[rt-users] Configure RT for Intergration with Active Directory
Hello all. I'm working with a brand new Request Tracker 4.07 install on Debian 7.0.0 (Wheezy) and I have some very general questions about configuring Request Tracker for integration with Active Directory. I would like our Window clients to be able to access Request Tracker using the SSO functionality of Internet Explorer, have their Request Tracker accounts created and relevant details pulled from Active Directory's LDAP. The more seamless this is the better. I have a very basic high-level conceptual understanding of how this is all supposed to fit together but am a bit lost on the specifics. Please bear with me. If I understand this correctly I need to do three things: - Configure External Authentication for Request Tracker - Configure NTLM /SSO, either in Apache via mod_ntlm, mod_ntlm_winbind or mod_pam - Configure an LDAP overlay so that authenticated RT users get their information fields populated with the relevant data # External Authentication: http://requesttracker.wikia.com/wiki/ExternalAuthentication # There seem to be two common ways to do this - either use WebExternalAuth which pushes the authentication requirement to Apache or use the RT::Authen::ExternalAuth module and have RT do the authentication directly. Which one should I use? I kind of get the impression that RT::Authen::ExternalAuth is someone what out of date and that WebExternalAuth is the recommend way to handle authentication. Is this correct? What criteria should I use to make the determination between the two methods? # Configure NTLM /SSO, either in Apache via mod_ntlm, mod_ntlm_winbind, mod_kerb or mod_pam # This is really more a question about the RT ecosystem but presuming I'm using WebExternalAuth correctly I then need to use an Apache module so Apache can make the determination as to whether or not a client is authenticated. Lots of advice points to mod_ntlm, which as far as I can tell does *not* require Samba and can directly do the NTLM challenge/response. On the other hand it seems like people recommend the use of Samba's t ntml_auth helper as more up to date way to handle NTLM authentication. I imagine you could also use mod_kerb if you have Kerberos setup or mod_pam if Samba is functioning appropriately. Again, I'm not really sure what authentication I should have Apache2 attempt to do for my clients nor how to configure the SSO cookies. # LDAP Overlays - http://requesttracker.wikia.com/wiki/LdapSummary There's lots of information here but I can't pick out which stuff is relevant and up to date. The ExternalAuth plug again seems to be popular. The AutoCreateFromExternalUserInfo and AutoCreateAndCanonicalizeUserInfo Wiki page appear to do just what I want but are preferenced by warning saying that they're out of date. Where can I find the relevant documentation to pull information about Active Directory Users with LDAP and have it auto-populate their RT user's fields. Some assistance in finding the right documentation on how to accomplish Active Directory integration would be very helpful. Thanks. --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314 -- RT Training in Seattle, June 19-20: http://bestpractical.com/training
[rt-users] ExternalAuth - attr_map used to populate Custom Fields?
This is a simple question that I suspect probably has a complicated answer: Can I use the attr_map to map Active Directory attributes to Request Tracker for Custom Fields? I would like to pull in some additional attributes such as 'company' and 'title' and populate some Custom Fields that I created for Users. Any advice? --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314 -- RT Training in Seattle, June 19-20: http://bestpractical.com/training
[rt-users] Configure Role Rights Globally?
I have a new install of Request Tracker 4.0.7 and am working through the very granular Rights structure. I'm planning on implementing a number of queues, some of which will be managed by IT personnel in departments other than my own. I'm wondering how people configure their Role (AdminCC, Cc, Owner and Requestor) rights - specifically whether or not they configure them on a per-queue basis or globally? To me, it makes conceptual sense to configure Role rights globally because regardless of what queue someone is working in, Requestors will need ReplyToTicket and ShowTicket and so on for each Role. Is there any obvious drawback to this approach? It seems unnecessarily tedious to assign the same Rights to each Role for each Queue. I would appreciate the input from someone more experienced with Request Tracker. Thank you. --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314
Re: [rt-users] Configure Role Rights Globally?
> -Original Message- > From: rt-users-boun...@lists.bestpractical.com [mailto:rt-users- > boun...@lists.bestpractical.com] On Behalf Of Tim Wiley > Sent: Thursday, July 11, 2013 1:50 PM > To: rt-users@lists.bestpractical.com > Subject: Re: [rt-users] Configure Role Rights Globally? > > On 07/11/2013 02:42 PM, Elliott, Kevin C (DOR) wrote: > > I have a new install of Request Tracker 4.0.7 and am working through > > the very granular Rights structure. I'm planning on implementing a > > number of queues, some of which will be managed by IT personnel in > > departments other than my own. > > > > I'm wondering how people configure their Role (AdminCC, Cc, Owner and > > Requestor) rights - specifically whether or not they configure them on > > a per-queue basis or globally? To me, it makes conceptual sense to > > configure Role rights globally because regardless of what queue > > someone is working in, Requestors will need ReplyToTicket and > > ShowTicket and so on for each Role. Is there any obvious drawback to > > this approach? It seems unnecessarily tedious to assign the same > > Rights to each Role for each Queue. > > > > I would appreciate the input from someone more experienced with > > Request Tracker. > > > > Thank you. > > This is precisely how we do those roles. > > Requestor & Cc: > * ReplyToTicket > * ShowTicket > > AdminCc: > * CommentOnTicket > * ReplyToTicket > * ShowTicket > * ShowTicketComments > > As for owner, they'll already have rights in the queue by virtue of being a > worker in it. At least in my setup they do. It seems to work pretty well for > giving permissions to users that have a vested interest in a given ticket, but > not having specific permissions in the queue. Excellent. That makes sense. Do you handle Rights for the builtin Systems groups (Everyone, Unprivileged, Privileged) the same way? Again, it doesn't make sense to me to configure these on a queue by queue basis. --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314
[rt-users] "Bad name after cn'" when using LDAPImport
I'm using Request Tracker 4.0.7 with LDAPImport 0.34 and Authen::ExternalAuth 10-4. I already have user creation and attribute mapping configured with ExternalAuth. I'm primarily interested in using LDAPImport to populate a half dozen or so Public Groups in Request Tracker with users from Active Directory. The idea is that separate divisions can just add their staff to that Active Directory group and when LDAPImport runs they'll be granted the appropriate rights to manage their division's queue in Request Tracker. I'm pulling from an Active Directory LDAP implementation at a functional level of Windows Server 2008. When I do a test run (/usr/local/share/request-tracker4/plugins/RT-Extension-LDAPImport/bin/rtldapimport --debug > ldapimport.debug 2>&1) I get the following: Couldn't load RT config file RT_SiteConfig.pm: Bad name after cn' at /etc/request-tracker4/RT_SiteConfig.pm line 91. Compilation failed in require at /usr/share/request-tracker4/lib/RT/Config.pm line 905. BEGIN failed--compilation aborted at ./rtldapimport line 26. That corresponds with this line of my RT_SiteConfig.pm: Set($LDAPGroupMapping, { Name => 'cn', I've configured LDAPImport as follows: ## LDAP Import ## Set($LDAPHost, 'ldaps://dc.alaska.gov'); Set($LDAPUser, 'CN=dor-requesttracker,OU=Security Groups and Accounts,OU=IT,OU=Divisions,OU=DOR,OU=State Departments,DC=alaska,DC=gov'); Set($LDAPPassword ,'Password); Set($LDAPBase, 'ou=DOR,ou=State Departments,dc=alaska,dc=gov'); Set($LDAPGroupBase, 'OU=Security Groups and Accounts,OU=IT,OU=Divisions,OU=DOR,OU=State Departments,DC=alaska,DC=gov'); Set($LDAPGroupFilter, '(|(CN=dor-rt-admins)(CN=dor-rt-staff)); Set($LDAPGroupMapping, { Name => 'cn', Member_Attr => 'member', Member_Attr_Value => 'sAMAccountName', Description => 'description'}); Set($LDAPSizeLimit, 1000); I feel like I'm missing something real simple here. Can someone lend another set of eyes to this problem? Thanks! --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314
Re: [rt-users] "Bad name after cn'" when using LDAPImport
That was indeed the failing line. Thank you. > -Original Message- > From: rt-users-boun...@lists.bestpractical.com [mailto:rt-users- > boun...@lists.bestpractical.com] On Behalf Of Nathan Cutler > Sent: Sunday, August 04, 2013 11:53 PM > To: rt-users@lists.bestpractical.com > Subject: Re: [rt-users] "Bad name after cn'" when using LDAPImport > > > That corresponds with this line of my RT_SiteConfig.pm: > > Look one line above that -- you appear to be missing a closing apostrophe. > > > Set($LDAPGroupFilter, '(|(CN=dor-rt-admins)(CN=dor-rt-staff)); > > This is the offending line.
[rt-users] LDAPImport succeds with user LDAP bind but fails with group
Continuing onwards with my attempt to pull groups and their members from Active Directory into Request Tracker I've made some progress. However, I'm currently stymied - LDAPImport will successfully connect and search for users but when re-using the LDAP connection it fails to connect for the group search. Here's the debugging information from an rtldapimport run: Running test import, no data will be changed Rerun command with --import to perform the import Rerun command with --debug for more information connecting to ldap://domaincontroller.alaska.gov binding as CN=dor-requesttracker,OU=Security Groups and Accounts,OU=IT,OU=Divisions,OU=DOR,OU=State Departments,DC=soa,DC=alaska,DC=gov searching with: base => 'OU=Security Groups and Accounts,OU=IT,OU=Divisions,OU=DOR,OU=State Departments,DC=soa,DC=alaska,DC=gov' control => 'Net::LDAP::Control::Paged=HASH(0x524cd80)' filter => '(&(cn = users))' search found 0 objects No results found, no import Testing group import searching with: base => 'OU=Security Groups and Accounts,OU=IT,OU=Divisions,OU=DOR,OU=State Departments,DC=soa,DC=alaska,DC=gov' control => 'Net::LDAP::Control::Paged=HASH(0x86973b8)' filter => '(|(CN=dor-requesttracker-admins)(CN=dor-asd-rt-staff))' [Mon Aug 5 17:10:47 2013] [error]: LDAP search failed Can't contact LDAP server (/usr/local/share/request-tracker4/plugins/RT-Extension-LDAPImport/lib/RT/Extension/LDAPImport.pm:1237) LDAP search failed Can't contact LDAP server search found 0 objects No results found, no group import Finished test Looking at the perl for LDAPImport.pm shows me that the _run_search method is generating the "LDAP search failed" part of the debugging output. I'm assuming this means that Net::LDAP is generating the "Can't contact LDAP server" from $result->code. I feel this hypothesis is further supported by the fact that a 'grep "contact" LDAPImport.pm' turn up nothing. It looks like Net:LDAP just gets the base and filter and off it goes. I've confirmed that my filter works with ldapsearch. I there something different I need to do get a successful LDAP bind when looking performing the group import? --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314
Re: [rt-users] LDAPImport succeds with user LDAP bind but fails with group
Ah! That's it. I forgot to change and test the filter ($LDAPFilter) used for the User import - not enough coffee this morning, I guess. The example used in the documentation is not applicable to Active Directory. Changing it from '(&(cn = users))' to '(&(objectclass=person)(!(objectclass=computer)))' allowed the User import to run successfully followed by the Group Import. Thanks all! > -Original Message- > From: rt-users-boun...@lists.bestpractical.com [mailto:rt-users- > boun...@lists.bestpractical.com] On Behalf Of Nathan Cutler > Sent: Monday, August 05, 2013 10:20 AM > To: rt-users@lists.bestpractical.com > Subject: Re: [rt-users] LDAPImport succeds with user LDAP bind but fails with > group > > Hi Kevin, > > > I’ve confirmed > > that my filter works with ldapsearch. > > Can you send the working ldapsearch command? Seems suspicious to me > that the initial search for the user comes up empty.
Re: [rt-users] A few general questions
> 1. How do you setup the "manager" account? Basically one that can delegate > tickets to others, but still have it to where we can take ownership without > their intervention if needed. Try configuring a global group called Staff (or something similar) and then assigning it global rights. This would represent your cross-queue staff members such as your IT staff who need these rights in any queue. Then you could create a group (e.g., $QUEUE-Staff) and then assign them appropriate rights to their queue. In a situation where you have many queues (Building Maintenance, Help Desk, Change Requests, etc), members of your global group would have rights to all of those queues and could act as queue independent staff. Members of the $QUEUE-Staff groups would have rights specific to their queue and would function in a similar manner. Just be aware that if you follow this scheme and you need to restrict the rights of the Staff group, you'll have to go back in after the fact and assign it per-queue rights. > 2. Is there an easy way to get statistics of number of tickets worked by each > individual staff member You should be able to look at charts in the search functionality. 3. Is there a good place to read up on the various > permissions and such I would need to set to allow my staff and I to do stuff. > I > have found hit and miss documentation in the wikia but nothing all inclusive. Try reading the http://requesttracker.wikia.com/wiki/RightsQuickStart and the http://requesttracker.wikia.com/wiki/Group Wikis. Other than that, if your RT instance is in a virtualized environment - I'd recommend taking a snapshot and just playing around with Rights and Groups until you get a good feel for it and then just roll back when you're done.
[rt-users] Can't load UntouchedInHours module
I'm working with Request Tracker 4.0.7 on Debian Wheezy 7.0.1 and am attempting to configure rt-crontool and UntouchedInHours.pm as presented on the Wiki (http://requesttracker.wikia.com/wiki/UntouchedInHours) I'm running the following rt-crontool command: /usr/bin/rt-crontool \ --search RT::Search::FromSQL \ --search-arg "Queue = '1' AND (Status = 'new' OR Status = 'open' ) AND Owner != 'Nobody'" \ --condition RT::Condition::UntouchedInHours --condition-arg 4 \ --action RT::Action::SendEmail \ --template "Custom - Untouched Ticket Notification" \ --transaction 'last' \ --transaction-type 'Correspond,Comment,Status' \ --verbose echo "" Which returns the following result: [Thu Aug 29 17:32:17 2013] [critical]: Failed to load module RT::Condition::UntouchedInHours. () at /usr/bin/rt-crontool line 307. (/usr/share/request-tracker4/lib/RT.pm:351) Failed to load module RT::Condition::UntouchedInHours. () at /usr/bin/rt-crontool line 307. I'm taking that to mean that there is a programming pub in UntouchedInHours.pm that is preventing it from being called correctly but for the life of me I can't seem to find it anywhere. It was copied verbatim from the Wiki: root@DorJnuASD-RT:~/Bin# cat /usr/share/request-tracker4/lib/RT/Condition/UntouchedInHours.pm package RT::Condition::UntouchedInHours; require RT::Condition::Generic; use RT::Date; @ISA = qw(RT::Condition::Generic); use strict; use vars qw/@ISA/; sub IsApplicable { my $self = shift; if ((time()-$self->TicketObj->LastUpdatedObj->Unix)/3600 >= $self->Argument) { return 1; } else { return 0; } } # The following could be omitted. They're there to allow overrides from Vendor and Local # but as this isn't a core module, they're just there for completeness :) eval "require RT::Condition::UntouchedInHours_Vendor"; die $@ if ($@ && $@ !~ qr{^Can't locate RT/Condition/UntouchedInHours_Vendor.pm}); eval "require RT::Condition::UntouchedInHours_Local"; die $@ if ($@ && $@ !~ qr{^Can't locate RT/Condition/UntouchedInHours_Local.pm}); 1; The permissions look appropriate as well: root@DorJnuASD-RT:~/Bin# ls -la /usr/share/request-tracker4/lib/RT/Condition/ total 60 drwxr-xr-x 2 root root 4096 Aug 29 09:24 . drwxr-xr-x 17 root root 4096 Jun 11 11:27 .. -rw-r--r-- 1 root root 2247 May 22 09:49 AnyTransaction.pm -rw-r--r-- 1 root root 2742 May 22 09:49 BeforeDue.pm -rw-r--r-- 1 root root 2677 May 22 09:49 CloseTicket.pm -rw-r--r-- 1 root root 2475 May 22 09:49 Overdue.pm -rw-r--r-- 1 root root 2351 May 22 09:49 OwnerChange.pm -rw-r--r-- 1 root root 2356 May 22 09:49 PriorityChange.pm -rw-r--r-- 1 root root 2325 May 22 09:49 PriorityExceeds.pm -rw-r--r-- 1 root root 2306 May 22 09:49 QueueChange.pm lrwxrwxrwx 1 root root9 Aug 29 08:37 RCS -> /root/RCS -rw-r--r-- 1 root root 2829 May 22 09:49 ReopenTicket.pm -rw-r--r-- 1 root root 4593 May 22 09:49 StatusChange.pm -rw-r--r-- 1 root root 800 Aug 29 09:23 UntouchedInHours.pm -rw-r--r-- 1 root root 2458 May 22 09:49 UserDefined.pm Any idea what I'm missing here? Thanks. --- Kevin Elliott Networking Specialist II Alaska Department of Revenue, ASD-IT (907) 465-2314
Re: [rt-users] Can't load UntouchedInHours module
That was indeed the issue. Thanks. > -Original Message- > From: rt-users-boun...@lists.bestpractical.com [mailto:rt-users- > boun...@lists.bestpractical.com] On Behalf Of Kevin Falcone > Sent: Thursday, August 29, 2013 12:35 PM > To: rt-users@lists.bestpractical.com > Subject: Re: [rt-users] Can't load UntouchedInHours module > > On Thu, Aug 29, 2013 at 05:39:33PM +, Elliott, Kevin C (DOR) wrote: > > > > [Thu Aug 29 17:32:17 2013] [critical]: Failed to load module > > RT::Condition::UntouchedInHours. () at /usr/bin/rt-crontool line 307. > > (/usr/share/request-tracker4/lib/RT.pm:351) > > Failed to load module RT::Condition::UntouchedInHours. () at /usr/bin/rt- > crontool line 307. > > > > root@DorJnuASD-RT:~/Bin# cat /usr/share/request- > tracker4/lib/RT/Condition/UntouchedInHours.pm > > > > package RT::Condition::UntouchedInHours; require > > RT::Condition::Generic; > > > > use RT::Date; > > > > > > @ISA = qw(RT::Condition::Generic); > > At the very least, this line is wrong: > http://bestpractical.com/docs/rt/latest/UPGRADING-4.0.html#Removals- > and-updates > > You want to inherit from RT::Condition. > > -kevin > > > use strict; > > use vars qw/@ISA/; > > > > sub IsApplicable { > > my $self = shift; > > > > if ((time()-$self->TicketObj->LastUpdatedObj->Unix)/3600 >= > $self->Argument) { > > return 1; > > } > > else { > > return 0; > > } > > > > } > > > > # The following could be omitted. They're there to allow overrides > > from Vendor and Local # but as this isn't a core module, they're just > > there for completeness :) eval "require > > RT::Condition::UntouchedInHours_Vendor"; > > die $@ if ($@ && $@ !~ qr{^Can't locate > > RT/Condition/UntouchedInHours_Vendor.pm}); > > eval "require RT::Condition::UntouchedInHours_Local"; > > die $@ if ($@ && $@ !~ qr{^Can't locate > > RT/Condition/UntouchedInHours_Local.pm}); > > > > 1;
Re: [rt-users] Can't load UntouchedInHours module
Good call. I've moved it over to /usr/local/share/request-tracker. > -Original Message- > From: Dominic Hargreaves [mailto:dominic.hargrea...@it.ox.ac.uk] > Sent: Friday, August 30, 2013 1:17 AM > To: Elliott, Kevin C (DOR) > Cc: rt-users@lists.bestpractical.com > Subject: Re: [rt-users] Can't load UntouchedInHours module > > On Thu, Aug 29, 2013 at 05:39:33PM +, Elliott, Kevin C (DOR) wrote: > > > root@DorJnuASD-RT:~/Bin# ls -la > > /usr/share/request-tracker4/lib/RT/Condition/ > > total 60 > > drwxr-xr-x 2 root root 4096 Aug 29 09:24 . > > drwxr-xr-x 17 root root 4096 Jun 11 11:27 .. > > -rw-r--r-- 1 root root 2247 May 22 09:49 AnyTransaction.pm > > -rw-r--r-- 1 root root 2742 May 22 09:49 BeforeDue.pm > > -rw-r--r-- 1 root root 2677 May 22 09:49 CloseTicket.pm > > -rw-r--r-- 1 root root 2475 May 22 09:49 Overdue.pm > > -rw-r--r-- 1 root root 2351 May 22 09:49 OwnerChange.pm > > -rw-r--r-- 1 root root 2356 May 22 09:49 PriorityChange.pm > > -rw-r--r-- 1 root root 2325 May 22 09:49 PriorityExceeds.pm > > -rw-r--r-- 1 root root 2306 May 22 09:49 QueueChange.pm > > lrwxrwxrwx 1 root root9 Aug 29 08:37 RCS -> /root/RCS > > -rw-r--r-- 1 root root 2829 May 22 09:49 ReopenTicket.pm > > -rw-r--r-- 1 root root 4593 May 22 09:49 StatusChange.pm > > -rw-r--r-- 1 root root 800 Aug 29 09:23 UntouchedInHours.pm > > -rw-r--r-- 1 root root 2458 May 22 09:49 UserDefined.pm > > Hi, > > Probably not related to your problem, but I really recommend not putting > locally installed files in /usr/share as that space is reserved for the > package > manager (dpkg) and you could end up with overwritten files there (plus it's > difficult to see what came from where). > > /usr/local/share/request-tracker4/lib exists for this purpose so you could > move that file into /usr/local/share/request-tracker4/lib/RT/Condition/ > > Cheers, > Dominic. > > -- > Dominic Hargreaves, Systems Development and Support Section IT Services, > University of Oxford, 13 Banbury Road, Oxford, OX2 6NN
Re: [rt-users] RT as a service
I believe BestPractical offers Request Tracker managed hosting (http://bestpractical.com/services/hosting.html). > -Original Message- > From: rt-users-boun...@lists.bestpractical.com [mailto:rt-users- > boun...@lists.bestpractical.com] On Behalf Of Roy > Sent: Tuesday, September 17, 2013 8:50 AM > To: rt-users@lists.bestpractical.com > Subject: [rt-users] RT as a service > > Hi, > > I am just wondering if anyone know of any service provider that offer RT > as a service under shared environment or similar. A friend of mine has a > very small company , with very low budget and looking for ticketing > solution. > UK based preferably > > Roy > > > > -- > RT Training in New York, October 8th and 9th: > http://bestpractical.com/training -- RT Training in New York, October 8th and 9th: http://bestpractical.com/training