[rt-users] rt 3.8.1 graph not working

2008-12-05 Thread Natxo Asenjo
hi,

I have a clean test installation of rt 3.8.1 and it looks great.
Thanks for all the hard work!

This is a kvm virtual machine with debian testing. Most of the perl
modules are from cpan, not from debian repos. I use the make fixdeps
option.

When I click on a ticket on the grap link, I get this ugly perl error page:

Error during compilation of
/opt/rt3/share/html/Ticket/Graphs/index.html: Attempt to reload
RT/Graph/Tickets.pm aborted. Compilation failed in require at
/opt/rt3/share/html/Ticket/Graphs/index.html line 78. Stack:
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:811]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:441]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:246]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:211]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:97]
[/opt/rt3/bin/../lib/RT/Interface/Web/Request.pm:68]
[/usr/local/share/perl/5.10.0/Class/Container.pm:275]
[/usr/local/share/perl/5.10.0/Class/Container.pm:353]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:348]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:868]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:822]
[/opt/rt3/bin/webmux.pl:148]
[/opt/rt3/share/html/Ticket/Graphs/index.html:78] BEGIN
failed--compilation aborted at
/opt/rt3/share/html/Ticket/Graphs/index.html line 78. Stack:
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:811]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:441]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:246]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:211]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:97]
[/opt/rt3/bin/../lib/RT/Interface/Web/Request.pm:68]
[/usr/local/share/perl/5.10.0/Class/Container.pm:275]
[/usr/local/share/perl/5.10.0/Class/Container.pm:353]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:348]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:868]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:822]
[/opt/rt3/bin/webmux.pl:148]
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]

I installed graphviz because I was seeing this syslog:
Dec  4 17:14:33  RT: You've enabled GraphViz, but we couldn't load the
module: Can't locate GraphViz.pm in @INC (@INC contains:
/root/rt-3.8.1/sbin/../local/lib /root/rt-3.8.1/sbin/../lib /etc/perl
/usr/local/lib/perl/5.10.0 /usr/local/share/perl/5.10.0 /usr/lib/perl5
/usr/share/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10
/usr/local/lib/site_perl .) at /root/rt-3.8.1/sbin/../lib/RT/Config.pm
line 249.

# perl -MCPAN -e 'install GraphViz'
CPAN: Storable loaded ok (v2.18)
Going to read /root/.cpan/Metadata
  Database was generated on Fri, 05 Dec 2008 03:27:20 GMT
CPAN: YAML loaded ok (v0.67)
Going to read 148 yaml files from /root/.cpan/build/
CPAN: Time::HiRes loaded ok (v1.9711)
DONE
Restored the state of 148 (in 1.2082 secs)
GraphViz is up to date (2.03).

Any clues?

-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: [EMAIL PROTECTED]


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] rt 3.8.1 graph not working

2008-12-06 Thread Natxo Asenjo
hi,

I have a clean test installation of rt 3.8.1 and it looks great.
Thanks for all the hard work!

This is a kvm virtual machine with debian testing. Most of the perl
modules are from cpan, not from debian repos. I use the make fixdeps
option.

When I click on a ticket on the grap link, I get this ugly perl error page:

Error during compilation of
/opt/rt3/share/html/Ticket/Graphs/index.html: Attempt to reload
RT/Graph/Tickets.pm aborted. Compilation failed in require at
/opt/rt3/share/html/Ticket/Graphs/index.html line 78. Stack:
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:811]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:441]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:246]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:211]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:97]
[/opt/rt3/bin/../lib/RT/Interface/Web/Request.pm:68]
[/usr/local/share/perl/5.10.0/Class/Container.pm:275]
[/usr/local/share/perl/5.10.0/Class/Container.pm:353]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:348]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:868]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:822]
[/opt/rt3/bin/webmux.pl:148]
[/opt/rt3/share/html/Ticket/Graphs/index.html:78] BEGIN
failed--compilation aborted at
/opt/rt3/share/html/Ticket/Graphs/index.html line 78. Stack:
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:811]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:441]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:246]
[/usr/local/share/perl/5.10.0/HTML/Mason/Request.pm:211]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:97]
[/opt/rt3/bin/../lib/RT/Interface/Web/Request.pm:68]
[/usr/local/share/perl/5.10.0/Class/Container.pm:275]
[/usr/local/share/perl/5.10.0/Class/Container.pm:353]
[/usr/local/share/perl/5.10.0/HTML/Mason/Interp.pm:348]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:868]
[/usr/local/share/perl/5.10.0/HTML/Mason/ApacheHandler.pm:822]
[/opt/rt3/bin/webmux.pl:148]
[/opt/rt3/share/html/Ticket/Graphs/index.html:78]

I installed graphviz because I was seeing this syslog:
Dec  4 17:14:33  RT: You've enabled GraphViz, but we couldn't load the
module: Can't locate GraphViz.pm in @INC (@INC contains:
/root/rt-3.8.1/sbin/../local/lib /root/rt-3.8.1/sbin/../lib /etc/perl
/usr/local/lib/perl/5.10.0 /usr/local/share/perl/5.10.0 /usr/lib/perl5
/usr/share/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10
/usr/local/lib/site_perl .) at /root/rt-3.8.1/sbin/../lib/RT/Config.pm
line 249.

# perl -MCPAN -e 'install GraphViz'
CPAN: Storable loaded ok (v2.18)
Going to read /root/.cpan/Metadata
 Database was generated on Fri, 05 Dec 2008 03:27:20 GMT
CPAN: YAML loaded ok (v0.67)
Going to read 148 yaml files from /root/.cpan/build/
CPAN: Time::HiRes loaded ok (v1.9711)
...DONE
Restored the state of 148 (in 1.2082 secs)
GraphViz is up to date (2.03).

Any clues?
-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: [EMAIL PROTECTED]


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] rt 3.8.1 graph not working

2008-12-06 Thread Natxo Asenjo
On Sat, Dec 6, 2008 at 4:48 PM, Ruslan Zakirov <[EMAIL PROTECTED]> wrote:
> stop/start your web server

that did not solve the problem yesterday. It doesn't solve it today
either. I rebooted the vm; removed the mason cache. Any other ideas?

It is not critical either. Is there a way to disable the graphing
abilitiy all together in RT_StieConfig.pm ?

natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: [EMAIL PROTECTED]


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] clickable link in custom field

2009-07-01 Thread Natxo Asenjo
hi,

is it possible to have a link to a url outside RT without __id__ or
without __ __CustomField__ in a custom field?

If i edit a custom field (CF) I see there is a field 'Link values'. I
thought I could use that, but as I can see it is for use with __id__
or __CustomField__.

Let me explain why I would like this. I am testing the AssetTracker
extension, and as you probably know, lots of devices have a management
web interface (like switches, printers, etc). I would like to have a
clickable CF that would take me to get there from one of the CF. I
know I can do it from one of the 'links' but they have names as
'depends on', 'refers to' , and those are reserverd for other
things inside RT.

Maybe this is just a silly question but I do not see how to do it from the CF.
-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] clickable link in custom field

2009-07-02 Thread Natxo Asenjo
On Thu, Jul 2, 2009 at 9:37 AM, Christian Loos wrote:
> Natxo Asenjo schrieb:

[knip explanation of what I would like to achieve]

> If you have example.com in the custom field and want to have a link like:
> http://example.com/webinterface/
>
> you have to put this in Link values to field:
> http://__CustomField__/webinterface/

So, I make a CF management_url. Name and description are
management_url, type is 'enter one value', applies to 'assets', no
validation, Link values is then __CustomField__ and I apply it to the
selected objects.

What I want is in to enter in the CF a url that can be clickable, like
http://ip.addres.of.switch

If I then go to the asset and enter in the CF management_url the value
http://ip.addr.of.switch then it is not clickable. If I enter
http://__CustomField__ then it does make a link but it links to
http://rtinstance.tld/AssetTracker/Asset/http%3A%2F%2F__CustomField__
and that goes nowhere obviously.

Forgive my asking, maybe it is too hot and I do not see the obvious
mistake in front of me. What am I doing wrong here?

TIA,

Natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] clickable link in custom field

2009-07-02 Thread Natxo Asenjo
ok, it works now :-)

in the link of the CF I fill this in: http://__CustomField__ and it works.

Another question: how can I enter a port in the link? Like
http://ip.add.of.device:9100 for a jetdirect printer, for instance. If
I enter in the CF hostname:9100 then it takes me to this url (in
another tab! great stuff): http://hostname%3a9100/ and then it does
not work. I suppose it has to do with html encoding, but do not know
how to fix this. Any clues?

TIA,

Natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] DashBoard create rights

2009-07-02 Thread Natxo Asenjo
On Thu, Jul 2, 2009 at 1:26 PM, Potla, Ashish
Bassaliel wrote:
> Hi,
> I am trying to configure Dashboards to all the users in my system.
>
> How do I assign the global right : CreateDashboard to all?

login as root of rt and create a systemwide dashboard: tools,
dashboards, new and in privacy, choose rt system's dashboard.

natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] DashBoard create rights

2009-07-02 Thread Natxo Asenjo
oops, I misread the question, disregard my answer
-- 
natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] import ldap users in RT with RT::Authen::ExternalAuth

2009-07-03 Thread Natxo Asenjo
hi,

yesterday I got RT::Authen::ExternalAuth working (v.0.0.8 I think, the
latest) with rt 3.8.4 and an openldap server. All according to the
README and wiki instructions, thanks for the great extension.

I was wondering if there is a way to import the users from the ldap
server into the rt database before they log in.

--
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] import ldap users in RT with RT::Authen::ExternalAuth

2009-07-03 Thread Natxo Asenjo
hi,

I found this:

http://www.cpan.org/modules/by-module/RT/RT-Extension-LDAPImport-0.06.tar.gz

and installed it according to the instructions in the README. My RT
installation is also vanilla 3.8.3, so everything is in /opt/rt3

The settings in RT_SiteConfig.pm are:

Set($LDAPHost,'host.domain.tld');
Set($LDAPUser, 'cn=user,dc=domain,dc=tld');
Set($LDAPPassword, 'password');
Set($LDAPBase, 'ou=users,dc=domain,dc=tld');
Set($LDAPFilter, 'cn = *');
Set($LDAPMapping, {Name => 'uid',
EmailAddress => 'mail',
RealName => 'cn',
WorkPhone=> 'telephoneNumber',
Organization => 'departmentName'});


Set($LDAPGroupName,'Imported Users');
Set($LDAPUpdateUsers,1);

The first run wasn't very sucessful:

Can't locate RT/Extension/LDAPImport.pm in @INC (@INC contains:
/opt/rt3/local/lib /opt/rt3/lib /etc/perl /usr/local/lib/perl/5.10.0
/usr/local/share/perl/5.10.0 /usr/lib/perl5 /usr/share/perl5
/usr/lib/perl/5.10 /usr/share/perl/5.10 /usr/local/lib/site_perl .) at
./rtldapimport line 13.

I had to add this path to rtldapimport because it would not find a module:

### after: use lib qw(@RT_LIB_PATH@);
use lib qw(/opt/rt3/local/lib /opt/rt3/lib
/opt/rt3/local/plugins/RT-Extension-LDAPImport/lib);

After that it runs

host:/opt/rt3/local/plugins/RT-Extension-LDAPImport/bin# ./rtldapimport --debug
Starting import
connecting to host.domain.tld
binding as cn=user,dc=domain,dc=tld
searching with base => 'ou=users,dc=domain,dc=tld' filter => 'cn = *'
search found 0 users
No results found, no import
Finished import

But it is incorrect, there are 16 objects in that container:

$ ldapsearch -x -b "ou=users,dc=domain,dc=tld" -h host.domain.tld "(cn=*)" cn
(lots of output with user dn and cn)
# numResponses: 17
# numEntries: 16

Am I doing something wrong? maybe the ldap filter in RT_SiteConfig.pm?
-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] import ldap users in RT with RT::Authen::ExternalAuth

2009-07-03 Thread Natxo Asenjo
On Fri, Jul 3, 2009 at 9:51 PM, Gary Greene wrote:
> On 7/3/09 11:30 AM, "Natxo Asenjo"  wrote:

>> The settings in RT_SiteConfig.pm are:
>>
>> Set($LDAPHost,'host.domain.tld');
>> Set($LDAPUser, 'cn=user,dc=domain,dc=tld');
>> Set($LDAPPassword, 'password');
>> Set($LDAPBase, 'ou=users,dc=domain,dc=tld');
>> Set($LDAPFilter, 'cn = *');
>> Set($LDAPMapping, {Name         => 'uid',
>>                     EmailAddress => 'mail',
>>                     RealName     => 'cn',
>>                     WorkPhone    => 'telephoneNumber',
>>                     Organization => 'departmentName'});

[knip]

> Your filter is incomplete. Are you using AD or OpenLDAP?

openldap. So any tips about how the filter should look like?

TIA,

Natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] import ldap users in RT with RT::Authen::ExternalAuth

2009-07-03 Thread Natxo Asenjo
On Fri, Jul 3, 2009 at 10:43 PM, Gary Greene wrote:
> On 7/3/09 1:15 PM, "Natxo Asenjo"  wrote:

[knip]

>>> Your filter is incomplete. Are you using AD or OpenLDAP?
>>
>> openldap. So any tips about how the filter should look like?
>>

> You'll likely want to do something like this:
>
> (&(objectClass = person)(uid = *))

that did the trick. Thanks!
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] devel list AssetTracker

2009-07-04 Thread Natxo Asenjo
hi,

My apologies for posting here, but I in the assettracker some things
remain unanswered (see
http://code.google.com/p/asset-tracker-4rt/wiki/FeatureRequestPage )
Is there a devel mailing list for asset tracker? Are there enough
people with an interest in such a list?

RT is the best helpdesk software out there, but I see lots of places
where the lack of some feautures (like tracking assets)  get RT out
the door. This is a shame. At work I am now stuck with topdesk because
of this, and every time I have to use that piece of sh*t I nearly cry
when I think at how good and fast RT is. That is why I would like to
change this, I am no perl guru (far from that) but am willing to learn
and contribute in my own time. Are there any other people interested
in further improving assettracker?

-- 
Groeten,
Natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] Apache won't start after upgrade to 3.8.4

2009-07-07 Thread Natxo Asenjo
hi,

did you follow the instructions in UPGRADING.mysql ?
-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] AT 1.2.4b1 with RT 3.8.4 install fails Can't locate object method "ACLEquivalenceObjects" via package "RTx::AssetTracker::System"

2009-09-03 Thread Natxo Asenjo
hi,
I have been documenting my findings with AT and this problem is solved like
this:

Creating types...[Tue Jul 21 19:51:34 2009] [crit]: Can't locate object
method
"ACLEquivalenceObjects" via package "RTx::AssetTracker::System" at
/opt/rt3/lib/RT/Principal_Overlay.pm line 327,  line 78.
(/opt/rt3/lib/RT.pm:377)
Can't locate object method "ACLEquivalenceObjects" via package
"RTx::AssetTracker::System" at /opt/rt3/lib/RT/Principal_Overlay.pm line
327,
 line 78.
make: *** [initdb] Error 255

What we need is to edit this file:
/opt/rt3/local/lib/RTx/AssetTracker/System.pm

replace /opt/rt3/local/ with your path for rt-local during the configure
step.

Add at the end of the file, but right before the last line that only has '1'
in it, this line:

sub ACLEquivalenceObjects { return () };

-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] AT 1.2.4b1 with RT 3.8.4 install fails Can't locate

2009-09-19 Thread Natxo Asenjo
On Fri, Sep 18, 2009 at 11:53 PM, Susan McClure  wrote:

> Hi,
> I am finally back to working on this... but I am now trying to install AT
> 1.2.4b1 on
> RT 3.8.5 on a RHE Linux system.  I am still having the failure, after
> modifying
> the  /opt/rt3/local/lib/RTx/AssetTracker/System.pm file as suggested.  I
> still fail.
> Do you have any other suggestions, esp. with 3.8.5 ?
>
> I modified it after the "make" and before the "make install" but still fail
> with
> similar error:
>

[knip]


> [Fri Sep 18 21:43:31 2009] [crit]: Can't locate object method
> "ACLEquivalenceObjects" via package "RTx::AssetTracker::System" at
> /opt/rt3/lib/RT/Principal_Overlay.pm line 327,  line 323.
> (/opt/rt3/local/lib/RT.pm:377)
>
>> Can't locate object method "ACLEquivalenceObjects" via package
>> "RTx::AssetTracker::System" at /opt/rt3/lib/RT/Principal_Overlay.pm line
>> 327,  line 323.
>> Creating types...make: *** [initdb] Error 255
>>
>
ok, I'm sorry, I guess I was not specific enough. You do not need to re-make
the installation of AT, you are done with it once you saw the error. What
you need to do is just modify the System.pm file and add the new subroutine.

I have here a installation instruction for debian lenny and RT 3.8.4 (but it
is a source installation, so it should be not very different in RH):
http://test.asenjo.nl/index.php/Installation_on_debian_lenny#Installation_Asset_Tracker

I plan to document the installation for centos, when I get some free time
(now it is very busy professional and personally).

Let me know if it works!

Natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] RT Asset Tracker?

2008-04-24 Thread Natxo Asenjo
On Thu, Apr 24, 2008 at 6:34 PM, Torsten Brumm
<[EMAIL PROTECTED]> wrote:
> it works under rt 3.6.5 like a charm ;-)

is it production ready or beta?

-- 
Groeten,
J.Asenjo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: [EMAIL PROTECTED]


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] A few small changes I'd like to make to our RT....

2009-10-22 Thread Natxo Asenjo
On Fri, Oct 23, 2009 at 12:36 AM, Gary Greene
wrote:

> On 10/22/09 3:04 PM, "Jerrad Pierce" 
> wrote:
> >> The thing here is that the interface is presenting far too much
> information
> >> for my users (both admin and self service UIs), thus why I'm trying to
> > I'd recommend just getting used to it.
>
> If I had to "just get used to it" as you put it, we'd never move over to
> using RT. The corporate culture here is very non-forgiving of IT if we
> don't
> give them exactly what they want. Thankfully, I've managed to do everything
> I want with only a couple of small items left on my plate for testing with
> more users here.
>

Bestpractical has consultants that can help you streamline your RT
installation to your users' wishes:
http://bestpractical.com/services/development.html

I mean, it's open source, but it does not have to cost zero, does it? Other
solutions cost a lot and you don't even get the chance to change the
functionality.

That is the typical solution for other software solution in environments
like yours anyway, I am surprised I even have to point it to you :-)

-- 
Natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] Painless way to install Asset tracker to RT 3.8

2010-02-04 Thread Natxo Asenjo
On Tue, Feb 2, 2010 at 11:27 PM, Michael Neuschafer
 wrote:
> Does anybody have good instructions on how to install Asset tracker on an RT
> 3.8?

this has worked for me:

http://test.asenjo.nl/index.php/Installation_on_debian_lenny

--
natxo
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com

2010 RT Training Sessions!
San Francisco, CA, USA - Feb 22 & 23
Dublin, Ireland - Mar 15 & 16
Boston, MA, USA - April 5 & 6
Washington DC, USA - Oct 25 & 26

Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] Help on discouraging migration to Remedy

2011-01-17 Thread Natxo Asenjo
On Wed, Jan 12, 2011 at 10:51 PM, Dennis  wrote:
> On Wed, Jan 12, 2011 at 3:49 AM, Guadagnino Cristiano
>  wrote:
>> Hi all,
>
> Hi,
>
> What are the reasons they want to move to Remedy, are there certain
> requirements or integrations with other software that would be too
> difficult to implement otherwise with RT?

probably because of the asset management capabilities? I've seen this
happen with another solution, topdesk (quite popular in NL).

No, asset tracker does not cut it here.

As much as I like RT, without a good asset tracking integration it
will lose lots of market in the smb segment.

-- 
natxo


Re: [rt-users] RT is no longer sending Auto Replies On-Create

2011-06-28 Thread Natxo Asenjo
On Tue, Jun 28, 2011 at 1:24 AM, Alberto Vazquez  wrote:
> OK ... I am about to ready to "throw in the towel"    I am not sure how
> all of this is suppose to work.  I aware that RT somehow use dovecot,
> sendmail and postfix.  Nothing has changed on the Exchange side, so I am not
> sure why I am getting the "Client does not have permissions to send as this
> sender (in reply to end of DATA command))" error.

> I have modified everything (I think) and I am still missing something, since
> RT still fails to send emails out.  Here are some logs.
>
> Thanks for all of your help.


> Jun 27 16:15:20 usch-apps-p056 postfix/smtp[2056]: 3681CC0516:
> to=, relay=mail.proiris.com[10.1.128.117]:25,
> delay=0.07, delays=0.04/0.01/0.01/0, dsn=5.7.1, status=bounced (host
> mail.proiris.com[10.1.128.117] said: 550 5.7.1 Client does not have
> permissions to send as this sender (in reply to MAIL FROM command))
> Jun 27 16:15:20 usch-apps-p056 postfix/cleanup[2054]: 4A944C0518:

there is your problem. The smtp server mail.proiris.com does not allow
your rt smtp server to relay e-mail.

This is no rt problem, get in touch with your e-mail admin and ask him
to help you fix this problem.

-- 
natxo


2011 Training: http://bestpractical.com/services/training.html

[rt-users] perlbrew/cpanm installation on centos 6

2012-06-08 Thread Natxo Asenjo
hi,

In a test environment I have installed rt 4.0.6 with a local Perl (5.14.2)
from perlbrew. Installing the dependencies with cpanm was a breeze, I must
say, impressive.

My problem is how to get this rt which starts perfectly from
/opt/rt4/sbin/rt-server running with apache2 on centos6. If I install
mod_perl, rt4 will not start because it tries to use the system Perl, and
that will not work because of all the missing dependencies.

If I try mod_fastcgi with the configuration on the web_deployment.pod I get
errors (selinux is disabled):

(13)Permission denied: FastCGI: failed to connect to server
"/opt/rt4/sbin/rt-server.fcgi":

Right now I got it working from a reverse proxy with mod_proxy starting the
webserver on port 8000 with Starman.

I get warnings:
[Fri Jun  8 14:10:59 2012] [warning]: The actual HTTP_HOST (127.0.0.1) does
NOT match the configured WebDomain (host.domain.tld). Perhaps you should
Set($WebDomain, '127.0.0.1'); in RT_SiteConfig.pm, otherwise your internal
links may be broken. (/opt/rt4/sbin/../lib/RT/Interface/Web.pm:1098)

The mod_proxy way looks promissing, but is it a correct way? Is anyone else
running rt from a non system Perl and apache2 in rhel/centos?

--
Groeten,
natxo


Re: [rt-users] perlbrew/cpanm installation on centos 6

2012-06-08 Thread Natxo Asenjo
On Fri, Jun 8, 2012 at 5:34 PM, Thomas Sibley  wrote:

>
> On 06/08/2012 10:20 AM, Natxo Asenjo wrote:
> > If I try mod_fastcgi with the configuration on the web_deployment.pod I
> > get errors (selinux is disabled):
> >
> > (13)Permission denied: FastCGI: failed to connect to server
> > "/opt/rt4/sbin/rt-server.fcgi":
>
> So, did you try to fix the permissions?  I suspect it's as simple as the
> user apache is running as can't read/execute rt-server.fcgi and the
> whole directory tree above it.  You may need to change the group on files.
>
> To do that easily, re-run ./configure from the source tarball with the
> appropriate --with-web-user and/or --with-web-group options and then run
> make install again.  You can find your original configure options at the
> top of /opt/rt4/etc/RT_Config.pm.
>

these are the permissions in /opt/rt4/sbin:

 ls -l /opt/rt4/sbin/
total 216
-rwxr-xr-x. 1 root apache  3690 Jun  8 21:11 rt-attributes-viewer
-rwxr-xr-x. 1 root apache  5511 Jun  8 21:11 rt-clean-sessions
-rwxr-xr-x. 1 root apache  7816 Jun  8 21:11 rt-dump-metadata
-rwxr-xr-x. 1 root apache  4966 Jun  8 21:11 rt-email-dashboards
-rwxr-xr-x. 1 root apache 11886 Jun  8 21:11 rt-email-digest
-rwxr-xr-x. 1 root apache 13054 Jun  8 21:11 rt-email-group-admin
-rwxr-xr-x. 1 root apache 11797 Jun  8 21:11 rt-fulltext-indexer
-rwxr-xr-x. 1 root apache  4664 Jun  8 21:11 rt-preferences-viewer
-rwxr-xr-x. 1 root apache  8032 Jun  8 21:11 rt-server
-rwxr-xr-x. 1 root apache  8032 Jun  8 21:11 rt-server.fcgi
-rwxr-xr-x. 1 root apache  3684 Jun  8 21:11 rt-session-viewer
-rwxr-xr-x. 1 root apache 17612 Jun  8 21:11 rt-setup-database
-rwxr-xr-x. 1 root apache 20761 Jun  8 21:11 rt-setup-fulltext-index
-rwxr-xr-x. 1 root apache  8439 Jun  8 21:11 rt-shredder
-rwxr-xr-x. 1 root apache 15790 Jun  8 21:11 rt-test-dependencies
-rwxr-xr-x. 1 root apache 38439 Jun  8 21:11 rt-validator
-rwxr-xr-x. 1 root apache  8032 Jun  8 21:11 standalone_httpd

This is my ./configure incantation:

#   $ ./configure --with-db-type=Pg --with-db-host=host.domain.tld
--with-db-rt-pass=password --with-web-user=apache --with-web-group=apache
--with-apachectl=/usr/sbin/apachectl --with-web-handler=fastcgi

My rt.conf apache virtual host config:

FastCgiServer /opt/rt4/sbin/rt-server -processes 5 -idle-timeout 300


ServerName rt.domain.tld
### Optional apache logs for RT
# Ensure that your log rotation scripts know about these files
ErrorLog /opt/rt4/var/log/apache2.error
TransferLog /opt/rt4/var/log/apache2.access
LogLevel debug

AddDefaultCharset UTF-8

Alias /NoAuth/images/ /opt/rt4/share/html/NoAuth/images/
ScriptAlias / /opt/rt4/sbin/rt-server.fcgi/

DocumentRoot "/opt/rt4/share/html"

Order allow,deny
Allow from all

Options +ExecCGI
AddHandler fastcgi-script fcgi




In the apache error log I get plenty of these:

Fri Jun 08 22:01:02 2012] [crit] (13)Permission denied: FastCGI: can't
create server "/opt/rt4/sbin/rt-server": bind() failed
[/etc/httpd/logs/fastcgi/5ca4b3adecea1bd2fa8ffd8f7584ca93]
[Fri Jun 08 22:01:03 2012] [crit] (13)Permission denied: FastCGI: can't
create server "/opt/rt4/sbin/rt-server": bind() failed
[/etc/httpd/logs/fastcgi/5ca4b3adecea1bd2fa8ffd8f7584ca93]

in the /opt/rt4/var/log/apache2.error

Fri Jun 08 21:58:29 2012] [alert] [client 192.168.0.21] (13)Permission
denied: FastCGI: failed to connect to (dynamic) server
"/opt/rt4/sbin/rt-server.fcgi": something is seriously wrong, any chance
the socket/named_pipe directory was removed?, see the FastCgiIpcDir
directive
[Fri Jun 08 21:58:29 2012] [error] [client 192.168.0.21] FastCGI:
incomplete headers (0 bytes) received from server
"/opt/rt4/sbin/rt-server.fcgi"

I am afraid my fastcgi fu is close to zero. Learning as I go. If any one
can shed light on this, that would be great.

TIA.

-- 
groet,
natxo


Re: [rt-users] perlbrew/cpanm installation on centos 6

2012-06-08 Thread Natxo Asenjo
On Fri, Jun 8, 2012 at 10:07 PM, Natxo Asenjo wrote:

> Fri Jun 08 21:58:29 2012] [alert] [client 192.168.0.21] (13)Permission
> denied: FastCGI: failed to connect to (dynamic) server
> "/opt/rt4/sbin/rt-server.fcgi": something is seriously wrong, any chance
> the socket/named_pipe directory was removed?, see the FastCgiIpcDir
> directive
> [Fri Jun 08 21:58:29 2012] [error] [client 192.168.0.21] FastCGI:
> incomplete headers (0 bytes) received from server
> "/opt/rt4/sbin/rt-server.fcgi"
>

If I define the FastCgiDir directive and chmod -R 777 that directory, then
it works:

 FastCgiIpcDir /var/www/html/fastcgi-rt/

If this directory is apache:apache 770, it doesn't work.

It bloks th best practical logo too:

[Fri Jun 08 22:33:14 2012] [error] [client 192.168.0.160] FastCGI: invalid
(dynamic) server
"/opt/rt4/share/html/NoAuth/images/jquery_ui/ui-bg_flat_75_ff_40x100.png":
access for server (uid 48, gid 48) not allowed: execute not allowed,
referer: http://rt.ipa.asenjo.nx/
[Fri Jun 08 22:34:34 2012] [error] [client 192.168.0.21] FastCGI: invalid
(dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png": access
for server (uid 48, gid 48) not allowed: execute not allowed, referer:
http://rt.ipa.asenjo.nx/

Quite weird.

-- 
natxo


Re: [rt-users] perlbrew/cpanm installation on centos 6

2012-06-08 Thread Natxo Asenjo
On Sat, Jun 9, 2012 at 12:57 AM, Kevin Falcone wrote:

> On Fri, Jun 08, 2012 at 10:07:16PM +0200, Natxo Asenjo wrote:
> > On Fri, Jun 8, 2012 at 5:34 PM, Thomas Sibley 
> wrote:
> >
> > My rt.conf apache virtual host config:
> >
> > FastCgiServer /opt/rt4/sbin/rt-server -processes 5 -idle-timeout 300
> >
> > 
> > ServerName rt.domain.tld
> > ### Optional apache logs for RT
> > # Ensure that your log rotation scripts know about these files
> > ErrorLog /opt/rt4/var/log/apache2.error
> > TransferLog /opt/rt4/var/log/apache2.access
> > LogLevel debug
> >
> > AddDefaultCharset UTF-8
> >
> > Alias /NoAuth/images/ /opt/rt4/share/html/NoAuth/images/
> > ScriptAlias / /opt/rt4/sbin/rt-server.fcgi/
> >
> > DocumentRoot "/opt/rt4/share/html"
> > 
> > Order allow,deny
> > Allow from all
> >
> > Options +ExecCGI
> > AddHandler fastcgi-script fcgi
> > 
> >
> > 
>
> Your FastCgiServer line looks different from the one in
> docs/web_deployment.pod.
>
>
you are right, I had bee trying stuff and forgotten to set it back:

FastCgiIpcDir /var/www/html/fastcgi-rt/
FastCgiServer /opt/rt4/sbin/rt-server.fcgi -processes 5 -idle-timeout 300

SetHandler fastcgi-script


ServerName rt.ipa.asenjo.nx
### Optional apache logs for RT
# Ensure that your log rotation scripts know about these files
ErrorLog /opt/rt4/var/log/apache2.error
TransferLog /opt/rt4/var/log/apache2.access
LogLevel debug

AddDefaultCharset UTF-8

Alias /NoAuth/images/ /opt/rt4/share/html/NoAuth/images/
ScriptAlias / /opt/rt4/sbin/rt-server.fcgi/

DocumentRoot "/opt/rt4/share/html"

Order allow,deny
Allow from all

Options +ExecCGI
AddHandler fastcgi-script fcgi




If I do not set the FastCgiIpcDir directive it does not work at all.

Without FastCgiIpcDir:

/opt/rt4/var/log/apache2.error:

[Sat Jun 09 08:12:34 2012] [error] [client 192.168.0.160] (13)Permission
denied: FastCGI: failed to connect to server
"/opt/rt4/sbin/rt-server.fcgi": connect() failed
[Sat Jun 09 08:12:34 2012] [error] [client 192.168.0.160] FastCGI:
incomplete headers (0 bytes) received from server
"/opt/rt4/sbin/rt-server.fcgi"

/var/log/httpd/error.log
[Sat Jun 09 08:13:29 2012] [crit] (13)Permission denied: FastCGI: can't
create server "/opt/rt4/sbin/rt-server.fcgi": bind() failed
[/etc/httpd/logs/fastcgi/f758b05f8779532382e3166ad1890013]
[Sat Jun 09 08:13:30 2012] [crit] (13)Permission denied: FastCGI: can't
create server "/opt/rt4/sbin/rt-server.fcgi": bind() failed
[/etc/httpd/logs/fastcgi/f758b05f8779532382e3166ad1890013]

With FastCgiIpcDir *and* the dir with permissions 777, it works blocking
some images:

[Sat Jun 09 08:15:28 2012] [error] [client 192.168.0.160] FastCGI: invalid
(dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png": access
for server (uid -1, gid -1) not allowed: execute not allowed, referer:
http://rt.ipa.asenjo.nx/
[Sat Jun 09 08:15:28 2012] [error] [client 192.168.0.160] FastCGI: invalid
(dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png": access
for server (uid -1, gid -1) not allowed: execute not allowed, referer:
http://rt.ipa.asenjo.nx/

If the FastCgiIpcDir has perms 770 for apache:apache , it does not work.

Is this normal behaviour?

Thanks for your help.
-- 
natxo

-kevin
>


Re: [rt-users] perlbrew/cpanm installation on centos 6

2012-06-08 Thread Natxo Asenjo
On Sat, Jun 9, 2012 at 8:17 AM, Natxo Asenjo  wrote:

>
> With FastCgiIpcDir *and* the dir with permissions 777, it works blocking
> some images:
>
> [Sat Jun 09 08:15:28 2012] [error] [client 192.168.0.160] FastCGI: invalid
> (dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png": access
> for server (uid -1, gid -1) not allowed: execute not allowed, referer:
> http://rt.ipa.asenjo.nx/
> [Sat Jun 09 08:15:28 2012] [error] [client 192.168.0.160] FastCGI: invalid
> (dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png": access
> for server (uid -1, gid -1) not allowed: execute not allowed, referer:
> http://rt.ipa.asenjo.nx/
>
> If the FastCgiIpcDir has perms 770 for apache:apache , it does not work.
>

by the way, the permissions for those images are:

 ls -l /opt/rt4/share/html/NoAuth/images/
total 40
-rw-r--r--. 1 root bin  334 Jun  8 21:11 autohandler
-rw-r--r--. 1 root bin 3929 Jun  8 21:11 bpslogo.png
drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 css
-rw-r--r--. 1 root bin  914 Jun  8 21:11 empty_star.gif
drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 farbtastic
-rw-r--r--. 1 root bin  335 Jun  8 21:11 favicon.png
drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 jquery_ui
-rw-r--r--. 1 root bin  161 Jun  8 21:11 star.gif
drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 tablesorter
-rw-r--r--. 1 root bin   81 Jun  8 21:11 test.png

So they are world readable and still being blocked. Perhaps they should be
owned by apache?


Re: [rt-users] perlbrew/cpanm installation on centos 6

2012-06-09 Thread Natxo Asenjo
On Sat, Jun 9, 2012 at 8:26 AM, Natxo Asenjo  wrote:

> On Sat, Jun 9, 2012 at 8:17 AM, Natxo Asenjo wrote:
>
>>
>> With FastCgiIpcDir *and* the dir with permissions 777, it works blocking
>> some images:
>>
>> [Sat Jun 09 08:15:28 2012] [error] [client 192.168.0.160] FastCGI:
>> invalid (dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png":
>> access for server (uid -1, gid -1) not allowed: execute not allowed,
>> referer: http://rt.ipa.asenjo.nx/
>> [Sat Jun 09 08:15:28 2012] [error] [client 192.168.0.160] FastCGI:
>> invalid (dynamic) server "/opt/rt4/share/html/NoAuth/images/bpslogo.png":
>> access for server (uid -1, gid -1) not allowed: execute not allowed,
>> referer: http://rt.ipa.asenjo.nx/
>>
>> If the FastCgiIpcDir has perms 770 for apache:apache , it does not work.
>>
>
> by the way, the permissions for those images are:
>
>  ls -l /opt/rt4/share/html/NoAuth/images/
> total 40
> -rw-r--r--. 1 root bin  334 Jun  8 21:11 autohandler
> -rw-r--r--. 1 root bin 3929 Jun  8 21:11 bpslogo.png
> drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 css
> -rw-r--r--. 1 root bin  914 Jun  8 21:11 empty_star.gif
> drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 farbtastic
> -rw-r--r--. 1 root bin  335 Jun  8 21:11 favicon.png
> drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 jquery_ui
> -rw-r--r--. 1 root bin  161 Jun  8 21:11 star.gif
> drwxr-xr-x. 2 root bin 4096 Jun  8 21:11 tablesorter
> -rw-r--r--. 1 root bin   81 Jun  8 21:11 test.png
>
> So they are world readable and still being blocked. Perhaps they should be
> owned by apache?
>

found it:

http://requesttracker.wikia.com/wiki/ApacheConfig#How_to_avoid_processing_images_like_dynamic_content

-- 
natxo


[rt-users] yet another fastcgi problem

2012-06-09 Thread Natxo Asenjo
hi,

Since I got rt working as a fastcgi virtual host with apache, another
virtual host running mediawiki stopped working:

Sat Jun 09 11:31:40 2012] [error] [client 192.168.0.21] FastCGI: invalid
(dynamic) server "/var/www/html/mediawiki/": script is a directory!
[Sat Jun 09 11:31:40 2012] [error] [client 192.168.0.21] FastCGI: invalid
(dynamic) server "/var/www/error/noindex.html": access for server (uid -1,
gid -1) not allowed: execute not allowed

If I do not load the fastcgi module and rt vhost, then it works as
expected. So running rt broke the other vhost.

Is it possible to run fastcgi with stock mod_php (or whatever its name in
rhel is), or do I have to run everything as fastcgi? In that case I think I
might choose the reverse proxy route with starman.
--
Groeten,
natxo


Re: [rt-users] Authen-ExternalAuth LDAP problem

2012-06-11 Thread Natxo Asenjo
On Mon, Jun 11, 2012 at 6:40 PM, Russ Lavoy  wrote:

knip


> # as internal users if they fail to authenticate from an
> # external service.
> Set($AutoCreateNonExternalUsers,0);
>
> # LDAP Settings
> 'My_LDAP'   =>  {
> 'type'  =>  'ldap',
> 'server'=>
>  'ldapserver',
> 'user'  =>
>  'cn=user,ou=oragnizational unit,dc=example,dc=net',
> 'pass'  =>  'passwd',
> 'base'  =>
>  'dc=example,dc=net',
> 'filter'=>
>  '(objectClass=*)',
> 'd_filter'  =>
>  '(objectClass=Foo)',
>
>
This should be:

Set( $ExternalSettings, {
 'My_LDAP'   =>   {
  .
etc.

Do not forget to verify your RT_SiteConfig.pm with perl -c RT_SiteConfig
after editing and restarting your webserver.

HTH,

-- 
natxo


[rt-users] database authentication (as in RT_SiteConfig.pm) using a kerberos principal

2012-06-23 Thread Natxo Asenjo
hi,

Using postgresql (or oracle possibly) it is possible to use kerberos/gssapi
to log in the database.

If I create a kerberos service principal rt/myserver.domain.tld/MYREALM.TLD
I can login the postgresql database with a keytab for this principal.

How can I tell the request tracker application it has to use this keytab
instead of setting a username/password in clear text in a config file? This
would be a huge security improvement IMO.

With other apps I can use the KRB5CCNAME variable to specify where the
ticket cache file is and use that.

Could something like this be possible?

TIA,
--
Groeten,
natxo


Re: [rt-users] database authentication (as in RT_SiteConfig.pm) using a kerberos principal

2012-06-25 Thread Natxo Asenjo
On Mon, Jun 25, 2012 at 4:32 PM, Kevin Falcone wrote:

> On Sat, Jun 23, 2012 at 04:49:25PM +0200, Natxo Asenjo wrote:
> >Using postgresql (or oracle possibly) it is possible to use
> kerberos/gssapi to log in the
> >database.
> >
> >If I create a kerberos service principal
> rt/myserver.domain.tld/MYREALM.TLD I can login the
> >postgresql database with a keytab for this principal.
> >
> >How can I tell the request tracker application it has to use this
> keytab instead of setting a
> >username/password in clear text in a config file? This would be a
> huge security improvement
> >IMO.
> >
> >With other apps I can use the KRB5CCNAME variable to specify where
> the ticket cache file is
> >and use that.
>
> If DBD::Pg or DBD::Oracle can do it, then RT should be able to
> leverage that.  You'll need to review the driver documentation for how
> the configuration needs to be set up.
>
>
DBI with the postgres driver can do it (I suppose that is DBD::Pg, correct
me if I am wrong).

I have created a service principal rt/webserver01.ipa.asenjo.nx and added a
postgresql login role in the postgresql server with the same name, no
passwords.

After that I retrieved the keytab for the service principal and saved it in
a file rt.keytab.

Then I wrote this snippet:

use strict;
use warnings;

use Authen::Krb5::Easy qw( kinit kdestroy kerror );

my $keytab = '/home/admin/rt.keytab';
my $ccache = '/tmp/rt.ccache';
my $principal = 'rt/webserver01.ipa.asenjo.nx';

print $principal, "\n";

$ENV{KRB5CCNAME} = $ccache;

kinit( $keytab, $principal ) || die kerror();

use DBI;

my $dbhost = "postgres.ipa.asenjo.nx";

my $dbh = DBI->connect(
   "DBI:Pg:dbname=template1;host=$dbhost",$principal,'');

my $sth = $dbh->prepare("select usename from pg_catalog.pg_user") ;

$sth->execute();

# save the postgres roles in value of hash, key not important
my %postgres_roles;
while ( my @data = $sth->fetchrow_array() ) {
$postgres_roles{$data[0]} = $data[0];
}

print %postgres_roles;

And I see the list of roles in the postgresql server, so it works using the
kerberos principal.

So how can I tell rt to look in the kerberos cache file for its kerberos
credentials?

TIA,
-- 
natxo


Re: [rt-users] database authentication (as in RT_SiteConfig.pm) using a kerberos principal

2012-07-09 Thread Natxo Asenjo
hi,

a bit late response.

This works! I had to make the kerberos credentials cache file apache
readable as well, and it works.

Thanks for the tip. Another password bites the dust :-)

-- 
groet,
natxo

On Wed, Jun 27, 2012 at 11:04 PM, Ruslan Zakirov wrote:

> Hi,
>
> Looks like you have to configure DatabaseHost, DatabaseUser and
> DatabasePassword properly and KRB5CCNAME environment variable. As I
> recall we cleanup ENV somewhere. Try putting it directly in
> ConnectToDatabase function in RT.pm.
>