Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LTB Service Desk Active Directory Support #52

Closed
optiti opened this issue Feb 14, 2022 · 8 comments · Fixed by #156
Closed

LTB Service Desk Active Directory Support #52

optiti opened this issue Feb 14, 2022 · 8 comments · Fixed by #156
Assignees
Labels
enhancement New feature or request sponsor Developpement sponsorized by customers
Milestone

Comments

@optiti
Copy link

optiti commented Feb 14, 2022

Hi,

I'm trying to get ltb service desk to work with Microsoft Active Directory but some features like "Change password" and "Lock account" don't work, so I've been looking for a useful log file to debug this behavior with no luck. I also did not get results activating the debug mode.

So my question is: This application works with Active Directory?

My environment is:

  • Red Hat Enterprise Linux 8.5
  • Microsoft Active Directory 2019
  • PHP versión 7.4
  • Smarty 3

My config.inc.local.php

$debug = false;
$ldap_url = "ldaps://ip.to.my.ad:636";
$ldap_starttls = false;
$ldap_binddn = "CN=Administrator,CN=Users,DC=mydomain,DC=cnp";
$ldap_bindpw = "MyAdminPassword";
$ldap_base = "DC=mydomain,DC=cnp";
$ldap_user_base = $ldap_base;
$ldap_user_filter = "(objectClass=user)";
$ldap_size_limit = 100;
@coudot coudot added the question Further information is requested label Feb 17, 2022
@coudot
Copy link
Member

coudot commented Feb 17, 2022

Service Desk is not designed to work with AD for now. AD and OpenLDAP do not have anything in common regarding password management, a lot of code is required. This would be a major feature to put in the roadmap.

See also #48

@klepptor
Copy link

Hi!

I would also love to see (full) Active Directory support in LTB Service Desk in the future.

We are already using Self Service Password but would like to provide the service desk functionality as well.

Keep up your great work!

@coudot
Copy link
Member

coudot commented Jul 21, 2022

Thanks for your interest, I know it would be a really cool feature. Hope to get some help or funds to code it.

@optikkore
Copy link

you can't use the code from https://self-service-password.readthedocs.io/en/stable/ ? It works in our AD environment amazingly.
side note if I modified resetpassword.php unlockaccount.php and lockaccount.php with this library that does work (https://github.com/Adldap2/Adldap2) it shoudn't break anything as long as I return all proper values should it?

@optikkore
Copy link

optikkore commented Aug 17, 2022

made a new config var $admode = true;
changed resetpassword.php as such

if($admode) { // create the unicode password
  $password = "\"" . $password . "\"";
  $uniPass="";
  for ($i=0; $i <strlen($password); $i++){ $uniPass .="{$password{$i}}\000";}
  }
  if ($ldap) {
    if ($admode){
            $entry["unicodePwd"] = $uniPass;
        if ( $pwdreset === "true" ) {
            $entry["pwdLastSet"] = 0;
        }
       }else{
        $entry["userPassword"] = $password;
        if ( $pwdreset === "true" ) {
            $entry["pwdReset"] = "TRUE";
        }

working on locking/checking on locked for ad now

@optikkore
Copy link

fixed different time stamps for date in smart.inc.php

function convert_ldap_date($date) {
$end = substr($date, -3);
if ($end === ".0Z")
{ 
  return ldapDate2phpDate( $date );
}else{
  $winSecs       = (int)($date / 10000000); // divide by 10 000 000 to get seconds
  $unixTimestamp = ($winSecs - 11644473600); // 1.1.1600 -> 1.1.1970 difference in seconds
  return date(DateTime::RFC822, $unixTimestamp);
}
}

@coudot coudot mentioned this issue Sep 16, 2022
6 tasks
@coudot coudot added this to the Backlog milestone Feb 7, 2023
@coudot coudot added enhancement New feature or request and removed question Further information is requested labels May 28, 2024
@coudot coudot modified the milestones: Backlog, 0.6 May 28, 2024
@coudot coudot added the sponsor Developpement sponsorized by customers label Jun 28, 2024
@coudot
Copy link
Member

coudot commented Jul 2, 2024

Main work need to be done in LTB-LDAP: ltb-project/ltb-common#16

@coudot coudot self-assigned this Jul 2, 2024
@coudot
Copy link
Member

coudot commented Jul 19, 2024

Work started by creating a class Interface \Ltb\Directory in ltb-common, and implementations of this class for OpenLDAP and AD.

Try a first function isLocked, need more work on OpenLDAP side to have the unlock date in a separate function, and also to have a function that tell if locking is allowed or not (depending on ppolicy pwdLockout setting).

@coudot coudot linked a pull request Jul 26, 2024 that will close this issue
17 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request sponsor Developpement sponsorized by customers
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants