OTRS doesn't see customers

[firebolt]

Hi!

I have a problem with ldap authentication of customers. I configured system so that agents and customers can log in with their ldap accounts. But the are not all of our customers appears in Customers menu item. I can see only 2 departments of 26.

Here is my config:

Code: Select all

  #АХД
    $Self->{CustomerUser1} = {
     Name => 'АХД',
     Module => 'Kernel::System::CustomerUser::LDAP',
     Params => {
      Host => 'svrmain.company.local',
      BaseDN => 'OU=Users,DC=company,DC=local',
      SSCOPE => 'sub',
      UserDN => 'cn=admin,ou=Administrators,dc=company,dc=local',
      UserPw => '********',
      SourceCharset => 'utf-8',
      DestCharset => 'utf-8',

How to make system see all of our customers?

[crythias]

viewtopic.php?f=60&t=16543

[firebolt]

viewtopic.php?f=60&t=16543

I've configured system logs and saw next errors:

Code: Select all

[Wed Sep 26 12:52:44 2012][Error][Kernel::System::CustomerUser::LDAP::CustomerSearch][363] Sizelimit exceeded

And what does it means?

[EXG133]

That is not an OTRS issue, your LDAP is configured to have a maximum size when it replies. Configure this on your AD/OpenLDAP.

[firebolt]

That is not an OTRS issue, your LDAP is configured to have a maximum size when it replies. Configure this on your AD/OpenLDAP.

According to this topic it's an OTRS Bug.

[firebolt]

OK, now my problem is solved.

I've added

Code: Select all

AlwaysFilter => '(&(objectCategory=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))',

string and

Code: Select all

CustomerUserSearchListLimit => 900,

string to my Config.pm.

This problem is well known)))

[EXG133]

That's not a problem, that's just a default setting. I thought you added that already, my bad for assuming. I totally agree more comments would be nice in the default.pm explaining this setting, not everyone is familiar with LDAP (I'm not either ).

Just FYI, this sizelimit can be configured on the server and with every LDAP query, but the server limit wins.

[firebolt]

I totally agree more comments would be nice in the default.pm explaining this setting...

It must be in all OTRS Documentations from oldest system version to highest!!! But it doesn't included in anyone

Hey crythias, could you affect to this situation?

[crythias]

How best may I help you on this? You've encountered and addressed the issues yourself.
Other relevant posts:
viewtopic.php?f=53&t=8173
viewtopic.php?f=62&t=12487
viewtopic.php?f=61&t=15401

[EXG133]

I think he means if you (as mod) can ask OTRS to provide a better manual for this popular setting. Judging on the posts on this forum many would welcome more information in the manual and/or default.pm.

[crythias]

I have no clout. I'm just a guy. The issue is server side, and (IMO) is generally a non-issue.

[jojo]

You should have some basic understanding of LDAP for working with LDAP. You should also have some basic knowledge of SMTP, POP3 or other protocols. The manual can not cover basic IT knowledge for everything

[EXG133]

I totally agree with you jojo. But I find this an interesting discussion:

The thing that bugs me a little is that if you copy from default.pm this is the default setting:

# CustomerUserListFields => ['login', 'first_name', 'last_name', 'customer_id', 'email'],
CustomerUserSearchFields => [ 'login', 'first_name', 'last_name', 'customer_id' ],
CustomerUserSearchPrefix => '*',
CustomerUserSearchSuffix => '*',
CustomerUserSearchListLimit => 250,
CustomerUserPostMasterSearchFields => ['email'],
CustomerUserNameFields => [ 'title', 'first_name', 'last_name' ],
CustomerUserEmailUniqCheck => 1,

Why does it have this set to 250? I never limit LDAP searches like this but instead rely on server side soft or hard limits (which I always set higher than 250, I think AD has a limit of 1000?). So at first I didn't read this option and was confused at my results.

EDIT: It might just be bad practice from my side, everything I know about LDAP is self thaught

[firebolt]

You should have some basic understanding of LDAP for working with LDAP. You should also have some basic knowledge of SMTP, POP3 or other protocols. The manual can not cover basic IT knowledge for everything

No no no! It's a specific parameter of a specific program! When I configure other systems for working with AD LDAP, they give me all users "from the box". But when I configure OTRS, I must specify this

Code: Select all

CustomerUserSearchListLimit => 900

parameter to have a possibility to see all my LDAP users. Otherwise I will see only ~200 users. It must be specified in the OTRS documentation! I think I have a basic understanding of LDAP.

[jojo]

This Parameter you described is aprotection not to fetch all users in once (as this really makes no sense). If you search for a user you will specify search parameters to get only a few back. Or do you wan't to scroll through some thousand of users on ticket creation?

[firebolt]

This Parameter you described is aprotection not to fetch all users in once (as this really makes no sense). If you search for a user you will specify search parameters to get only a few back. Or do you wan't to scroll through some thousand of users on ticket creation?

OK. I can't tell you anything at this moment because I really don't have experience in using OTRS. I can't imagine what you are talking about. As I remember customer doesn't need to scroll through thousand of users when he creates a ticket. He just choose a queue which receives his ticket. That parameter helped me to see all my LDAP users. And 'AlwaysFilter' parameter helped me to filter users.

[crythias]

The point is that there is no reason to see all of your users within OTRS. There is nothing (or practically nothing) that you can do through the GUI as a batch to users. And the things you want to apply to large groups of people would better be handled via changes in Config.pm or command line.