Раскидывание агентов по группам

[germesnsk]

Здравствуйте, хочу раскидать агентов по группам, на основе групп безопасности AD, сваял вот такой конфиг:

Code: Select all

    # ADMIN AGENTS
    $Self->{'AuthModule1'} = 'Kernel::System::Auth::LDAP';
    $Self->{'AuthModule::LDAP::Replace1'} = 'domain\\';
    $Self->{'AuthModule::LDAP::Host1'} = 'dc.domain.local';
    $Self->{'AuthModule::LDAP::BaseDN1'} = 'dc=domain,dc=local';
    $Self->{'AuthModule::LDAP::UID1'} = 'sAMAccountName';
 
    # Check if the user is allowed to auth in a posixGroup
    # (e. g. user needs to be in a group OTRS_Agents to use otrs)
    $Self->{'AuthModule::LDAP::GroupDN1'} = 'CN=OTRS Agents,CN=Builtin,DC=domain,DC=local';
    $Self->{'AuthModule::LDAP::AccessAttr1'} = 'member';
    $Self->{'AuthModule::LDAP::UserAttr1'} = 'DN';
 
    # Bind credentials to log into AD
    $Self->{'AuthModule::LDAP::SearchUserDN1'} = 'CN=helpdesk,CN=Builtin,DC=domain,DC=local';
    $Self->{'AuthModule::LDAP::SearchUserPw1'} = 'PW';
 
    # in case you want to add always one filter to each ldap query, use
    # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
    $Self->{'AuthModule::LDAP::AlwaysFilter1'} = '';
 
    # in case you want to add a suffix to each login name,  then
    # you can use this option. e. g. user just want to use user but
    # in your ldap directory exists user@domain.
    $Self->{'AuthModule:LDAP::UserSuffix1'} = '';

    # Now sync data with OTRS DB
    $Self->{'AuthSyncModule1'} = 'Kernel::System::Auth::Sync::LDAP';
    $Self->{'AuthSyncModule::LDAP::Host1'} = 'dc.domain.local';
    $Self->{'AuthSyncModule::LDAP::BaseDN1'} = 'dc=domain, dc=local';
    $Self->{'AuthSyncModule::LDAP::UID1'} = 'sAMAccountName';
    $Self->{'AuthSyncModule::LDAP::SearchUserDN1'} = 'CN=helpdesk,CN=Builtin,DC=domain,DC=local';
    $Self->{'AuthSyncModule::LDAP::SearchUserPw1'} = 'PW';
 
    $Self->{'AuthSyncModule::LDAP::UserSyncMap1'} = {
        # DB -> LDAP
        UserFirstname => 'givenName',
        UserLastname  => 'sn',
        UserEmail     => 'mail',
    };
     
    # Heads AGENTS
    $Self->{'AuthModule2'} = 'Kernel::System::Auth::LDAP';
    $Self->{'AuthModule::LDAP::Replace2'} = 'domain\\';
    $Self->{'AuthModule::LDAP::Host2'} = 'dc.domain.local';
    $Self->{'AuthModule::LDAP::BaseDN2'} = 'dc=domain,dc=local';
    $Self->{'AuthModule::LDAP::UID2'} = 'sAMAccountName';
 
    # Check if the user is allowed to auth in a posixGroup
    # (e. g. user needs to be in a group OTRS_Agents to use otrs)
    $Self->{'AuthModule::LDAP::GroupDN2'} = 'CN=Test,CN=Builtin,DC=cloud,DC=local';
    $Self->{'AuthModule::LDAP::AccessAttr2'} = 'member';
    $Self->{'AuthModule::LDAP::UserAttr2'} = 'DN';
 
    # Bind credentials to log into AD
    $Self->{'AuthModule::LDAP::SearchUserDN2'} = 'CN=helpdesk,CN=Builtin,DC=domain,DC=local';
    $Self->{'AuthModule::LDAP::SearchUserPw2'} = 'Pw';
 
    # in case you want to add always one filter to each ldap query, use
    # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
    $Self->{'AuthModule::LDAP::AlwaysFilter2'} = '';
 
    # in case you want to add a suffix to each login name,  then
    # you can use this option. e. g. user just want to use user but
    # in your ldap directory exists user@domain.
    $Self->{'AuthModule:LDAP::UserSuffix2'} = '';

    # Now sync data with OTRS DB
    $Self->{'AuthSyncModule2'} = 'Kernel::System::Auth::Sync::LDAP';
    $Self->{'AuthSyncModule::LDAP::Host2'} = 'dc.domain.local';
    $Self->{'AuthSyncModule::LDAP::BaseDN2'} = 'dc=domain, dc=local';
    $Self->{'AuthSyncModule::LDAP::UID2'} = 'sAMAccountName';
    $Self->{'AuthSyncModule::LDAP::SearchUserDN2'} = 'CN=helpdesk,CN=Builtin,DC=domain,DC=local';
    $Self->{'AuthSyncModule::LDAP::SearchUserPw2'} = 'PW';
 
    $Self->{'AuthSyncModule::LDAP::UserSyncMap2'} = {
        # DB -> LDAP
        UserFirstname => 'givenName',
        UserLastname  => 'sn',
        UserEmail     => 'mail',
    };
    # AuthSyncModule::LDAP::UserSyncInitialGroups
    # (sync following group with rw permission after initial create of first agent
    # login)
    $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups2'} = [
        'Heads'
    ];

    $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups1'} = [
       'stats'
    ];

 

Собственно авторизация работает на ура, а вот мапит агентов только в группу stats, при том мапит даже если пользователь входит только в группу безопасности Test, в группу Heads не мапит ни в какую, куда рыть, что делать?

[germesnsk]

Предложили вот такое решение:

Code: Select all

    $Self->{'AuthSyncModule::LDAP:::LDAP::UserSyncRolesDefinition2'} = {
	'CN=Test,CN=Builtin,DC=domain,DC=local'=>{
	    'Heads'=>1,
	}
    };

    $Self->{'AuthSyncModule::LDAP:::LDAP::UserSyncRolesDefinition'} = {
	'CN=Test,CN=Builtin,DC=domain,DC=local'=>{
	    'Heads'=>1,
	}
    };
    $Self->{'AuthSyncModule::LDAP:::LDAP::UserSyncRolesDefinition1'} = {
	'CN=Test,CN=Builtin,DC=domain,DC=local'=>{
	    'Heads'=>1,
	}
    };

2/3 кода в тестовых целях -- просьба ногами не пинать... но и оно не работает ни в какую, хотя роль есть...