11.3. Backends to authenticate Agents and Customers

From open-support.info

< Book:OTRS 3.0 - Admin Manual | Chapter 11(Difference between revisions)
Jump to: navigation, search
m (→Authentication backends for Customers)
m (→DB (Default))
 
(7 intermediate revisions not shown)
Line 1: Line 1:
{{Book
{{Book
-
|next=/1
+
|next=../4
|heading=11.3.
|heading=11.3.
|title=Backends to authenticate Agents and Customers
|title=Backends to authenticate Agents and Customers
|status=effective
|status=effective
-
|progress=00
+
|progress=0
|author=Dick6809
|author=Dick6809
|editor=Dick6809
|editor=Dick6809
Line 10: Line 10:
<onlyinclude>OTRS offers the option to authenticate agents and customers against different backends.
<onlyinclude>OTRS offers the option to authenticate agents and customers against different backends.
-
__TOC__
 
== Authentication backends for Agents ==
== Authentication backends for Agents ==
Line 16: Line 15:
The backend to authenticate agents which is used by default is the OTRS database. Agents can be added and edited via the agent management interface in the Admin page (see Example 11-6 below).  
The backend to authenticate agents which is used by default is the OTRS database. Agents can be added and edited via the agent management interface in the Admin page (see Example 11-6 below).  
-
{| class="script"
+
{{book/example
-
| Example 11.6. Authenticate agents against a DB backend
+
|id= Example 11.6
-
|-
+
|title= Authenticate agents against a DB backend
-
|
+
|code=
<pre>
<pre>
     $Self->{'AuthModule'} = 'Kernel::System::Auth::DB';
     $Self->{'AuthModule'} = 'Kernel::System::Auth::DB';
</pre>
</pre>
-
|}
+
}}
<br />
<br />
Line 29: Line 28:
If an LDAP directory has all your agent data stored, you can use the LDAP module to authenticate your users in OTRS (see Example 11-7 below). This module has only read access to the LDAP tree, which means that you cannot edit your user data via the agent management interface.  
If an LDAP directory has all your agent data stored, you can use the LDAP module to authenticate your users in OTRS (see Example 11-7 below). This module has only read access to the LDAP tree, which means that you cannot edit your user data via the agent management interface.  
-
{| class="script"
+
{{book/example
-
| Example 11.7. Authenticate agents against an LDAP backend
+
|id= Example 11.7
-
|-
+
|title= Authenticate agents against an LDAP backend
-
|
+
|code=
<pre>
<pre>
# This is an example configuration for an LDAP auth. backend.
# This is an example configuration for an LDAP auth. backend.
Line 72: Line 71:
};
};
</pre>
</pre>
-
|}
+
}}
The configuration parameters shown in Script 11.8 can be used to synchronize the user data from your LDAP directory into your local OTRS database. This reduces the number of requests to your LDAP server and speeds up the authentication with OTRS. The data synchronization is done when the agent authenticates the first time. Although the data can be syncronized into the local OTRS database, the LDAP directory is the last instance for the authentication, so an inactive user in the LDAP tree can't authenticate to OTRS, even when the account data is already stored in the OTRS database. The agent data in the LDAP directory can't be edited via the web interface of OTRS, so the data has to be managed directly in the LDAP tree.  
The configuration parameters shown in Script 11.8 can be used to synchronize the user data from your LDAP directory into your local OTRS database. This reduces the number of requests to your LDAP server and speeds up the authentication with OTRS. The data synchronization is done when the agent authenticates the first time. Although the data can be syncronized into the local OTRS database, the LDAP directory is the last instance for the authentication, so an inactive user in the LDAP tree can't authenticate to OTRS, even when the account data is already stored in the OTRS database. The agent data in the LDAP directory can't be edited via the web interface of OTRS, so the data has to be managed directly in the LDAP tree.  
-
{| class="script"
+
{{book/script
-
|
+
|code=
<pre>
<pre>
# agent data sync against ldap
# agent data sync against ldap
Line 102: Line 101:
];
];
</pre>
</pre>
-
|-
+
|id= Script 11.8
-
| Script 11.8. Synchronizing the user data from the LDAP directory into the OTRS database.
+
|title= Synchronizing the user data from the LDAP directory into the OTRS database.
-
|}
+
}}
<br />
<br />
Line 134: Line 133:
The configuration parameters shown in Example 11-9 can be used to authenticate agents against a Radius server.  
The configuration parameters shown in Example 11-9 can be used to authenticate agents against a Radius server.  
-
{| class="script"
+
{{book/example
-
| Example 11.9. Authenticate Agents against a Radius backend
+
|id= Example 11.9
-
|-
+
|title= Authenticate Agents against a Radius backend
-
|
+
|code=
<pre>
<pre>
# This is example configuration to auth. agents against a radius server
# This is example configuration to auth. agents against a radius server
Line 144: Line 143:
$Self->{'AuthModule::Radius::Password'} = 'radiussecret';
$Self->{'AuthModule::Radius::Password'} = 'radiussecret';
</pre>
</pre>
-
|}
+
}}
<br />
<br />
Line 152: Line 151:
The default user authentication backend for customers in OTRS is the OTRS database. With this backend, all customer data can be edited via the web interface of OTRS (see Example 11-10 below).  
The default user authentication backend for customers in OTRS is the OTRS database. With this backend, all customer data can be edited via the web interface of OTRS (see Example 11-10 below).  
-
{| class="script"
+
{{book/example
-
| Example 11.10. Customer user authentication against a DB backend
+
|id= Example 11.10
-
|-
+
|title= Customer user authentication against a DB backend
-
|
+
|code=
<pre>
<pre>
# This is the auth. module againt the otrs db
# This is the auth. module againt the otrs db
Line 166: Line 165:
#$Self->{'Customer::AuthModule::DB::Password'} = "some_password";
#$Self->{'Customer::AuthModule::DB::Password'} = "some_password";
</pre>
</pre>
-
|}
+
}}
<br />
<br />
Line 172: Line 171:
If you have an LDAP directory with all your customer data, you can use the LDAP module to authenticate your customers to OTRS (see Example 11-11 below). Because this module has only read-access to the LDAP backend, it is not possible to edit the customer data via the OTRS web interface.  
If you have an LDAP directory with all your customer data, you can use the LDAP module to authenticate your customers to OTRS (see Example 11-11 below). Because this module has only read-access to the LDAP backend, it is not possible to edit the customer data via the OTRS web interface.  
 +
{{book/example
 +
|id= Example 11.11
 +
|title= Customer user authentication against an LDAP backend
 +
|code=
<pre>
<pre>
-
Example 11.11. Customer user authentication against an LDAP backend
 
-
 
# This is an example configuration for an LDAP auth. backend.
# This is an example configuration for an LDAP auth. backend.
# (make sure Net::LDAP is installed!)
# (make sure Net::LDAP is installed!)
Line 213: Line 214:
};
};
</pre>
</pre>
 +
}}
=== HTTPBasicAuth for customers ===
=== HTTPBasicAuth for customers ===
If you want to implement a "single sign on" solution for all your customer users, you can use HTTPBasic authentication (for all your systems) and use the HTTPBasicAuth module with OTRS (no login is needed with OTRS any more). See Example 11-12 below.  
If you want to implement a "single sign on" solution for all your customer users, you can use HTTPBasic authentication (for all your systems) and use the HTTPBasicAuth module with OTRS (no login is needed with OTRS any more). See Example 11-12 below.  
 +
{{book/example
 +
|id= Example 11.12
 +
|title= Customer user authentication with HTTPBasic
 +
|code=
<pre>
<pre>
-
Example 11.12. Customer user authentication with HTTPBasic
 
-
 
# This is an example configuration for an apache ($ENV{REMOTE_USER})
# This is an example configuration for an apache ($ENV{REMOTE_USER})
# auth. backend. Use it if you want to have a singe login through
# auth. backend. Use it if you want to have a singe login through
Line 232: Line 236:
$Self->{CustomerPanelLogoutURL} = 'http://host.example.com/thanks-for-using-otrs.html';
$Self->{CustomerPanelLogoutURL} = 'http://host.example.com/thanks-for-using-otrs.html';
</pre>
</pre>
 +
}}
 +
<br />
=== Radius ===
=== Radius ===
The settings shown in Example 11-13 can be used to authenticate your customers against a Radius server.  
The settings shown in Example 11-13 can be used to authenticate your customers against a Radius server.  
 +
{{book/example
 +
|id= Example 11.13
 +
|title= Customer user authentication against a Radius backend
 +
|code=
<pre>
<pre>
-
Example 11.13. Customer user authentication against a Radius backend
 
-
 
# This is a example configuration to auth. customer against a radius server
# This is a example configuration to auth. customer against a radius server
$Self->{'Customer::AuthModule'} = 'Kernel::System::Auth::Radius';
$Self->{'Customer::AuthModule'} = 'Kernel::System::Auth::Radius';
Line 244: Line 252:
$Self->{'Customer::AuthModule::Radius::Password'} = 'radiussecret';
$Self->{'Customer::AuthModule::Radius::Password'} = 'radiussecret';
</pre>
</pre>
-
</onlyinclude>
+
}}</onlyinclude>

Latest revision as of 06:42, 24 April 2011

OTRS offers the option to authenticate agents and customers against different backends.

Contents

Authentication backends for Agents

DB (Default)

The backend to authenticate agents which is used by default is the OTRS database. Agents can be added and edited via the agent management interface in the Admin page (see Example 11-6 below).

Example 11.6. Authenticate agents against a DB backend 
    $Self->{'AuthModule'} = 'Kernel::System::Auth::DB';


LDAP

If an LDAP directory has all your agent data stored, you can use the LDAP module to authenticate your users in OTRS (see Example 11-7 below). This module has only read access to the LDAP tree, which means that you cannot edit your user data via the agent management interface.

Example 11.7. Authenticate agents against an LDAP backend 
# This is an example configuration for an LDAP auth. backend.
# (Make sure Net::LDAP is installed!)
$Self->{'AuthModule'} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'AuthModule::LDAP::UID'} = 'uid';

# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
$Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
$Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
# for ldap posixGroups objectclass (just uid)
#  $Self->{'AuthModule::LDAP::UserAttr'} = 'UID';
# for non ldap posixGroups objectclass (with full user dn)
#  $Self->{'AuthModule::LDAP::UserAttr'} = 'DN';

# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
$Self->{'AuthModule::LDAP::SearchUserDN'} = '';
$Self->{'AuthModule::LDAP::SearchUserPw'} = '';

# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
$Self->{'AuthModule::LDAP::AlwaysFilter'} = '';

# in case you want to add a suffix to each login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
#    $Self->{'AuthModule::LDAP::UserSuffix'} = '@domain.com';

# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
$Self->{'AuthModule::LDAP::Params'} = {
    port => 389,
    timeout => 120,
    async => 0,
    version => 3,
};


The configuration parameters shown in Script 11.8 can be used to synchronize the user data from your LDAP directory into your local OTRS database. This reduces the number of requests to your LDAP server and speeds up the authentication with OTRS. The data synchronization is done when the agent authenticates the first time. Although the data can be syncronized into the local OTRS database, the LDAP directory is the last instance for the authentication, so an inactive user in the LDAP tree can't authenticate to OTRS, even when the account data is already stored in the OTRS database. The agent data in the LDAP directory can't be edited via the web interface of OTRS, so the data has to be managed directly in the LDAP tree. 

# agent data sync against ldap
$Self->{'AuthSyncModule'} = 'Kernel::System::Auth::Sync::LDAP';
$Self->{'AuthSyncModule::LDAP::Host'} = 'ldap://ldap.example.com/';
$Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=otrs, dc=org';
$Self->{'AuthSyncModule::LDAP::UID'} = 'uid';
$Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'uid=sys, ou=user, dc=otrs, dc=org';
$Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'some_pass';
$Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
    # DB -> LDAP
    UserFirstname => 'givenName',
    UserLastname  => 'sn',
    UserEmail     => 'mail',
};
[...]

# AuthSyncModule::LDAP::UserSyncInitialGroups
# (sync following group with rw permission after initial create of first agent
# login)
$Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [
    'users',
];
Script 11.8. Synchronizing the user data from the LDAP directory into the OTRS database.


HTTPBasicAuth for Agents

If you want to implement a "single sign on" solution for all your agents, you can use HTTP basic authentication (for all your systems) and the HTTPBasicAuth module for OTRS (see Example 11-8 below).

Example 11.8. Authenticate Agents using HTTPBasic 
# This is an example configuration for an apache ($ENV{REMOTE_USER})
# auth. backend. Use it if you want to have a singe login through
# apache http-basic-auth
$Self->{'AuthModule'} = 'Kernel::System::Auth::HTTPBasicAuth';

# Note:
#
# If you use this module, you should use as fallback
# the following configuration settings if the user is not authorized
# apache ($ENV{REMOTE_USER})
$Self->{LoginURL} = 'http://host.example.com/not-authorised-for-otrs.html';
$Self->{LogoutURL} = 'http://host.example.com/thanks-for-using-otrs.html';


Radius

The configuration parameters shown in Example 11-9 can be used to authenticate agents against a Radius server.

Example 11.9. Authenticate Agents against a Radius backend 
# This is example configuration to auth. agents against a radius server
$Self->{'AuthModule'} = 'Kernel::System::Auth::Radius';
$Self->{'AuthModule::Radius::Host'} = 'radiushost';
$Self->{'AuthModule::Radius::Password'} = 'radiussecret';


Authentication backends for Customers

Database (Default)

The default user authentication backend for customers in OTRS is the OTRS database. With this backend, all customer data can be edited via the web interface of OTRS (see Example 11-10 below).

Example 11.10. Customer user authentication against a DB backend 
# This is the auth. module againt the otrs db
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::DB';
$Self->{'Customer::AuthModule::DB::Table'} = 'customer_user';
$Self->{'Customer::AuthModule::DB::CustomerKey'} = 'login';
$Self->{'Customer::AuthModule::DB::CustomerPassword'} = 'pw';
#$Self->{'Customer::AuthModule::DB::DSN'} = "DBI:mysql:database=customerdb;host=customerdbhost";
#$Self->{'Customer::AuthModule::DB::User'} = "some_user";
#$Self->{'Customer::AuthModule::DB::Password'} = "some_password";


LDAP

If you have an LDAP directory with all your customer data, you can use the LDAP module to authenticate your customers to OTRS (see Example 11-11 below). Because this module has only read-access to the LDAP backend, it is not possible to edit the customer data via the OTRS web interface.

Example 11.11. Customer user authentication against an LDAP backend 
# This is an example configuration for an LDAP auth. backend.
# (make sure Net::LDAP is installed!)
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'uid';

# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
$Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
$Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
# for ldap posixGroups objectclass (just uid)
$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'UID';
# for non ldap posixGroups objectclass (full user dn)
#$Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';

# The following is valid but would only be necessary if the
# anonymous user does NOT have permission to read from the LDAP tree
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = '';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '';

# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
$Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '';

# in case you want to add a suffix to each customer login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
#$Self->{'Customer::AuthModule::LDAP::UserSuffix'} = '@domain.com';

# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
$Self->{'Customer::AuthModule::LDAP::Params'} = {
    port => 389,
    timeout => 120,
    async => 0,
    version => 3,
};

HTTPBasicAuth for customers

If you want to implement a "single sign on" solution for all your customer users, you can use HTTPBasic authentication (for all your systems) and use the HTTPBasicAuth module with OTRS (no login is needed with OTRS any more). See Example 11-12 below.

Example 11.12. Customer user authentication with HTTPBasic 
# This is an example configuration for an apache ($ENV{REMOTE_USER})
# auth. backend. Use it if you want to have a singe login through
# apache http-basic-auth
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::HTTPBasicAuth';

# Note:
# If you use this module, you should use the following
# config settings as fallback, if user isn't login through
# apache ($ENV{REMOTE_USER})
$Self->{CustomerPanelLoginURL} = 'http://host.example.com/not-authorised-for-otrs.html';
$Self->{CustomerPanelLogoutURL} = 'http://host.example.com/thanks-for-using-otrs.html';


Radius

The settings shown in Example 11-13 can be used to authenticate your customers against a Radius server.

Example 11.13. Customer user authentication against a Radius backend 
# This is a example configuration to auth. customer against a radius server
$Self->{'Customer::AuthModule'} = 'Kernel::System::Auth::Radius';
$Self->{'Customer::AuthModule::Radius::Host'} = 'radiushost';
$Self->{'Customer::AuthModule::Radius::Password'} = 'radiussecret';
Retrieved from "http://open-support.sakura.ne.jp/wiki/index.php?title=Book:OTRS_3.0_-_Admin_Manual/Chapter_11/3"
Personal tools
Namespaces
Variants
Actions
Navigation
Toolbox