osTicket authenticate with Open Directory

Question

We recently setup osTicket Ticket System and have been testing it to see whether to implement in our office. It would really help to have the ability to authenticate against our existing open directory. I found an article (http://www.bauer-power.net/2010/04/how-to-make-osticket-160-authenticate.html) that talks about using Active Directory and editing the class.staff.php file by replacing the following code:

/*compares user password*/ 
function check_passwd($password){ 
return (strlen($this->passwd) && strcmp($this->passwd, MD5($password))==0)?(TRUE):(FALSE); 
}

The new code is:

/*compares user password*/ 
function check_passwd($password){ 
// Change made for LDAP Auth based on -> http://osticket.com/forums/showthread.php?t=3312 
// Change this line to the FQDN of your domain controller 
$ds=ldap_connect('mydc.mydomain.local') or die("Couldn't connect to AD!"); 
// Change this line to the name of your Active Directory domain 
if ($ds) { 
$domain="mydomain"; 
$ldapbind = ldap_bind($ds); 
if (!@ldap_bind( $ds, $domain."\\".$this->username, $password) ) { 
// Auth failed! lets try at osTicket database 
return (strlen($this->passwd) && strcmp($this->passwd, MD5($password))==0)?(TRUE):(FALSE); 
// return(FALSE); 
} 
else{ 
// Auth succeeded! 
return(TRUE); 
} 
// End Changes 
}

}

However, it seems that I'm still not able to connect. I'm assuming this is because I need to use OD and not Active Directory. Any help would be greatly appreciated.

Thank you, Aaron

Answer 1

Your issue is that it is trying to do a password compare, between the passed in value, and the value in the target directory.

Your added line: strlen($this->passwd) && strcmp($this->passwd, MD5($password))==0)?(TRUE) is trying to MD5 hash the password the user entered and compare to the retrieved password.

But that makes a pair of HUGE assumptions, that the directory you connect too is:

1. Using MD5 as the hash for the password
2. Willing to return that hash

You really should be doing a test bind, and if it succeeds, yay, if not, nay! You ought to be able to do a password compare function as well.

A test bind is nicer as it increments last login times in most directory systems as well.