Tjyylli

I am testing OTRS 6 with the ITSM module. Right now I'm only testing it on our DEV environment, so it would not be a problem to ditch everything and start from scratch if it's the easiest way. I intend to put it to production soon, tho.

I installed it "by the book" using the official docs and it worked like a charm! It has been nstalled on Ubuntu Server 18.04 LTS. I have all users authenticating locally using the User Database on MySQL. I had Customers, Agents and Admins all able to authenticate and being presented with the correct user panel.

After that, I have been able to successfully integrate OTRS with my AD, but with a catch: all my AD users are mapped as Customers, all my Domain Admins (who also belong to the OTRS_Admins AD Group) are Agents, and.... I'm left with no account to manage OTRS. No Admins at all.

What should I do? How can I map my Domain Admins to be OTRS Admins and not Agents? How to map some of my Domain Users to be Agents? Am I doing something wrong? I'm completely lost.

The oficial docs don´t help that much, and I couldn't find on Google anyone with my specific need.

My (redacted) Config.pm:

     $Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';





        ### OTRS Admin Auth

        ### 

        $Self->{'AuthModule::LDAP::Host'} = '192.168.179.2';     # AD Server

        $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=test,DC=local'; # Domain

        $Self->{'AuthModule::LDAP::UID'} = 'sAMAccountName';

        $Self->{'AuthModule::LDAP::GroupDN'} = 'CN=OTRS_Admins,CN=Users,DC=test,DC=local';   #OTRS Admin group

        $Self->{'AuthModule::LDAP::AccessAttr'} = 'member';

        $Self->{'AuthModule::LDAP::UserAttr'} = 'DN';

        $Self->{'AuthModule::LDAP::SearchUserDN'} = 'svc_otrs'; #OTRS service user

        $Self->{'AuthModule::LDAP::SearchUserPw'} = 'Passw0rd'; #And its passwird

        $Self->{'AuthModule::LDAP::AlwaysFilter'} = '';

        $Self->{'AuthModule::LDAP::Params'} = {

                          port => 389,

                          timeout => 120,

                          async => 0,

                          version => 3,

                          sscope => 'sub'

                        };



        ### User Sync

        ### AD <==> DB OTRS (MySQL)

        $Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';

        $Self->{'AuthSyncModule::LDAP::Host'} = '192.168.179.2';      # AD SRV

        $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=test,DC=local'; # Domain

        $Self->{'AuthSyncModule::LDAP::UID'} = 'sAMAccountName';

        $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'svc_otrs';         

        $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'Passw0rd';    

        $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {

        # DB -> LDAP

        UserFirstname => 'givenName',

        UserLastname => 'sn',

        UserEmail => 'mail',

        };



        $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [

        'users', 'basic_admin',

        ];

  $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';

    $Self->{'Customer::AuthModule::LDAP::Host'} = '192.168.179.2';

    $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=test,DC=local';    

    $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';

    $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'svc_otrs';     

    $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'Passw0rd';     

    $Self->{CustomerUser} = {

    Module => 'Kernel::System::CustomerUser::LDAP',

    Params => {

    Host => '192.168.179.2',     # AD Server

    BaseDN => 'dc=test,DC=local',      #Domain

    SSCOPE => 'sub',

    UserDN =>'svc_otrs',     #OTRS Service User

    UserPw => 'Passw0rd',    #its password

    AlwaysFilter => '(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))',

    SourceCharset => 'utf-8',

    DestCharset => 'utf-8',

    },



    CustomerKey => 'sAMAccountName',

    CustomerID => 'mail',

    CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'],

    CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'],

    CustomerUserSearchPrefix => '',

    CustomerUserSearchSuffix => '*',

    CustomerUserSearchListLimit => 10000,

    CustomerUserPostMasterSearchFields => ['mail'],

    CustomerUserNameFields => ['givenname', 'sn'],

    Map => [

    # note: Login, Email and CustomerID needed!

    #[ 'UserSalutation', 'Title', 'title', 1, 0, 'var' ],

    [ 'UserFirstname', 'Firstname', 'givenname', 1, 1, 'var' ],

    [ 'UserLastname', 'Lastname', 'sn', 1, 1, 'var' ],

    [ 'UserLogin', 'Login', 'sAMAccountName', 1, 1, 'var' ],

    [ 'UserEmail', 'Email', 'mail', 1, 1, 'var' ],

    [ 'UserCustomerID', 'CustomerID', 'mail', 0, 1, 'var' ],

    [ 'UserPhone', 'Phone', 'telephonenumber', 1, 0, 'var' ],

    #[ 'UserAddress', 'Address', 'postaladdress', 1, 0, 'var' ],

    #[ 'UserComment', 'Comment', 'description', 1, 0, 'var' ],

    ],

    };