Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a single organizational unit in AD server for the purpose of integrating many desktop PC's. Now, I have installed Request tracker v 4.0.8 and integrated it with AD server. Now the issue is, I don't want to authenticate all the user who are in the AD server to RT server. I would like only some of them to authenticate to RT server. Condition is, I don't want to create a new organizational unit. I don't want to create separate user for RT within AD server. I would just like to use the single user name for both desktop integration and for RT purpose. How to achieve this?

share|improve this question
add comment

1 Answer

If you used the LDAP module, you can create the query string to limit the users to a specific LDAP group. I did this at $OLDJOB, but I haven't saved the config files so I can't paste a working example here.

Anyway, the line in your RT_SiteConfig.pm file you need to edit is this:

'filter'                    =>  '(FILTER_STRING)'

in the LDAP segment.

Edit: A second look into the demo RT_SiteConfig.pm caused me to remember that RT is clever enough do this without a combined search for user and memberOf operation. See this lines in the default config file for the LDAP auth module:

# What is the attribute for the group object that determines membership?
'group_attr'                =>  'GROUP_ATTR',
# What is the attribute of the user entry that should be matched against group_attr above? (Optional; defaults to 'dn')
'group_attr_value'          =>  'GROUP_ATTR_VALUE',
share|improve this answer
    
Thank you. But I'm not using the LDAP module. I'm using this solution: serverfault.com/a/462090/147369. Any light? –  FELDAP Jan 7 '13 at 5:19
    
Have a look into httpd.apache.org/docs/2.0/mod/mod_auth_ldap.html#reqgroup –  SvW Jan 7 '13 at 5:23
    
I have read the documentation you have provided and I'm bit confused which option to use. I would like to authenticate the users who are in the group called "rt_group". How do I add this in config file? I tried various options, but doesn't work or still it authenticates the users irrespective of group they are in. –  FELDAP Jan 7 '13 at 6:33
    
Sorry, I've never used mod_auth_ldap on Apache, and certainly not against AD. –  SvW Jan 7 '13 at 6:38
    
Ok. Thank you. :) Still hoping for the answer. –  FELDAP Jan 7 '13 at 6:39
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.