OTRS: LDAP Authentication, Authorization, and Synchronization (FreeIPA, AD)

• OTRS Business Solution - paid version
• ((OTRS)) Community Edition - free version

• ITSM module (Service Level Management, Change Management, Configuration Management, CMDB)
• responsive web interface
• API
• SLA and services
• multi-tenancy
• escalation
• Authentication: DB, LDAP, HTTPBasicAuth, Radius
• support for MySQL, MariaDB, PostgreSQL, Oracle

Clients, queues, agents and groups

• clients - can create applications by sending a letter or using web access
• queues - each application is in one of the queues of applications
• agents - IT professionals working on the execution of applications from the queues available to them
• Groups - an entity that connects queues, clients and agents, as well as specifies the rights of agents — for example, only reading, changing the priority of an application, etc.

Standard groups

• admin - group members can administer (configure) OTRS
• stats - the ability to customize and run reports
• users - standard group for clients, queues and agents

Rights associated with groups

Basic rights

• read only - read only permissions in this group / queue
• move - the rights to move applications to this group / queue
• Creation - rights to create applications in this group / queue
• note - rights to add notes to requests in this group / queue
• owner - rights to change the owner of applications in this group / queue
• priority - the right to change the priority of applications in this group / queue
• read / write - full read and write permissions for requests in this group / queue

Additional rights

• reports - provides access to the reports page
• redirect - the right to redirect / bounce the mail message (link redirect / bounce to ticketZoom)
• create - the right to make a response to the application
• customer - the right to change the customer for this application
• forward - the right to forward messages (using the Forward button)
• pending - the right to transfer the request pending
• phone - the right to add the customer’s call content to the application as a message / note
• responsible - The right to change the person responsible for the application

• each client can be included in one or several groups, initially all clients belong to the users group
• each order queue is associated with any one of the groups
• through the web interface, the client can make applications in those queues to which groups have access, in which it is included
• When the client sends an application via e-mail, it is possible to change the characteristics of the application, including the queue to which the application falls, by analyzing the attributes of the letter (for example, the sender's address or the message header).
• if the client made a phone call, the agent can make a request manually by selecting any of the queues available to the agent
• It is desirable that the client request is always in the queues available to the client, otherwise he will not be able to access it through the web interface
• agents can perform actions on requests in accordance with the rights to the queue in which the application is located

Database Authentication

$Self->{'AuthModule'} = 'Kernel::System::Auth::DB'; 

 $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::DB'; $Self->{'Customer::AuthModule::DB::Table'} = 'customer_user'; $Self->{'Customer::AuthModule::DB::CustomerKey'} = 'login'; $Self->{'Customer::AuthModule::DB::CustomerPassword'} = 'pw'; 

Roles and Companies

• Roles - allow you to more flexibly manage access, linking groups and agents together
• companies - allow you to isolate applications of different customers (whether they are different departments or companies)

Formulation of the problem

Training

Accounts to view LDAP

FreeIPA groups for synchronization with OTRS roles

• otrs-sa - members of this group will have access to the administration of OTRS, but we will not give access to the queues so that there is no desire to always work under the administrator),
• otrs-admins - our managers who have the right to change the priority of applications) and
• otrs-helpdesk - accounts of our specialists

Attribute that defines belonging to a company

• my-it-company - for my-it-company.com employees
• pear-company - for employees pear.com
• macrohard-company - for employees at macrohard.com

Define user attributes used by FreeIPA

 kinit laptevs ipa user-show --all --raw laptevs 

OTRS configuration setup

Configuration files

• / opt / otrs / - as a rule, OTRS files are located here
• Kernel / Config.pm - the configuration file you are editing
• Kernel / Config / Defaults.pm - a file with standard settings, you do not edit it, but in it you can view all existing parameters and comments

Agent configuration

Agent Authentication

  # --------------------------------------------------- # # Agents authentication # # --------------------------------------------------- # # my-it-company.com LDAP backend $Self->{AuthModule} = 'Kernel::System::Auth::LDAP'; # Адрес LDAP-сервера $Self->{'AuthModule::LDAP::Host'} = 'my-it-company.com'; $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=my-it-company,dc=com'; $Self->{'AuthModule::LDAP::UID'} = 'uid'; # Блок нужен, только если запрещен анонимный просмотр структуры каталогов $Self->{'AuthModule::LDAP::SearchUserDN'} = 'uid=ldap-bot,cn=users,cn=accounts,dc=my-it-company,dc=com'; $Self->{'AuthModule::LDAP::SearchUserPw'} = 'bot-password!'; # Фильтр запроса к LDAP. Пусть у нас будут только пользователи, имеющие заполненный атрибут "электронная почта" $Self->{'AuthModule::LDAP::AlwaysFilter'} = '(mail=*)'; # Добавляем при проблемах с кодировкой $Self->{'AuthModule::LDAP::Charset'} = 'utf-8'; $Self->{'AuthModule::UseSyncBackend'} = 'AuthSyncBackend'; # my-it-company.com DB backend $Self->{AuthModule2} = 'Kernel::System::Auth::DB'; $Self->{'AuthModule::DB::CryptType2'} = 'sha2'; # --------------------------------------------------- # # End Agents authentication # # --------------------------------------------------- # 

Agent synchronization (LDAP groups with OTRS roles)

  # --------------------------------------------------- # # Agent authentication sync # # (enable agent data sync. after succsessful # # authentication) # # --------------------------------------------------- # # my-it-company.com LDAP auth sync. backend. $Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::LDAP'; $Self->{'AuthSyncModule::LDAP::Host'} = 'my-it-company.com'; $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=my-it-company,dc=com'; $Self->{'AuthSyncModule::LDAP::UID'} = 'uid'; $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'uid=ldap-bot,cn=users,cn=accounts,dc=my-it-company,dc=com'; $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'bot-password!'; $Self->{'AuthSyncModule::LDAP::AlwaysFilter'} = '(mail=*)'; $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = { # DB -> LDAP UserFirstname => 'givenName', UserLastname => 'sn', UserEmail => 'mail', }; $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'member'; $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN'; $Self->{'AuthSyncModule::LDAP::UserSyncRolesDefinition'} = { # ldap group 'cn=otrs-sa,cn=groups,cn=accounts,dc=my-it-company,dc=com' => { # otrs role 'otrs-sa' => 1, }, 'cn=otrs-admins,cn=groups,cn=accounts,dc=my-it-company,dc=com' => { 'otrs-admins' => 1, }, 'cn=otrs-helpdesk,cn=groups,cn=accounts,dc=my-it-company,dc=com' => { 'helpdesk' => 1, } }; $Self->{DatabaseUserTable} = 'users'; $Self->{DatabaseUserTableUserID} = 'id'; $Self->{DatabaseUserTableUserPW} = 'pw'; $Self->{DatabaseUserTableUser} = 'login'; # --------------------------------------------------- # # End Agents authentication sync # # --------------------------------------------------- # 

  # --------------------------------------------------- # # Agent authentication sync # # (enable agent data sync. after succsessful # # authentication) # # --------------------------------------------------- # # my-it-company.com LDAP auth sync. backend. $Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::LDAP'; $Self->{'AuthSyncModule::LDAP::Host'} = 'my-it-company.com'; $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=my-it-company,dc=com'; $Self->{'AuthSyncModule::LDAP::UID'} = 'uid'; $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'uid=ldap-bot,cn=users,cn=accounts,dc=my-it-company,dc=com'; $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'bot-password!'; $Self->{'AuthSyncModule::LDAP::AlwaysFilter'} = '(mail=*)'; $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = { # DB -> LDAP UserFirstname => 'givenName', UserLastname => 'sn', UserEmail => 'mail', }; $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'member'; $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN'; # AuthSyncModule::LDAP::UserSyncGroupsDefinition # (If "LDAP" was selected for AuthModule and you want to sync LDAP # groups to otrs groups, define the following.) $Self->{'AuthSyncModule::LDAP::UserSyncGroupsDefinition'} = { # ldap group 'cn=otrs-admins,cn=groups,cn=accounts,dc=my-it-company,dc=com' => { # otrs group 'admin' => { # permission rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, 'stats' => { rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, 'users' => { rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, 'pear-group' => { rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, 'macrohard-group' => { rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, }, 'cn=otrs-helpdesk,cn=groups,cn=accounts,dc=my-it-company,dc=com' => { 'stats' => { rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, 'users' => { rw => 1, move_into => 1, create => 1, note => 1, owner => 1, prioriry => 1, ro => 1, }, } }; $Self->{DatabaseUserTable} = 'users'; $Self->{DatabaseUserTableUserID} = 'id'; $Self->{DatabaseUserTableUserPW} = 'pw'; $Self->{DatabaseUserTableUser} = 'login'; # --------------------------------------------------- # # End Agents authentication sync # # --------------------------------------------------- # 

  # --------------------------------------------------- # # Agent authentication sync # # (enable agent data sync. after succsessful # # authentication) # # --------------------------------------------------- # # my-it-company.com LDAP auth sync. backend. $Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::LDAP'; $Self->{'AuthSyncModule::LDAP::Host'} = 'my-it-company.com'; $Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=my-it-company,dc=com'; $Self->{'AuthSyncModule::LDAP::UID'} = 'uid'; $Self->{'AuthSyncModule::LDAP::SearchUserDN'} = 'uid=ldap-bot,cn=users,cn=accounts,dc=my-it-company,dc=com'; $Self->{'AuthSyncModule::LDAP::SearchUserPw'} = 'bot-password!'; $Self->{'AuthSyncModule::LDAP::AlwaysFilter'} = '(mail=*)'; $Self->{'AuthSyncModule::LDAP::UserSyncMap'} = { # DB -> LDAP UserFirstname => 'givenName', UserLastname => 'sn', UserEmail => 'mail', }; $Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'member'; $Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN'; # Включать агента в какие-либо группы с доступом на чтение/запись # AuthSyncModule::LDAP::UserSyncInitialGroups # (sync following group with rw permission after initial create of first agent # login) $Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [ 'users', ]; $Self->{DatabaseUserTable} = 'users'; $Self->{DatabaseUserTableUserID} = 'id'; $Self->{DatabaseUserTableUserPW} = 'pw'; $Self->{DatabaseUserTableUser} = 'login'; # --------------------------------------------------- # # End Agents authentication sync # # --------------------------------------------------- # 

Customer setup

Client Authentication

  # --------------------------------------------------- # # Сustomer authentication # # --------------------------------------------------- # # Сustomer DB auth. backend $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::DB'; $Self->{'Customer::AuthModule::DB::Table'} = 'customer_user'; $Self->{'Customer::AuthModule::DB::CustomerKey'} = 'login'; $Self->{'Customer::AuthModule::DB::CustomerPassword'} = 'pw'; # my-it-company.com (Сustomer) LDAP auth. backend $Self->{'Customer::AuthModule2'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host2'} = 'my-it-company.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN2'} = 'dc=my-it-company,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID2'} = 'uid'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN2'} = 'uid=ldap-bot,cn=users,cn=accounts,dc=my-it-company,dc=com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw2'} = 'bot-password!'; $Self->{'Customer::AuthModule::LDAP::AlwaysFilter2'} = '(mail=*)'; # pear LDAP auth. backend. $Self->{'Customer::AuthModule3'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host3'} = 'pear.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN3'} = 'DC=pear,DC=com'; $Self->{'Customer::AuthModule::LDAP::UID3'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN3'} = 'ldap-bot@pear.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw3'} = 'bot-password?'; # Отфильтруем: (mail=*) - у кого есть почта и (samAccountType=805306368) - учетная запись пользователя и (!(userAccountControl:1.2.840.113556.1.4.803:=2)) - не отключена $Self->{'Customer::AuthModule::LDAP::AlwaysFilter3'} = '(&(mail=*)(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'; # macrohard LDAP auth. backend. $Self->{'Customer::AuthModule4'} = 'Kernel::System::CustomerAuth::LDAP'; $Self->{'Customer::AuthModule::LDAP::Host4'} = 'macrohard.com'; $Self->{'Customer::AuthModule::LDAP::BaseDN4'} = 'dc=macrohard,dc=com'; $Self->{'Customer::AuthModule::LDAP::UID4'} = 'sAMAccountName'; $Self->{'Customer::AuthModule::LDAP::SearchUserDN4'} = 'ldap-bot@macrohard.com'; $Self->{'Customer::AuthModule::LDAP::SearchUserPw4'} = 'bot-password!?'; $Self->{'Customer::AuthModule::LDAP::AlwaysFilter4'} = '(&(mail=*)(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))'; # --------------------------------------------------- # # End customer authentication settings # # --------------------------------------------------- # 

Client synchronization (obtaining client attributes from LDAP, communication with OTRS companies)

  # --------------------------------------------------- # # Customer authentication sync # # --------------------------------------------------- # # Customer user DB backend and settings $Self->{CustomerUser} = { Name => Translatable('Database Backend'), Module => 'Kernel::System::CustomerUser::DB', Params => { Table => 'customer_user', SearchCaseSensitive => 0, }, # customer unique id CustomerKey => 'login', # customer # CustomerID => 'customer_id', CustomerValid => 'valid_id', CustomerUserListFields => [ 'first_name', 'last_name', 'email' ], CustomerUserSearchFields => [ 'login', 'first_name', 'last_name', 'customer_id' ], CustomerUserSearchPrefix => '*', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['email'], CustomerUserNameFields => [ 'title', 'first_name', 'last_name' ], CustomerUserEmailUniqCheck => 1, CustomerCompanySupport => 1, CacheTTL => 60 * 60 * 24, Map => [ [ 'UserTitle', Translatable('Title or salutation'), 'title', 1, 0, 'var', '', 0, undef, undef ], [ 'UserFirstname', Translatable('Firstname'), 'first_name', 1, 1, 'var', '', 0, undef, undef ], [ 'UserLastname', Translatable('Lastname'), 'last_name', 1, 1, 'var', '', 0, undef, undef ], [ 'UserLogin', Translatable('Username'), 'login', 1, 1, 'var', '', 0, undef, undef ], [ 'UserPassword', Translatable('Password'), 'pw', 0, 0, 'var', '', 0, undef, undef ], [ 'UserEmail', Translatable('Email'), 'email', 1, 1, 'var', '', 0, undef, undef ], [ 'UserCustomerID', Translatable('CustomerID'), 'customer_id', 0, 1, 'var', '', 0, undef, undef ], [ 'UserPhone', Translatable('Phone'), 'phone', 1, 0, 'var', '', 0, undef, undef ], [ 'UserFax', Translatable('Fax'), 'fax', 1, 0, 'var', '', 0, undef, undef ], [ 'UserMobile', Translatable('Mobile'), 'mobile', 1, 0, 'var', '', 0, undef, undef ], [ 'UserStreet', Translatable('Street'), 'street', 1, 0, 'var', '', 0, undef, undef ], [ 'UserZip', Translatable('Zip'), 'zip', 1, 0, 'var', '', 0, undef, undef ], [ 'UserCity', Translatable('City'), 'city', 1, 0, 'var', '', 0, undef, undef ], [ 'UserCountry', Translatable('Country'), 'country', 1, 0, 'var', '', 0, undef, undef ], [ 'UserComment', Translatable('Comment'), 'comments', 1, 0, 'var', '', 0, undef, undef ], [ 'ValidID', Translatable('Valid'), 'valid_id', 0, 1, 'int', '', 0, undef, undef ], ], # default selections Selections => { # UserTitle => { # 'Mr.' => Translatable('Mr.'), # 'Mrs.' => Translatable('Mrs.'), # }, }, }; # my-it-company.com customer user ldap backend and settings $Self->{CustomerUser2} = { Name => 'AD my-it-company.com', Module => 'Kernel::System::CustomerUser::LDAP', Params => { # ldap host Host => 'my-it-company.com', # ldap base dn BaseDN => 'dc=my-it-company,dc=com', # search scope (one|sub) SSCOPE => 'sub', UserDN => 'uid=ldap-bot,cn=users,cn=accounts,dc=my-it-company,dc=com', UserPw => 'bot-password!', # in case you want to add always one filter to each ldap query, use # this option. eg AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)' AlwaysFilter => '(mail=*)', SourceCharset => 'utf-8', Die => 0, }, # customer unique id CustomerKey => 'uid', # customer # CustomerID => 'ou', CustomerUserListFields => ['uid', 'cn', 'mail'], CustomerUserSearchFields => ['uid', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['sn', 'givenname'], # Configures the character for joining customer user name parts. Join single space if it is not defined. CustomerUserNameFieldsJoin => ' ', # show customer user and customer tickets in customer interface CustomerUserExcludePrimaryCustomerID => 0, # add a ldap filter for valid users (expert setting) # CustomerUserValidFilter => '(!(description=gesperrt))', # admin can't change customer preferences AdminSetPreferences => 1, # cache time to live in sec. - cache any ldap queries CacheTTL => 0, Map => [ [ 'UserTitle', Translatable('Title or salutation'), 'title', 1, 0, 'var', '', 1, undef, undef ], [ 'UserFirstname', Translatable('Firstname'), 'givenname', 1, 1, 'var', '', 1, undef, undef ], [ 'UserLastname', Translatable('Lastname'), 'sn', 1, 1, 'var', '', 1, undef, undef ], [ 'UserLogin', Translatable('Username'), 'uid', 1, 1, 'var', '', 1, undef, undef ], [ 'UserEmail', Translatable('Email'), 'mail', 1, 1, 'var', '', 1, undef, undef ], [ 'UserCustomerID', Translatable('CustomerID'), 'ou', 0, 1, 'var', '', 1, undef, undef ], [ 'UserPhone', Translatable('Phone'), 'telephonenumber', 1, 0, 'var', '', 1, undef, undef ], [ 'UserMobile', Translatable('Mobile'), 'mobile', 1, 0, 'var', '', 1, undef, undef ], ], }; # pear customer user ldap backend and settings $Self->{CustomerUser3} = { Name => 'AD pear', Module => 'Kernel::System::CustomerUser::LDAP', Params => { # ldap host Host => 'pear.com', BaseDN => 'DC=pear,DC=com', SSCOPE => 'sub', UserDN => 'ldap-bot@pear.com', UserPw => 'bot-password?', AlwaysFilter => '(&(mail=*)(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', SourceCharset => 'utf-8', Die => 0, }, # customer unique id CustomerKey => 'sAMAccountName', # customer # CustomerID => 'company', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['sn', 'givenname'], # Configures the character for joining customer user name parts. Join single space if it is not defined. CustomerUserNameFieldsJoin => ' ', # show customer user and customer tickets in customer interface CustomerUserExcludePrimaryCustomerID => 0, AdminSetPreferences => 1, CacheTTL => 0, Map => [ # note: Login, Email and CustomerID needed! # var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly, http-link-target, link class(es) [ 'UserTitle', Translatable('Title or salutation'), 'title', 1, 0, 'var', '', 1, undef, undef ], [ 'UserFirstname', Translatable('Firstname'), 'givenname', 1, 1, 'var', '', 1, undef, undef ], [ 'UserLastname', Translatable('Lastname'), 'sn', 1, 1, 'var', '', 1, undef, undef ], [ 'UserLogin', Translatable('Username'), 'sAMAccountName', 1, 1, 'var', '', 1, undef, undef ], [ 'UserFullLogin', Translatable('FullUsername'), 'userPrincipalName', 1, 1, 'var', '', 1, undef, undef ], [ 'UserEmail', Translatable('Email'), 'mail', 1, 1, 'var', '', 1, undef, undef ], [ 'UserCustomerID', Translatable('CustomerID'), 'company', 0, 1, 'var', '', 1, undef, undef ], [ 'UserPhone', Translatable('Phone'), 'telephoneNumber', 1, 0, 'var', '', 1, undef, undef ], [ 'UserMobile', Translatable('Mobile'), 'mobile', 1, 0, 'var', '', 1, undef, undef ], [ 'UserAddress', Translatable('Address'), 'postaladdress', 1, 0, 'var', '', 1, undef, undef ], [ 'UserOffice', Translatable('Office'), 'physicalDeliveryOfficeName', 1, 0, 'var', '', 1, undef, undef ], [ 'UserDepartment', Translatable('Department'), 'department', 1, 0, 'var', '', 1, undef, undef ], [ 'UserComment', Translatable('Comment'), 'description', 1, 0, 'var', '', 1, undef, undef ], ], }; # macrohard customer user ldap backend and settings $Self->{CustomerUser4} = { Name => 'AD macrohard', Module => 'Kernel::System::CustomerUser::LDAP', Params => { # ldap host Host => 'macrohard.com', # ldap base dn BaseDN => 'dc=macrohard,dc=com', # search scope (one|sub) SSCOPE => 'sub', UserDN => 'ldap-bot@macrohard.com', UserPw => 'bot-password!?', AlwaysFilter => '(&(mail=*)(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', SourceCharset => 'utf-8', Die => 0, }, # customer unique id CustomerKey => 'sAMAccountName', # customer # CustomerID => 'company', CustomerUserListFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchFields => ['sAMAccountName', 'cn', 'mail'], CustomerUserSearchPrefix => '', CustomerUserSearchSuffix => '*', CustomerUserSearchListLimit => 250, CustomerUserPostMasterSearchFields => ['mail'], CustomerUserNameFields => ['sn', 'givenname'], # Configures the character for joining customer user name parts. Join single space if it is not defined. CustomerUserNameFieldsJoin => ' ', # show customer user and customer tickets in customer interface CustomerUserExcludePrimaryCustomerID => 0, AdminSetPreferences => 1, CacheTTL => 0, Map => [ [ 'UserTitle', Translatable('Title or salutation'), 'title', 1, 0, 'var', '', 1, undef, undef ], [ 'UserFirstname', Translatable('Firstname'), 'givenname', 1, 1, 'var', '', 1, undef, undef ], [ 'UserLastname', Translatable('Lastname'), 'sn', 1, 1, 'var', '', 1, undef, undef ], [ 'UserLogin', Translatable('Username'), 'sAMAccountName', 1, 1, 'var', '', 1, undef, undef ], [ 'UserFullLogin', Translatable('FullUsername'), 'userPrincipalName', 1, 1, 'var', '', 1, undef, undef ], [ 'UserEmail', Translatable('Email'), 'mail', 1, 1, 'var', '', 1, undef, undef ], [ 'UserCustomerID', Translatable('CustomerID'), 'company', 0, 1, 'var', '', 1, undef, undef ], [ 'UserPhone', Translatable('Phone'), 'telephoneNumber', 1, 0, 'var', '', 1, undef, undef ], [ 'UserMobile', Translatable('Mobile'), 'mobile', 1, 0, 'var', '', 1, undef, undef ], [ 'UserAddress', Translatable('Address'), 'postaladdress', 1, 0, 'var', '', 1, undef, undef ], [ 'UserOffice', Translatable('Office'), 'physicalDeliveryOfficeName', 1, 0, 'var', '', 1, undef, undef ], [ 'UserDepartment', Translatable('Department'), 'department', 1, 0, 'var', '', 1, undef, undef ], [ 'UserComment', Translatable('Comment'), 'description', 1, 0, 'var', '', 1, undef, undef ], ], }; 

Conclusion

• In parallel with LDAP, you can also run SSO authentication, which will make life easier for customers
• If there are experts on Perl - you can write your own backend to connect to other information systems.
• The configuration is consciously simplified, for example, there are no filtering blocks by affiliation to LDAP groups, no domain suffixes, BASE DN, work with additional attributes, work with LDAP on other ports, and much more.