авторизация клиентов через AD. Авторизоваться могут не все!

[jas_1211]

Добрый день, настроил авторизацию через AD. Работает нормально, только вот странность не все клиенты могут авторизовываться.
выдает что логин и пароль не правильны.
в логе пишет:
[Thu Jan 9 16:12:54 2014][Notice][Kernel::System::CustomerAuth::LDAP::Auth] CustomerUser: test authentication failed, no LDAP group entry foundGroupDN='DC=sunup,DC=local', Filter='(member=CN=test,DC=sunup,DC=local)'! (REMOTE_ADDR: 10.0.7.42).

Код: Выделить всё

    $Self->{CustomerUser} = {
        Name => 'LDAP Backend',
        Module => 'Kernel::System::CustomerUser::LDAP',
        Params => {
            # ldap host
            Host => '10.0.7.3',
            # ldap base dn
            BaseDN => 'dc=sunup,dc=local',
            # search scope (one|sub)
            SSCOPE => 'sub',
            # The following is valid but would only be necessary if the
            # anonymous user does NOT have permission to read from the LDAP tree
            UserDN => 'CN=OTRS,CN=Users,DC=sunup,DC=local',
            UserPw => 'pass',
            # in case you want to add always one filter to each ldap query, use
            # this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
            AlwaysFilter => '',
            # if both your frontend and your LDAP are unicode, use this:
            SourceCharset => 'utf-8',
            DestCharset   => 'utf-8',
            # if your frontend is unicode and the charset of your
            # ldap server is iso-8859-1, use these options.
            # SourceCharset => 'iso-8859-1',
            # DestCharset => 'utf-8',
            # die if backend can't work, e. g. can't connect to server
            Die => 0,
            # Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
            Params => {
                port    => 389,
                timeout => 120,
                async   => 0,
                version => 3,
            },
       },
       # customer unique id
       CustomerKey => 'sAMAccountName',
       # customer #
       CustomerID => 'mail',
       CustomerUserListFields => ['sAMAccountName', 'mail'],
       CustomerUserSearchFields => ['sAMAccountName', 'mail'],
       CustomerUserSearchPrefix => '',
       CustomerUserSearchSuffix => '*',
       CustomerUserSearchListLimit => 50000,
       CustomerUserPostMasterSearchFields => ['mail'],
       CustomerUserNameFields => ['first_name', 'sn'],
       # show now own tickets in customer panel, CompanyTickets
       CustomerUserExcludePrimaryCustomerID => 0,
       # add a ldap filter for valid users (expert setting)
       # CustomerUserValidFilter => '(!(description=gesperrt))',
       # admin can't change customer preferences
       AdminSetPreferences => 0,
       # cache time to live in sec. - cache any ldap queries
       #CacheTTL => 0,
       Map => [
			# note: Login, Email and CustomerID needed!
			# var, frontend, storage, shown (1=always,2=lite), required, storage-type, http-link, readonly
			[ 'UserFirstname',  'Firstname',  'cn',       			1, 1, 'var', '', 0 ],
			[ 'UserLastname',   'Lastname',   'description',        1, 1, 'var', '', 0 ],
			[ 'UserLogin',      'Username',   'sAMAccountName',		1, 1, 'var', '', 0 ],
			[ 'UserEmail',      'Email',      'mail',				1, 1, 'var', '', 0 ],
			[ 'UserCustomerID', 'CustomerID', 'mail',				0, 1, 'var', '', 0 ],
			[ 'UserAddress',    'Address',    'company',   	1, 1, 'var', '', 0 ],
       ],
   };

все нужные поля в AD заполнил.
Спасибо

[alexus]

Код: Выделить всё

$Self->{CustomerUser}

к авторизации никакого отношения не имеет!

[jas_1211]

сорри я тогда наверно вот это:

Код: Выделить всё

		# Enable LDAP lookups for Customer logins.
    $Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
    $Self->{'Customer::AuthModule::LDAP::Host'} = 'prmdc.sunup.local';
    $Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'DC=sunup,DC=local';
    $Self->{'Customer::AuthModule::LDAP::UID'} = 'sAMAccountName';
    $Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = 'CN=OTRS,CN=Users,DC=sunup,DC=local';
    $Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = 'pass';
    #$Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '(objectclass=user)';
    $Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'DC=sunup,DC=local';
    $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'member';
    $Self->{'Customer::AuthModule::LDAP::UserAttr'} = 'DN';