Hi There,
I am having an issue with LDAP inheritance. Basically OTRS is setup to connect to and LDAP backend, with sync option on as well as role sync. Whats happening is that if the permission is assigned directly to the person in AD that person can sign into OTRS, if its assigned indirectly through a group in AD the user cant login, the error received in the log is No user Found.
There is already on old OTRS instance using this same LDAP configuration and it is working ok, with installing OTRS 5 on a new instance and replicating the LDAP config we experience this issue.
Has anyone experienced this before, and if so any ideas what it might be?
Thanks!
LDAP group inheritance issue
Moderator: crythias
Re: LDAP group inheritance issue
As far as I know OTRS is not able to handle nested groups.
But there is already a open commit which caught the attention of the developers.
https://github.com/OTRS/otrs/pull/1344
But there is already a open commit which caught the attention of the developers.
https://github.com/OTRS/otrs/pull/1344
Re: LDAP group inheritance issue
it is possible with a special ldap search query (search Microsofts Knoledge Base to find out the strin)
"Production": OTRS™ 8, OTRS™ 7, STORM powered by OTRS
"Testing": ((OTRS Community Edition)) and git Master
Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
"Testing": ((OTRS Community Edition)) and git Master
Never change Defaults.pm! :: Blog
Professional Services:: http://www.otrs.com :: enjoy@otrs.com
Re: LDAP group inheritance issue
Thanks jojo,
I found this on KB which shows the filter, thought I would add it here. I am awaiting feedback from the ldap admins on the article and will give feedback here if this solved it.
https://social.technet.microsoft.com/Fo ... inserverDS
I found this on KB which shows the filter, thought I would add it here. I am awaiting feedback from the ldap admins on the article and will give feedback here if this solved it.
https://social.technet.microsoft.com/Fo ... inserverDS
-
- Administrator
- Posts: 3956
- Joined: 18 Dec 2007, 12:23
- Znuny Version: Znuny and Znuny LTS
- Real Name: Roy Kaldung
- Company: Znuny
- Contact:
Re: LDAP group inheritance issue
Seet https://msdn.microsoft.com/en-us/librar ... s.85).aspx and look for LDAP_MATCHING_RULE_IN_CHAIN That's all you need
Znuny and Znuny LTS running on CentOS / RHEL / Debian / SLES / MySQL / PostgreSQL / Oracle / OpenLDAP / Active Directory / SSO
Use a test system - always.
Do you need professional services? Check out https://www.znuny.com/
Do you want to contribute or want to know where it goes ?
Use a test system - always.
Do you need professional services? Check out https://www.znuny.com/
Do you want to contribute or want to know where it goes ?