Agents

# This is the auth. module against the otrs db
$Self->{AuthModule} = 'Kernel::System::Auth::DB';

# defines AuthSyncBackend (AuthSyncModule) for AuthModule
# if this key exists and is empty, there won't be a sync.
# example values: AuthSyncBackend, AuthSyncBackend2
#    $Self->{'AuthModule::UseSyncBackend'} = '';

# password crypt type (bcrypt|sha2|sha1|md5|apr1|crypt|plain)
#    $Self->{'AuthModule::DB::CryptType'} = 'sha2';

# If "bcrypt" was selected for CryptType, use cost specified here for bcrypt hashing.
#   Currently max. supported cost value is 31.
# $Self->{'AuthModule::DB::bcryptCost'} = 12;

# This is an example configuration for an LDAP auth. backend.
# (take care that Net::LDAP is installed!)
#    $Self->{AuthModule} = 'Kernel::System::Auth::LDAP';
#    $Self->{'AuthModule::LDAP::Host'} = 'ldap.example.com';
#    $Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
#    $Self->{'AuthModule::LDAP::UID'} = 'uid';

# Check if the user is allowed to auth in a posixGroup
# (e. g. user needs to be in a group xyz to use otrs)
#    $Self->{'AuthModule::LDAP::GroupDN'} = 'cn=otrsallow,ou=posixGroups,dc=example,dc=com';
#    $Self->{'AuthModule::LDAP::AccessAttr'} = 'memberUid';
# for ldap posixGroups objectclass (just uid)
#    $Self->{'AuthModule::LDAP::UserAttr'} = 'UID';
# for non ldap posixGroups objectclass (with full user dn)
#    $Self->{'AuthModule::LDAP::UserAttr'} = 'DN';

# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
#    $Self->{'AuthModule::LDAP::SearchUserDN'} = '';
#    $Self->{'AuthModule::LDAP::SearchUserPw'} = '';

# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
# or if you want to filter with a locigal OR-Expression, like AlwaysFilter => '(|(mail=*abc.com)(mail=*xyz.com))'
#    $Self->{'AuthModule::LDAP::AlwaysFilter'} = '';

# in case you want to add a suffix to each login name, then
# you can use this option. e. g. user just want to use user but
# in your ldap directory exists user@domain.
#    $Self->{'AuthModule::LDAP::UserSuffix'} = '@domain.com';

# In case you want to convert all given usernames to lower letters you
# should activate this option. It might be helpful if databases are
# in use that do not distinguish selects for upper and lower case letters
# (Oracle, postgresql). User might be synched twice, if this option
# is not in use.
#    $Self->{'AuthModule::LDAP::UserLowerCase'} = 0;

# In case you need to use OTRS in iso-charset, you can define this
# by using this option (converts utf-8 data from LDAP to iso).
#    $Self->{'AuthModule::LDAP::Charset'} = 'iso-8859-1';

# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
#    $Self->{'AuthModule::LDAP::Params'} = {
#        port    => 389,
#        timeout => 120,
#        async   => 0,
#        version => 3,
#    };

# Die if backend can't work, e. g. can't connect to server.
#    $Self->{'AuthModule::LDAP::Die'} = 1;

$Self->{AuthModule} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'AuthModule::LDAP::UID'} = 'uid';

$Self->{'AuthModule::LDAP::Host'} = 'ldaps://secure.example.com';
$Self->{'AuthModule::LDAP::Params'}->{port} = 636;

### Backend One
$Self->{AuthModule} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'AuthModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'AuthModule::LDAP::UID'} = 'uid';

### Backend Two
$Self->{AuthModule1} = 'Kernel::System::Auth::LDAP';
$Self->{'AuthModule::LDAP::Host1'} = 'ldap.example.com';
$Self->{'AuthModule::LDAP::BaseDN1'} = 'dc=example,dc=com';
$Self->{'AuthModule::LDAP::UID1'} = 'uid';

$Self->{'AuthModule::LDAP::Host'} = ['ldaps://ldapserver_one.com', 'ldaps://ldapserver_two.com'];
$Self->{'AuthModule::LDAP::Die'} = 0;

$Self->{'AuthModule::UseSyncBackend'} = 'AuthSyncBackend';

$Self->{'AuthModule::UseSyncBackend1'} = 'AuthSyncBackend1';

$Self->{'AuthModule::UseSyncBackend1'} = 'AuthSyncBackend';

# This is an example configuration for an LDAP auth sync. backend.
# (take care that Net::LDAP is installed!)
$Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::LDAP';
$Self->{'AuthSyncModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'AuthSyncModule::LDAP::UID'} = 'uid';

# The following is valid but would only be necessary if the
# anonymous user do NOT have permission to read from the LDAP tree
$Self->{'AuthSyncModule::LDAP::SearchUserDN'} = '';
$Self->{'AuthSyncModule::LDAP::SearchUserPw'} = '';

# in case you want to add always one filter to each ldap query, use
# this option. e. g. AlwaysFilter => '(mail=*)' or AlwaysFilter => '(objectclass=user)'
# or if you want to filter with a logical OR-Expression, like AlwaysFilter => '(|(mail=*abc.com)(mail=*xyz.com))'
$Self->{'AuthSyncModule::LDAP::AlwaysFilter'} = '';

# AuthSyncModule::LDAP::UserSyncMap
# (map if agent should create/synced from LDAP to DB after successful login)
# you may specify LDAP-Fields as either
#  * list, which will check each field. first existing will be picked ( ["givenName","cn","_empty"] )
#  * name of an LDAP-Field (may return empty strings) ("givenName")
#  * fixed strings, prefixed with an underscore: "_test", which will always return this fixed string
$Self->{'AuthSyncModule::LDAP::UserSyncMap'} = {
    # DB -> LDAP
    UserFirstname => 'givenName',
    UserLastname  => 'sn',
    UserEmail     => 'mail',
};

# In case you need to use OTRS in iso-charset, you can define this
# by using this option (converts utf-8 data from LDAP to iso).
$Self->{'AuthSyncModule::LDAP::Charset'} = 'iso-8859-1';

# Net::LDAP new params (if needed - for more info see perldoc Net::LDAP)
$Self->{'AuthSyncModule::LDAP::Params'} = {
    port    => 389,
    timeout => 120,
    async   => 0,
    version => 3,
};

# Die if backend can't work, e. g. can't connect to server.
$Self->{'AuthSyncModule::LDAP::Die'} = 1;

# Attributes needed for group syncs
# (attribute name for group value key)
$Self->{'AuthSyncModule::LDAP::AccessAttr'} = 'memberUid';
# (attribute for type of group content UID/DN for full ldap name)
$Self->{'AuthSyncModule::LDAP::UserAttr'} = 'UID';
$Self->{'AuthSyncModule::LDAP::UserAttr'} = 'DN';

# AuthSyncModule::LDAP::UserSyncInitialGroups
# (sync following group with rw permission after initial create of first agent
# login)
$Self->{'AuthSyncModule::LDAP::UserSyncInitialGroups'} = [
    'users',
];

# AuthSyncModule::LDAP::UserSyncGroupsDefinition
# (If "LDAP" was selected for AuthModule and you want to sync LDAP
# groups to otrs groups, define the following.)
$Self->{'AuthSyncModule::LDAP::UserSyncGroupsDefinition'} = {
    # ldap group
    'cn=agent,o=otrs' => {
        # otrs group
        'admin' => {
            # permission
            rw => 1,
            ro => 1,
        },
        'faq' => {
            rw => 0,
            ro => 1,
        },
    },
    'cn=agent2,o=otrs' => {
        'users' => {
            rw => 1,
            ro => 1,
        },
    }
};

# AuthSyncModule::LDAP::UserSyncRolesDefinition
# (If "LDAP" was selected for AuthModule and you want to sync LDAP
# groups to otrs roles, define the following.)
$Self->{'AuthSyncModule::LDAP::UserSyncRolesDefinition'} = {
    # ldap group
    'cn=agent,o=otrs' => {
        # otrs role
        'role1' => 1,
        'role2' => 0,
    },
    'cn=agent2,o=otrs' => {
        'role3' => 1,
    }
};

# AuthSyncModule::LDAP::UserSyncAttributeGroupsDefinition
# (If "LDAP" was selected for AuthModule and you want to sync LDAP
# attributes to otrs groups, define the following.)
$Self->{'AuthSyncModule::LDAP::UserSyncAttributeGroupsDefinition'} = {
    # ldap attribute
    'LDAPAttribute' => {
        # ldap attribute value
        'LDAPAttributeValue1' => {
            # otrs group
            'admin' => {
                # permission
                rw => 1,
                ro => 1,
            },
            'faq' => {
                rw => 0,
                ro => 1,
            },
        },
    },
    'LDAPAttribute2' => {
        'LDAPAttributeValue' => {
            'users' => {
                rw => 1,
                ro => 1,
            },
        },
     }
};

# AuthSyncModule::LDAP::UserSyncAttributeRolesDefinition
# (If "LDAP" was selected for AuthModule and you want to sync LDAP
# attributes to otrs roles, define the following.)
$Self->{'AuthSyncModule::LDAP::UserSyncAttributeRolesDefinition'} = {
    # ldap attribute
    'LDAPAttribute' => {
        # ldap attribute value
        'LDAPAttributeValue1' => {
            # otrs role
            'role1' => 1,
            'role2' => 1,
        },
    },
    'LDAPAttribute2' => {
        'LDAPAttributeValue1' => {
            'role3' => 1,
        },
    },
};

$Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::LDAP';
$Self->{'AuthSyncModule::LDAP::Host'} = 'ldap.example.com';
$Self->{'AuthSyncModule::LDAP::BaseDN'} = 'dc=example,dc=com';
$Self->{'AuthSyncModule::LDAP::UID'} = 'uid';

# This is an example configuration for an apache ($ENV{REMOTE_USER})
# auth. backend. Use it if you want to have a singe login through
# apache http-basic-auth.
#    $Self->{AuthModule} = 'Kernel::System::Auth::HTTPBasicAuth';
# In case there is a leading domain in the REMOTE_USER, you can
# replace it by the next config option.
#    $Self->{'AuthModule::HTTPBasicAuth::Replace'} = 'example_domain\\';
# In case you need to replace some part of the REMOTE_USER, you can
# use the following RegExp ($1 will be new login).
#    $Self->{'AuthModule::HTTPBasicAuth::ReplaceRegExp'} = '^(.+?)@.+?$';
# Defines a header name, that has to be present for agents to authenticate.
#    $Self->{'AuthModule::HTTPBasicAuth::RequiredLoginHeader'} = 'RequiredHeader';
# Defines a header value, that has to be present in the required header for agents to authenticate.
#    $Self->{'AuthModule::HTTPBasicAuth::RequiredLoginHeaderValue'} = 'RequiredHeaderValue';
# Defines a header value regular expression, that has to be present in the required header for agents to authenticate.
#    $Self->{'AuthModule::HTTPBasicAuth::RequiredLoginHeaderValueRegExp'} = '^RequiredHeaderRegExp$';
# Note:
# If you use this module, you should use as fallback the following
# config settings if user isn't login through apache ($ENV{REMOTE_USER}).
#    $Self->{LoginURL} = 'http://host.example.com/not-authorised-for-otrs.html';
#    $Self->{LogoutURL} = 'http://host.example.com/thanks-for-using-otrs.html';

$Self->{AuthSyncModule} = 'Kernel::System::Auth::Sync::HTTPHeader';

$Self->{'AuthSyncModule::HTTPHeader::UserSyncMap'} = {
    # DB -> Header
    UserFirstname => 'givenName',
    UserLastname  => 'lastName',
    UserEmail     => 'mail',
};

# AuthSyncModule::HTTPHeader::UserSyncInitialGroups
# Sync the following group(s) with rw permission after initial agent login.
$Self->{'AuthSyncModule::HTTPHeader::UserSyncInitialGroups'} = [
    'users',
];

# AuthSyncModule::HTTPHeader::UserSyncGroupsDefinition
# Sync groups based on headers (no value check, just existence of header is checked).
$Self->{'AuthSyncModule::HTTPHeader::UserSyncGroupsDefinition'} = {
    # header name
    'IsAgent' => {
        # otrs group
        'admin' => {
            # permission
            rw => 1,
            ro => 1,
        },
        'stats' => {
            rw => 0,
            ro => 1,
        },
    },
};

# AuthSyncModule::HTTPHeader::UserSyncAttributeGroupsDefinition
# Sync groups based on header values.
# Multiple values per header are possible if separated by ',' or ';' (e.g. 'OTRS_Groups: admin, faq, users').
$Self->{'AuthSyncModule::HTTPHeader::UserSyncAttributeGroupsDefinition'} = {
    # header name
    'HTTPHeaderAttribute1' => {
        # header attribute
        'HTTPHeaderAttribute1Value1' => {
            # otrs group
            'admin' => {
                # permission
                rw => 1,
                ro => 1,
            },
            'stats' => {
                rw => 1,
                ro => 1,
            },
        },
    },
    'HTTPHeaderAttribute2' => {
        'HTTPHeaderAttribute1Value2' => {
            'users' => {
                rw => 1,
                ro => 1,
            },
        },
    },
};

# AuthSyncModule::HTTPHeader::UserSyncRolesDefinition
# Sync roles based on headers (no value check, just existence of header is checked).
$Self->{'AuthSyncModule::HTTPHeader::UserSyncRolesDefinition'} = {
    # header name
    'IsAgent' => {
        # otrs role
        'role1' => 1,
        'role2' => 0,
    },
};

# AuthSyncModule::HTTPHeader::UserSyncAttributeRolesDefinition
# Sync roles based on header values.
# Multiple values per header are possible if separated by ',' or ';' (e.g. 'OTRS_Roles: 1st_level, 2nd_level, admin').
$Self->{'AuthSyncModule::HTTPHeader::UserSyncAttributeRolesDefinition'} = {
    # header name
    'HTTPHeaderAttribute1' => {
        # header value
        'HTTPHeaderAttribute1Value1' => {
            # otrs role
            'role1' => 1,
            'role2' => 1,
        },
    },
    'HTTPHeaderAttribute2' => {
        'HTTPHeaderAttribute1Value2' => {
            'role3' => 1,
        },
    },
};

# This is example configuration to auth. agents against a radius server.
#    $Self->{'AuthModule'} = 'Kernel::System::Auth::Radius';
#    $Self->{'AuthModule::Radius::Host'} = 'radiushost';
#    $Self->{'AuthModule::Radius::Password'} = 'radiussecret';

# Die if backend can't work, e. g. can't connect to server.
#    $Self->{'AuthModule::Radius::Die'} = 1;