{{ SOFTWARE_NAME }} LDAP backend (svc-db-openldap) for the web-app-kix-administrator role group. Authenticates KIX agents via Auth::LDAP and provisions the contact via Auth::Sync::LDAP.
Framework
[
{
"Name": "{{ SOFTWARE_NAME }} svc-db-openldap (Agent, web-app-kix-administrator)",
"Enabled": 1,
"UsageContext": "Agent",
"Module": "Kernel::System::Auth::LDAP",
"Config": {
"Host": "{{ KIX_LDAP_HOST }}",
"Params": {
"async": 0,
"port": {{ KIX_LDAP_PORT }},
"timeout": 10,
"version": 3
},
"BaseDN": "{{ KIX_LDAP_BASE_DN }}",
"AlwaysFilter": "(objectclass=inetOrgPerson)",
"Charset": "utf-8",
"SearchUserDN": "{{ KIX_LDAP_BIND_DN }}",
"SearchUserPw": "{{ KIX_LDAP_BIND_PW }}",
"GroupDN": "{{ KIX_LDAP_ADMINISTRATOR_GROUP_DN }}",
"AccessAttr": "member",
"UID": "{{ KIX_LDAP_UID_ATTR }}",
"UserAttr": "DN",
"AuthAttr": "{{ KIX_LDAP_UID_ATTR }}",
"UserSuffix": "",
"Debug": 1
},
"Sync": [
{
"Enabled": 1,
"Module": "Kernel::System::Auth::Sync::LDAP",
"Config": {
"ContactUserSync": {
"Email": "mail",
"Firstname": "givenName",
"Lastname": "sn",
"UserLogin": "{{ KIX_LDAP_UID_ATTR }}",
"PrimaryOrganisationID": "SET:1"
},
"GroupDNBasedUsageContextSync": {
"{{ KIX_LDAP_ADMINISTRATOR_GROUP_DN }}": {
"IsAgent": 1,
"IsCustomer": 0
}
}
}
}
]
}
]
Second {{ SOFTWARE_NAME }} LDAP backend for the web-app-kix-user role group. KIX iterates over Authentication entries; if the administrator backend (###100) refuses (user not in admin group), this one tries the user group. The OAuth2-proxy `allowed_groups` filter still lets only members of either group through, so this backend never sees a user without an {{ SOFTWARE_NAME }} role.
Framework
[
{
"Name": "{{ SOFTWARE_NAME }} svc-db-openldap (Agent, web-app-kix-user)",
"Enabled": 1,
"UsageContext": "Agent",
"Module": "Kernel::System::Auth::LDAP",
"Config": {
"Host": "{{ KIX_LDAP_HOST }}",
"Params": {
"async": 0,
"port": {{ KIX_LDAP_PORT }},
"timeout": 10,
"version": 3
},
"BaseDN": "{{ KIX_LDAP_BASE_DN }}",
"AlwaysFilter": "(objectclass=inetOrgPerson)",
"Charset": "utf-8",
"SearchUserDN": "{{ KIX_LDAP_BIND_DN }}",
"SearchUserPw": "{{ KIX_LDAP_BIND_PW }}",
"GroupDN": "{{ KIX_LDAP_USER_GROUP_DN }}",
"AccessAttr": "member",
"UID": "{{ KIX_LDAP_UID_ATTR }}",
"UserAttr": "DN",
"AuthAttr": "{{ KIX_LDAP_UID_ATTR }}",
"UserSuffix": "",
"Debug": 1
},
"Sync": [
{
"Enabled": 1,
"Module": "Kernel::System::Auth::Sync::LDAP",
"Config": {
"ContactUserSync": {
"Email": "mail",
"Firstname": "givenName",
"Lastname": "sn",
"UserLogin": "{{ KIX_LDAP_UID_ATTR }}",
"PrimaryOrganisationID": "SET:1"
},
"GroupDNBasedUsageContextSync": {
"{{ KIX_LDAP_USER_GROUP_DN }}": {
"IsAgent": 1,
"IsCustomer": 0
}
}
}
}
]
}
]