LdapSiteConfigSettingsForActiveDirectory

NOTICE

This is very out of date and based on old versions of RT. For modern equivalents, see RT::Authen::ExternalAuth and the LDAPImport extension.

Introduction

This code is part of the LDAP integration overlay; you'll also need LdapUserLocalOverlay and, optionally, LdapAutocreateAuthCallback.

2007/09/28 - Edward Kovarski; It has been adjusted for a Windows 2003 Active Directory Environment

• 2007/10/31 - Mario Leal; Using this code I was unable to authenticate until I changed:

Set($LdapFilter, '(objectclass=posixAccount)');
To:
Set($LdapFilter, '(objectclass=*)');

Setup

Be sure to set the following variables for your environment,

LdapServer LdapBase LdapUser LdapPass

Configuration

Put these in your site configuration file, [=${RTHOME}/etc/RT_SiteConfig.pm]

### What auth methods do you like and in what order?
 
 Set($AuthMethods, ['LDAP', 'Internal']);
 
 ### LDAP Settings
 #
 # There are two different branches of this: LdapAuth* and LdapInfo*;
 # additionally, most of the old Ldap* variables are honored, too.
 #
 # This means if you only have one LDAP server/config you can just set
 # "LdapServer", "LdapUser", etc. and they will be used for both
 # authentication and information
 
 ### Enable/Disable LDAP services
 Set($LdapExternalAuth, 1);
 Set($LdapExternalInfo, 1);
 
 ### Common Settings: affecting both auth and info services
 
 # Should we create accounts for users who aren't in LDAP?
 Set($LdapAutoCreateNonLdapUsers, 1);
 
 # Should we assign the privileged rights to the user?
 Set($AutoCreate, {Privileged => 1});
 
 # Map RT attributes to LDAP attributes
 #
 # The mapping below is known to work in Windows 2003 w/Active Directory
 #
 ####
 #### NOTE
 ####
 #### You have the following options for the user id with Active Directory,
 ####
 #### 'mail'
 #### Users email address, user@mydomain.com
 ####
 #### 'userPrincipalName'
 #### New user logon name stored in the following format, user@ad_domain.com
 ####
 #### 'sAMAccountName' (Default for this config)
 #### Also known as the pre-Windows 2000 Logon Name
 
 

Set( $LdapAttrMap, {

'Name' => 'sAMAccountName',
'EmailAddress' => 'mail',
'Organization' => 'physicalDeliveryOfficeName',
'RealName' => 'cn',
'ExternalContactInfoId' => 'dn',
'ExternalAuthId' => 'sAMAccountName',
'Gecos' => 'sAMAccountName',
'HomePhone' => 'homePhone',
'WorkPhone' => 'telephoneNumber',
'MobilePhone' => 'mobile',
'PagerPhone' => 'pager',
'Address1' => 'streetAddress',
'Address2' => 'postOfficeBox',
'City' => 'l',
'State' => 'st',
'Zip' => 'postalCode',
'Country' => 'co',
'FreeformContactInfo' => 'info',
}

);

# A list of RT attrs which can uniquely identify a user,
 # ordered from most to least preferred.
 Set($LdapRTAttrMatchList, ['ExternalContactInfoId', 'Name',
                            'EmailAddress', 'RealName',
                            'WorkPhone', 'Address2']
 );
 
 # A list of LDAP attrs to examine when canonicalizing email addresses,
 # ordered from most to least preferred
 Set($LdapEmailAttrMatchList, ['mail', 'mailRoutingAddress',
                               'mailAlternateAddress']
 );
 
 # A list of prefixes to apply to email address matches.
 # Windows 2003 AD uses prefixes or smtp: or SMTP:.
 # If not required just leave ''
 Set($LdapEmailAttrMatchPrefix, ['', 'smtp:', 'SMTP:'] );
 
 # The basics; if set, these override $RT::LdapAuth* and $RT::LdapInfo*
 Set($LdapServer, 'ldap.example.com');
 Set($LdapBase, 'ou=People,dc=example,dc=com');
 Set($LdapFilter, '(objectclass=posixAccount)');
 
 #   Windows 2003 Active Directory does not allow anonymous LDAP binding
 #   thus you must pass Net::LDAP a username and password that has
 #   access to read the directory.
 #
 #   You may also need to specify the full distinguished name instead of
 #   just a username for LdapUser below.
 #   e.g. cn=Username,cn=Users,dc=yourdomain,dc=com
 #
 Set($LdapUser, 'ldapuser@ad.domain.com');
 Set($LdapPass, 'password');
 
 # This filter is used by RT::User::UpdateFromLdap to test whether an
 # LDAP user's RT account should be disabled. Any user whose LDAP record
 # passes this filter (returns true) will be disabled at login
 Set($LdapDisableFilter, '(employmentStatus=Terminated)');
 
 # If you set these, only members of this group can auth via LDAP
 #Set($LdapGroup, 'cn=RT,ou=Group,dc=example,dc=com');
 #Set($LdapGroupAttr, 'uniqueMember');
 
 # These turn on SSL for LDAP
 #Set($LdapTLS, 0);
 #Set($LdapSSLVersion, 3);
 
 ### IF YOU USE THE SAME LDAP SERVER FOR AUTH AND INFO STOP HERE ###
 
 ### Authentication settings
 
 #
 # These are used only if their $RT::Ldap* analogs are not set;
 # if you want one of these variables to be honored, you must comment
 # out the corresponding $RT::Ldap* variable above
 
 #Set($LdapAuthServer, 'ldap.example.com');
 #Set($LdapAuthBase, 'ou=People,dc=example,dc=com');
 #Set($LdapAuthFilter, "(objectclass=posixAccount)");
 #Set($LdapAuthUser, '');
 #Set($LdapAuthPass, '');
 
 # This filter is used by RT::User::UpdateFromLdap to test whether an
 # LDAP user's RT account should be disabled. Any user whose LDAP record
 # passes this filter (returns true) will be disabled at login
 # Set($LdapAuthDisableFilter, '(employmentStatus=Terminated)');
 
 
 # If you set these, only members of this group can auth via LDAP
 #Set($LdapAuthGroup, 'cn=RT,ou=Group,dc=example,dc=com');
 #Set($LdapAuthGroupAttr, 'uniqueMember');
 # These turn on SSL for LDAP
 #Set($LdapAuthTLS, 0);
 #Set($LdapAuthSSLVersion, 3);
 
 
 ### Information settings
 
 #
 # These are used only if their $RT::Ldap* analogs are not set;
 # if you want one of these variables to be honored, you must comment
 # out the corresponding $RT::Ldap* variable above
 
 
 #Set($LdapInfoServer, 'ldap.example.com');
 #Set($LdapInfoBase, 'ou=People,dc=example,dc=com');
 #Set($LdapInfoFilter, "(objectclass=posixAccount)");
 #Set($LdapInfoUser, '');
 #Set($LdapInfoPass, '');
 
 # This filter is used by RT::User::UpdateFromLdap to test whether an
 # LDAP user's RT account should be disabled. Any user whose LDAP record
 # passes this filter (returns true) will be disabled at login
 # Set($LdapInfoDisableFilter, '(employmentStatus=Terminated)');
 
 # These turn on SSL for LDAP
 #Set($LdapInfoTLS, 0);
 #Set($LdapInfoSSLVersion, 3);