OTRS CVS - Manual
Prev | Chapter 9. User | Next

# User Auth Backend

## Database (default)

The default user auth backend is the otrs database.

        [Kernel/Config.pm]
        # This is the auth. module againt the otrs db
        $Self->{'AuthModule'} = 'Kernel::System::Auth::DB';
        [...]

## LDAP

If there is a LDAP tree available with your users then you can use the user LDAP auth backend. This module is just read only ( means it can't write to your LDAP tree - this should just be possibe for your tree manager) so you can't create or update user via the Admin-Interface.

        [Kernel/Config.pm]
        # This is an example configuration for an LDAP auth. backend.
        # (take care that Net::LDAP is installed!)
        $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
        $Self->{'AuthModule::LDAP::Host'} = 'ldap.example.com';
        $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
        $Self->{'AuthModule::LDAP::UID'} = 'uid';

        # Check if the user is allowed to auth in a posixGroup
        # (e. g. user needs to be in a group xyz to use otrs)
    #    $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
    #    $Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';

        # The following is valid but would only be necessary if the
        # anonymous user do NOT have permission to read from the LDAP tree
        $Self->{'AuthModule::LDAP::SearchUserDN'} = '';
        $Self->{'AuthModule::LDAP::SearchUserPw'} = '';

        # in case you want to add always one filter to each ldap query, use
        # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
    #   $Self->{'AuthModule::LDAP::AlwaysFilter'} = '';

        # in case you want to add a suffix to each login name, then
        # you can use this option. e. g. user just want to use user but
        # in your ldap directory exists user@domain.
    #    $Self->{'AuthModule::LDAP::UserSuffix'} = '@domain.com';

        # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
    #    $Self->{'AuthModule::LDAP::Params'} = {
    #        port => 389,
    #        version => 3,
    #    };
        [...]

LDAP entries shall conform to the PosixAccount and inetOrgPerson schema. An example entry might look like:

        dn: uid=lester,ou=user,dc=example,dc=com
        objectClass: top
        objectClass: account
        objectClass: posixAccount
        objectClass: organizationalPerson
        objectClass: inetOrgPerson
        objectClass: officePerson
        uid: lester
        cn: Lester Adamas
        userPassword: {crypt}X5/DBrWPOQQaI
        gecos: Lester
        loginShell: /bin/csh
        uidNumber: 10
        gidNumber: 10
        homeDirectory: /home/lester
        sn: Adams
        givenName: Lester
        mail: lester@example.com
        preferredLanguage: fr
        comment: technical support

Please note, that in version 1.x you have to create a db entry for the ldap user. This is done automatically on first login in versions > 1.1.x.

This will be the config option to map the LDAP attributes to database. Default is:

        # UserSyncLDAPMap
        # (map if agent should create/synced from LDAP to DB after login)
        $Self->{UserSyncLDAPMap} = {
            # DB -> LDAP
            Firstname => 'givenName',
            Lastname => 'sn',
            Email => 'mail',
        };

## HTTPBasicAuth

If you a "single sign on" solution, use http basic authentication (for all your systems) and use the HTTPBasicAuth module (no otrs login is required!).

        [Kernel/Config.pm]
        # This is the auth. module againt $ENV{REMOTE_USER} (apache
        # http-basic-auth)
        $Self->{'AuthModule'} = 'Kernel::System::Auth::HTTPBasicAuth';
        # Note:
        # If you use this module, you should use as fallback the following
        # config settings if user isn't login through apache ($ENV{REMOTE_USER})
        $Self->{LoginURL} = 'http://host.example.com/not-authorised-for-otrs.html';
        $Self->{LogoutURL} = 'http://host.example.com/thanks-for-using-otrs.html';
        [...]

## Radius

Authentication against a radius server.

        [Kernel/Config.pm]
        # This is example configuration to auth. agents against a radius server
        $Self->{'AuthModule'} = 'Kernel::System::Auth::Radius';
        $Self->{'AuthModule::Radius::Host'} = 'radiushost';
        $Self->{'AuthModule::Radius::Password'} = 'radiussecret';
        [...]

Prev | Home | Next
User Backend | Up | Customer