LDAP group membership filter used in RT3

Question

I am trying to setup LDAP authentication to an Active Directory server for an RT3 site.

I think that there is an error in the LDAP authentication module, but I really do not understand what the filter is trying to do. See RT/Authen/ExternalAuth/LDAP.pm line 126:

$ldap_msg = $ldap->search(  base   => $group,
                            filter => $filter,
                            attrs  => \@attrs,
                            scope  => 'base');

There is a config file that specifies the group, group_attr and group_attr_value.

Group is passed as $group, and the filter is created from a group_attr=group string. In my case group_attr = present and the memberOf line comes back with CN=ITAdmins,CN=Builtin,DC=SPGLOBAL,DC=local and the filter becomes Filter: (present=CN=ITAdmins,CN=Builtin,DC=SPGLOBAL,DC=local) and Attrs: dn.

This is invalid for a filter, but can any one who knows a bit more about this see what is meant to be happening?

Answer 1

Thanks for posting the link to the code, that makes it much simpler to understand.

So the model is, authentitcate with username and password, then $group, if defined means check that they are a member of a group to let them in.

$group should be a full LDAP DN, so cn=AccessGroup,ou=Groups,dc=myDomain,dc=com or the like.

$group_attr_val should be member, memberOf, or maybe Member, depending on whatever the member attribute is in your target LDAP directory.

So I think your issue is that group-attr=present is probably wrong and should be as simple as member instead.