The default customer auth backend is the otrs database with your customer user which are created via the Admin-Interface or Customer-Interface (Create Account).
[Kernel/Config.pm]
# This is the auth. module againt the otrs db
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::DB';
[...] |
If there is a LDAP tree available with your customer users then you can use the customer LDAP auth backend. This module is just read only ( means it can't write to your LDAP tree - this should just be possibe for your tree manager) so you can't create customer user via the Admin- or Customer-Interface.
[Kernel/Config.pm]
# This is an example configuration for an LDAP auth. backend.
# (take care that Net::LDAP is installed!)
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::LDAP';
$Self->{'Customer::AuthModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'Customer::AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'Customer::AuthModule::LDAP::UID'} = 'uid';
# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
# $Self->{'Customer::AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
# $Self->{'Customer::AuthModule::LDAP::AccessAttr'} = 'memberUid';
# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
$Self->{'Customer::AuthModule::LDAP::SearchUserDN'} = '';
$Self->{'Customer::AuthModule::LDAP::SearchUserPw'} = '';
# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
# $Self->{'Customer::AuthModule::LDAP::AlwaysFilter'} = '';
# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
# $Self->{'Customer::AuthModule::LDAP::Params'} = {
# port => 389,
# version => 3,
# };
[...] |
If you a "single sign on" solution for your customers, use http basic authentication (for all your systems) and use the HTTPBasicAuth module (no otrs login is required!).
[Kernel/Config.pm]
# This is the auth. module againt $ENV{REMOTE_USER} (apache
# http-basic-auth)
$Self->{'Customer::AuthModule'} = 'Kernel::System::CustomerAuth::HTTPBasicAuth';
# Note:
# If you use this module, you should use as fallback the following
# config settings if user isn't login through apache ($ENV{REMOTE_USER})
$Self->{CustomerPanelLoginURL} = 'http://host/not-authorised-for-otrs.html';
$Self->{CustomerPanelLogoutURL} = 'http://host/thanks-for-using-otrs.html';
[...] |
Authentication against a radius server.
[Kernel/Config.pm]
# This is example configuration to auth. agents against a radius server
$Self->{'Customer::AuthModule'} = 'Kernel::System::Auth::Radius';
$Self->{'Customer::AuthModule::Radius::Host'} = 'radiushost';
$Self->{'Customer::AuthModule::Radius::Password'} = 'radiussecret';
[...] |