS|MSWin32|dos|os2)$/) {
# Populate fields with information from Unix /etc/passwd
my ($comments, $realname) = (getpwnam($user))[5, 6];
$user_info{'Comments'} = $comments if defined $comments;
$user_info{'RealName'} = $realname if defined $realname;
}
elsif ($^O eq 'MSWin32' and eval 'use Net::AdminMisc; 1') {
# Populate fields with information from NT domain controller
}
# and return the wad of stuff
return {%user_info};
}
# }}}
sub LookupExternalUsername {
my %UserInfo = ();
$UserInfo{'Name'} = shift;
$UserInfo{'Name'} =~ s/\"//g;
my $FoundInExternalDatabase = 0;
$RT::Logger->debug( "LookupExternalUsername: Looking for ", $UserInfo{'Name'} );
# Name is the RT username you want to use for this user.
my %LdapUserInfo = LdapUserFindByUsername($UserInfo{'Name'});
if ($LdapUserInfo{'Name'}) {
$FoundInExternalDatabase = 1;
$RT::Logger->debug("LookupExternalUsername: Mapping '".
$UserInfo{'Name'} .
"' to '" .
$LdapUserInfo{'EmailAddress'} . "'");
foreach my $key (keys %LdapUserInfo) {
$UserInfo{$key} = $LdapUserInfo{$key};
}
} else {
$RT::Logger->debug("LookupExternalUsername: Fail to find username for '".
$UserInfo{'Name'}."'");
}
return ($FoundInExternalDatabase, %UserInfo);
}
sub LdapUserFindByUsername {
my $username = shift;
my %UserInfo = ();
my $ldap = RT::User::LdapConnect();
my $filter = "(&($RT::LdapAuthUidAttr=$username)$RT::LdapMailFilter)";
my @attr = keys %RT::LdapMailResultMap;
$RT::Logger->debug( "LdapUserFindByUsername: Looking for ",
join(" ", @attr), " filter=", $filter );
my $mesg = $ldap->search(
base => $RT::LdapMailBase,
scope => $RT::LdapMailScope,
filter => $filter,
attributes => [@attr],
);
if ( ($mesg->code != LDAP_SUCCESS) and
($mesg->code != LDAP_PARTIAL_RESULTS) ) {
$RT::Logger->critical("LdapUserFindByUsername: Search failed: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
RT::User::LdapDisconnect($ldap);
return undef;
}
if (1 != $mesg->count) {
$RT::Logger->critical("LdapUserFindByUsername: Search returned 0 results: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
RT::User::LdapDisconnect($ldap);
return undef;
}
while( my $entry = $mesg->shift_entry) {
foreach my $attr (keys %RT::LdapMailResultMap) {
foreach my $value ($entry->get_value($attr)) {
$UserInfo{$RT::LdapMailResultMap{$attr}} = $value;
}
}
}
RT::User::LdapDisconnect($ldap);
return %UserInfo;
}
1;
After running this for a while, I found users were entering logins instead of email addresses, and lookup in AD was failing, so I changed User_Local.pm as follows, to try lookup by username if lookup by email address fails:
[root@hotel RT]# diff -C 5 -b User_Local.pm.old User_Local.pm
*** User_Local.pm.old 2007-03-23 13:05:02.000000000 +1200
--- User_Local.pm 2007-03-23 13:13:23.000000000 +1200
***************
*** 20,41 ****
--- 20,45 ----
# inclusion in the work.
#
#
# END LICENSE BLOCK
+
# LDAP integration in RT 3. These overrides provide LDAP
# authentication and user info syncronizing.
#
# Written by Petter Reinholdtsen <pere@hungry.com> based on Code from
# Marcelo Bartsch <bartschm_cl@hotmail.com>, Stewart James
# <stewart.james@vu.edu.au> and Carl Makin <carl@xena.IPAustralia.gov.au>.
#
# Copy this file into rt3/local/lib/RT/User_Local.pm to active it.
+
# Modification Originally by Marcelo Bartsch <bartschm_cl@hotmail.com>
# Update by Stewart James <stewart.james@vu.edu.au for rt3.
# Update with TLS support and more flexible LDAP code by Petter Reinholdtsen.
+ # Update to handle logins presented as email addresses.
+ #
# Drop this file in /opt/rt3/lib/RT/User_Local.pm
# Drop something like below in yout RT_SiteConfig.pm
#
# Set($LDAPExternalAuth, 1); # Enable LDAP auth
# Set($LdapServer, "ldap.domain.com");
***************
*** 45,54 ****
--- 49,59 ----
# Set($LdapAuthPass, "");
# Set($LdapAuthBase, "ou=users,dc=domain,dc=com");
# Set($LdapAuthUidAttr, "uid");
# Set($LdapAuthFilter, "(objectclass=posixAccount)");
+
no warnings qw(redefine);
# {{{ sub LookupExternalUserInfo
=item LookupExternalUserInfo
***************
*** 85,96 ****
--- 90,110 ----
$UserInfo{'RealName'} = shift;
$UserInfo{'RealName'} =~ s/\"//g;
my $FoundInExternalDatabase = 0;
+ $RT::Logger->info("LookupExternalUserInfo: looking up EmailAddress: '"
+ . $UserInfo{'EmailAddress'} . "', RealName: '"
+ . $UserInfo{'RealName'} . "'" );
+
# Name is the RT username you want to use for this user.
my %LdapUserInfo = LdapUserFindByMailaddr($UserInfo{'EmailAddress'});
+ # The EmailAddress may actually be a username, so if lookup by
+ # email address fails, try lookup by username
+ unless($LdapUserInfo{'Name'}) {
+ %LdapUserInfo = LdapUserFindByName($UserInfo{'EmailAddress'});
+ }
if ($LdapUserInfo{'Name'}) {
$FoundInExternalDatabase = 1;
$RT::Logger->info("LookupExternalUserInfo: Mapping '".
$UserInfo{'EmailAddress'} .
"' to '" .
***************
*** 113,122 ****
--- 127,140 ----
sub CanonicalizeUserInfo {
my $self = shift;
my $argsref = shift;
my $success = 1;
+ $RT::Logger->info("CanonicalizeUserInfo: "
+ . "EmailAddress: '" . $argsref->{'EmailAddress'}
+ . "', RealName: '" . $argsref->{'RealName'} . "'" );
+
my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
LookupExternalUserInfo( $argsref->{'EmailAddress'},
$argsref->{'RealName'} );
if ($UserFoundInExternalDatabase) {
for my $key (keys %ExternalUserInfo) {
***************
*** 275,284 ****
--- 293,379 ----
return (undef);
}
# }}}
+ # {{{ sub LdapUserFindByName
+
+ =head2 LdapUserFindByName
+
+ Lookup user owning a given name on OU, returning the
+ username or undef if not known or the search failed.
+
+ The following configure options are used by this function in addition
+ to the ones used by LdapConnect().
+
+ $RT::LdapNameBase
+ $RT::LdapNameFilter
+ $RT::LdapNameScope
+ $RT::LdapNameSearchAttr
+ $RT::LdapNameResultMap
+
+ For example:
+
+ Set($LdapNameBase, 'dc=mydomain,dc=co,dc=nz');
+ Set($LdapNameFilter, '(objectClass=user)');
+ Set($LdapNameScope, 'sub');
+ Set($LdapNameSearchAttr, 'sAMAccountName');
+ %RT::LdapNameResultMap = (
+ 'sAMAccountName' => 'Name',
+ 'mail' => 'EmailAddress',
+ 'cn' => 'RealName',
+ );
+
+
+ =cut
+
+ # Example search
+ # ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm
+
+ sub LdapUserFindByName {
+ my $name = shift;
+ my %UserInfo = ();
+ $ldap = LdapConnect();
+ my $filter = "(&($RT::LdapNameSearchAttr=$name)$RT::LdapNameFilter)";
+ my @attr = keys %RT::LdapNameResultMap;
+ $RT::Logger->info( "LdapUserFindByName: Looking for ",
+ join(" ", @attr), " filter=", $filter );
+ $mesg = $ldap->search(
+ base => $RT::LdapNameBase,
+ scope => $RT::LdapNameScope,
+ filter => $filter,
+ attributes => [@attr],
+ );
+ if ( ($mesg->code != LDAP_SUCCESS) and
+ ($mesg->code != LDAP_PARTIAL_RESULTS) ) {
+ $RT::Logger->critical("LdapUserFindByName: Search failed: ",
+ "retval=", $mesg->code, " ",
+ ldap_error_name($mesg->code));
+ LdapDisconnect($ldap);
+ return undef;
+ }
+
+ if (1 != $mesg->count) {
+ $RT::Logger->critical("LdapUserFindByName: Search failed: ",
+ "\$mesg->count=", $mesg->count);
+ LdapDisconnect($ldap);
+ return undef;
+ }
+
+ while( my $entry = $mesg->shift_entry) {
+ foreach my $attr (keys %RT::LdapNameResultMap) {
+ foreach my $value ($entry->get_value($attr)) {
+ $UserInfo{$RT::LdapNameResultMap{$attr}} = $value;
+ }
+ }
+ }
+ LdapDisconnect($ldap);
+ return %UserInfo;
+ }
+
+ # }}}
+
# {{{ sub LdapUserFindByMailaddr
=head2 LdapUserFindByMailaddr
Lookup user owning a given email address on UiO, returning the
***************
*** 422,431 ****
--- 517,530 ----
sub LdapFindUser {
my $ldap = shift;
my $username = shift;
+ $RT::Logger->info("LdapFindUser: "
+ . "ldap: '" . $ldap
+ . "', username: '" . $username . "'" );
+
my $filter;
if ($RT::LdapAuthFilter) {
$filter = "(&(" .$RT::LdapAuthUidAttr . "=$username)$RT::LdapAuthFilter)";
} else {
$filter = "(" .$RT::LdapAuthUidAttr . "=$username)";
Or, if you just want to cut and paste the final form:
# BEGIN LICENSE BLOCK
#
# Copyright (c) 2004 Petter Reinholdtsen <pere@hungry.com>
#
# (Except where explictly superceded by other copyright notices)
#
# This work is made available to you under the terms of Version 2 of
# the GNU General Public License. A copy of that license should have
# been provided with this software, but in any event can be snarfed
# from www.gnu.org.
#
# This work is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# Unless otherwise specified, all modifications, corrections or
# extensions to this work which alter its source code become the
# property of Best Practical Solutions, LLC when submitted for
# inclusion in the work.
#
#
# END LICENSE BLOCK
# LDAP integration in RT 3. These overrides provide LDAP
# authentication and user info syncronizing.
#
# Written by Petter Reinholdtsen <pere@hungry.com> based on Code from
# Marcelo Bartsch <bartschm_cl@hotmail.com>, Stewart James
# <stewart.james@vu.edu.au> and Carl Makin <carl@xena.IPAustralia.gov.au>.
#
# Copy this file into rt3/local/lib/RT/User_Local.pm to active it.
# Modification Originally by Marcelo Bartsch <bartschm_cl@hotmail.com>
# Update by Stewart James <stewart.james@vu.edu.au for rt3.
# Update with TLS support and more flexible LDAP code by Petter Reinholdtsen.
# Update to handle logins presented as email addresses.
#
# Drop this file in /opt/rt3/lib/RT/User_Local.pm
# Drop something like below in yout RT_SiteConfig.pm
#
# Set($LDAPExternalAuth, 1); # Enable LDAP auth
# Set($LdapServer, "ldap.domain.com");
# Set($LdapCAFile, "/site/w3-sertifikater/w3_cacert.pem");
# Set($LdapAuthStartTLS, 1); # Need to use TLS or ldaps to check passwords
# Set($LdapUser, ""); # Can search without username and password
# Set($LdapAuthPass, "");
# Set($LdapAuthBase, "ou=users,dc=domain,dc=com");
# Set($LdapAuthUidAttr, "uid");
# Set($LdapAuthFilter, "(objectclass=posixAccount)");
no warnings qw(redefine);
# {{{ sub LookupExternalUserInfo
=item LookupExternalUserInfo
LookupExternalUserInfo is a site-definable method for synchronizing
incoming users with an external data source.
This routine takes a tuple of EmailAddress and FriendlyName
EmailAddress is the user's email address, ususally taken from
an email message's From: header.
RealName is a freeform string, ususally taken from the "comment"
portion of an email message's From: header.
It returns (FoundInExternalDatabase, ParamHash);
FoundInExternalDatabase must be set to 1 before return if the user
was found in the external database.
ParamHash is a Perl parameter hash which can contain at least the
following fields. These fields are used to populate RT's users
database when the user is created
EmailAddress is the email address that RT should use for this user.
Name is the 'Name' attribute RT should use for this user.
'Name' is used for things like access control and user lookups.
RealName is what RT should display as the user's name when displaying
'friendly' names
=cut
sub LookupExternalUserInfo {
my %UserInfo = ();
$UserInfo{'EmailAddress'} = shift;
$UserInfo{'RealName'} = shift;
$UserInfo{'RealName'} =~ s/\"//g;
my $FoundInExternalDatabase = 0;
$RT::Logger->info("LookupExternalUserInfo: looking up EmailAddress: '"
. $UserInfo{'EmailAddress'} . "', RealName: '"
. $UserInfo{'RealName'} . "'" );
# Name is the RT username you want to use for this user.
my %LdapUserInfo = LdapUserFindByMailaddr($UserInfo{'EmailAddress'});
# The EmailAddress may actually be a username, so if lookup by
# email address fails, try lookup by username
unless($LdapUserInfo{'Name'}) {
%LdapUserInfo = LdapUserFindByName($UserInfo{'EmailAddress'});
}
if ($LdapUserInfo{'Name'}) {
$FoundInExternalDatabase = 1;
$RT::Logger->info("LookupExternalUserInfo: Mapping '".
$UserInfo{'EmailAddress'} .
"' to '" .
$LdapUserInfo{'Name'} . "'");
foreach my $key (keys %LdapUserInfo) {
$UserInfo{$key} = $LdapUserInfo{$key};
}
} else {
$RT::Logger->info("LookupExternalUserInfo: Fail to find username for '".
$UserInfo{'EmailAddress'}."'");
}
return ($FoundInExternalDatabase, %UserInfo);
}
# }}}
# {{{ sub CanonicalizeUserInfo
sub CanonicalizeUserInfo {
my $self = shift;
my $argsref = shift;
my $success = 1;
$RT::Logger->info("CanonicalizeUserInfo: "
. "EmailAddress: '" . $argsref->{'EmailAddress'}
. "', RealName: '" . $argsref->{'RealName'} . "'" );
my ($UserFoundInExternalDatabase, %ExternalUserInfo) =
LookupExternalUserInfo( $argsref->{'EmailAddress'},
$argsref->{'RealName'} );
if ($UserFoundInExternalDatabase) {
for my $key (keys %ExternalUserInfo) {
$argsref->{$key} = $ExternalUserInfo{$key};
}
}
return ($success);
}
# }}}
# {{{ sub SetPasswordExternal
=head2 SetPasswordExternal
Takes a string, and try to set this string as the users password in an
external system, if the user is listed in the external system.
Returns 1 if the password was set successfully, undef if it failed,
and -1 if the user is unknown to the external system.
This hook is called from SetPassword.
=cut
sub SetPasswordExternal {
my $self = shift;
my $password = shift;
# Not allowed to set password for users in LDAP
if ($RT::LDAPExternalAuth) {
my $ldap = LdapConnect();
my $mesg;
if ( $mesg = LdapFindUser( $ldap, $self->Name )
&& defined $mesg && $mesg->count ) {
LdapDisconnect($ldap);
return ( undef,
$self->loc("LDAP users must change password in LDAP") );
}
LdapDisconnect($ldap);
}
return (-1, "No such user in LDAP");
}
# }}}
# {{{ sub SetPassword
=head2 SetPassword
Takes a string. Checks the string's length and sets this user's password
to that string.
Override for function in User_Overlay.pm, with modification for LDAP
authentication.
=cut
sub SetPassword {
my $self = shift;
my $password = shift;
unless ( $self->CurrentUserCanModify('Password') ) {
return ( 0, $self->loc('Permission Denied') );
}
my ($code, $msg) = $self->SetPasswordExternal($password);
return ($code, $msg) unless (-1 == $code);
if ( !$password ) {
return ( 0, $self->loc("No password set") );
}
elsif ( length($password) < $RT::MinimumPasswordLength ) {
return ( 0, $self->loc("Password too short") );
}
else {
$password = $self->_GeneratePassword($password);
return ( $self->SUPER::SetPassword( $password));
}
}
# }}}
# {{{ sub IsPasswordExternal
=head2 IsPasswordExternal
Returns true if the passed in value is this user's password. Return
undef if the password don't match. Return -1 if the user is unknown
in the external system.
This hook is called from IsPassword.
=cut
sub IsPasswordExternal {
my $self = shift;
my $value = shift;
# Let LDAP be authorative for users in LDAP, and only fall
# through for users without LDAP entry.
if ($RT::LDAPExternalAuth) {
return IsLdapPassword($self->Name, $value);
}
}
# }}}
# {{{ sub IsPassword
=head2 IsPassword
Check the users password using LDAP. Override for function in
User_Overlay.pm, with modification for LDAP authentication.
=cut
sub IsPassword {
my $self = shift;
my $value = shift;
#TODO there isn't any apparent way to legitimately ACL this
# RT does not allow null passwords
if ( ( !defined($value) ) or ( $value eq '' ) ) {
return (undef);
}
if ( $self->PrincipalObj->Disabled ) {
$RT::Logger->info(
"Disabled user " . $self->Name . " tried to log in" );
return (undef);
}
if ( ($self->__Value('Password') eq '') ||
($self->__Value('Password') eq undef) ) {
return(undef);
}
my $code = $self->IsPasswordExternal($value);
return ($code) unless (-1 == $code);
# is it an MD5 password
if ($self->__Value('Password') eq $self->_GeneratePassword($value)) {
return(1);
}
# if it's recognized by crypt, we say ok too.
if ($self->__Value('Password') eq crypt($value,
$self->__Value('Password'))) {
return (1);
}
# no password check has succeeded. get out
return (undef);
}
# }}}
# {{{ sub LdapUserFindByName
=head2 LdapUserFindByName
Lookup user owning a given name on OU, returning the
username or undef if not known or the search failed.
The following configure options are used by this function in addition
to the ones used by LdapConnect().
$RT::LdapNameBase
$RT::LdapNameFilter
$RT::LdapNameScope
$RT::LdapNameSearchAttr
$RT::LdapNameResultMap
For example:
Set($LdapNameBase, 'dc=mydomain,dc=co,dc=nz');
Set($LdapNameFilter, '(objectClass=user)');
Set($LdapNameScope, 'sub');
Set($LdapNameSearchAttr, 'sAMAccountName');
%RT::LdapNameResultMap = (
'sAMAccountName' => 'Name',
'mail' => 'EmailAddress',
'cn' => 'RealName',
);
=cut
# Example search
# ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm
sub LdapUserFindByName {
my $name = shift;
my %UserInfo = ();
$ldap = LdapConnect();
my $filter = "(&($RT::LdapNameSearchAttr=$name)$RT::LdapNameFilter)";
my @attr = keys %RT::LdapNameResultMap;
$RT::Logger->info( "LdapUserFindByName: Looking for ",
join(" ", @attr), " filter=", $filter );
$mesg = $ldap->search(
base => $RT::LdapNameBase,
scope => $RT::LdapNameScope,
filter => $filter,
attributes => [@attr],
);
if ( ($mesg->code != LDAP_SUCCESS) and
($mesg->code != LDAP_PARTIAL_RESULTS) ) {
$RT::Logger->critical("LdapUserFindByName: Search failed: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
LdapDisconnect($ldap);
return undef;
}
if (1 != $mesg->count) {
$RT::Logger->critical("LdapUserFindByName: Search failed: ",
"\$mesg->count=", $mesg->count);
LdapDisconnect($ldap);
return undef;
}
while( my $entry = $mesg->shift_entry) {
foreach my $attr (keys %RT::LdapNameResultMap) {
foreach my $value ($entry->get_value($attr)) {
$UserInfo{$RT::LdapNameResultMap{$attr}} = $value;
}
}
}
LdapDisconnect($ldap);
return %UserInfo;
}
# }}}
# {{{ sub LdapUserFindByMailaddr
=head2 LdapUserFindByMailaddr
Lookup user owning a given email address on UiO, returning the
username or undef if not known or the search failed.
The following configure options are used by this function in addition
to the ones used by LdapConnect().
$RT::LdapMailBase
$RT::LdapMailFilter
$RT::LdapMailScope
$RT::LdapMailSearchAttr
$RT::LdapMailMap
=cut
# Example search
# ldapsearch -x -b ou=mail,dc=uio,dc=no -ZZ -h ldap.uio.no -D uid=pre,ou=users,dc=uio,dc=no -W target=mathiasm
sub LdapUserFindByMailaddr {
my $mailaddr = shift;
my %UserInfo = ();
$ldap = LdapConnect();
my $filter = "(&($RT::LdapMailSearchAttr=$mailaddr)$RT::LdapMailFilter)";
my @attr = keys %RT::LdapMailResultMap;
$RT::Logger->info( "LdapUserFindByMailaddr: Looking for ",
join(" ", @attr), " filter=", $filter );
$mesg = $ldap->search(
base => $RT::LdapMailBase,
scope => $RT::LdapMailScope,
filter => $filter,
attributes => [@attr],
);
if ( ($mesg->code != LDAP_SUCCESS) and
($mesg->code != LDAP_PARTIAL_RESULTS) ) {
$RT::Logger->critical("LdapUserFindByMailaddr: Search failed: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
LdapDisconnect($ldap);
return undef;
}
if (1 != $mesg->count) {
LdapDisconnect($ldap);
return undef;
}
while( my $entry = $mesg->shift_entry) {
foreach my $attr (keys %RT::LdapMailResultMap) {
foreach my $value ($entry->get_value($attr)) {
$UserInfo{$RT::LdapMailResultMap{$attr}} = $value;
}
}
}
LdapDisconnect($ldap);
return %UserInfo;
}
# {{{ sub LdapConnect
=head2 LdapConnect
Connect to the LDAP databsae.
The following configure options are used by this function:
$RT::LdapServer
$RT::LdapUser
$RT::LdapPass
=cut
sub LdapConnect {
use Net::LDAP qw(LDAP_SUCCESS LDAP_PARTIAL_RESULTS);
use Net::LDAP::Util qw (ldap_error_name);
my $mesg;
my $ldap = Net::LDAP->new($RT::LdapServer,
version => 3);
unless ($ldap) {
$RT::Logger->critical("IsLdapPassword: Cannot connect to",
"LDAP server ", $RT::LdapServer);
return undef;
}
# I seem to have problems if I try and bind with a NULL username
# by hand So this now checks to see if we are really going to bind
# with a username.
if (defined($RT::LdapUser) && $RT::LdapUser ne '') {
$mesg = $ldap->bind($RT::LdapUser,
password => $RT::LdapPass );
} else {
# This bind is redundant with LDAP protocol version 3
$mesg = $ldap->bind;
}
if ($mesg->code != LDAP_SUCCESS) {
$RT::Logger->critical("IsLdapPassword: Cannot bind to LDAP: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
return undef;
}
return $ldap;
}
# }}}
# {{{ sub LdapDisconnect
=head2 LdapDisconnect
Disconnect from the LDAP database.
=cut
sub LdapDisconnect {
my $ldap = shift;
my $mesg = $ldap->unbind();
if ($mesg->code != LDAP_SUCCESS) {
$RT::Logger->critical("LdapDisconnect: unbind failed: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
}
}
# }}}
# {{{ sub LdapFindUser
=head2 LdapFindUser
Locate info on a giver user given the username.
Configure options used by this function:
$RT::LdpaAuthBase
$RT::LdpaAuthFilter
$RT::LdpaAuthUidAttr
=cut
sub LdapFindUser {
my $ldap = shift;
my $username = shift;
$RT::Logger->info("LdapFindUser: "
. "ldap: '" . $ldap
. "', username: '" . $username . "'" );
my $filter;
if ($RT::LdapAuthFilter) {
$filter = "(&(" .$RT::LdapAuthUidAttr . "=$username)$RT::LdapAuthFilter)";
} else {
$filter = "(" .$RT::LdapAuthUidAttr . "=$username)";
}
$RT::Logger->debug("IsLdapPassword: First search filter '$filter'");
my $mesg = $ldap->search(base => $RT::LdapAuthBase,
filter => $filter,
attrs => ['dn']);
if (!(($mesg->code == LDAP_SUCCESS) or
($mesg->code == LDAP_PARTIAL_RESULTS)))
{
$RT::Logger->debug("IsLdapPassword: Could not search for $filter: ",
"retval=", $mesg->code, " ",
ldap_error_name($mesg->code));
return undef;
}
return $mesg;
}
# }}}
# {{{ sub IsLdapPassword
=head2 IsLdapPassword
Takes a username and password as argument, and check if the password
is correct for the given user. Return undef if password check failed,
-1 if the user is unknown, and 1 if the password check succeeded.
=cut
sub IsLdapPassword {
my $username = shift;
my $value = shift;
$RT::Logger->debug("IsLdapPassword: executing");
my $ldap = LdapConnect();
return undef unless $ldap;
my $mesg = LdapFindUser($ldap, $username);
unless ($mesg) {
LdapDisconnect($ldap);
return undef;
}
$RT::Logger->debug("IsLdapPassword: First search produced ",
$mesg->count, " results");
if (! $mesg->count)
{
$RT::Logger->info("IsLdapPassword: AUTH FAILED $username");
LdapDisconnect($ldap);
return -1;
}
$ldap->start_tls( verify => 'require',
cafile => $RT::LdapCAFile ) if ($RT::LdapAuthStartTLS);
my $userdn = $mesg->first_entry->dn;
$RT::Logger->debug("IsLdapPassword: Trying to bind using DN=$userdn");
my $mesg2 = $ldap->bind($userdn,
password => $value );
if ($mesg2->code != LDAP_SUCCESS) {
$RT::Logger->critical("IsLdapPassword: Unable to bind as $userdn: ",
"retval=", $mesg2->code, " ",
ldap_error_name($mesg2->code));
LdapDisconnect($ldap);
return undef;
}
else
{
$RT::Logger->info("IsLdapPassword: AUTH OK $username ($userdn) base:",
$RT::LdapAuthBase);
LdapDisconnect($ldap);
return 1;
}
}
# }}}
1;