Active directory integration

[Hybrid]

e-mail sent

[Hybrid]

This proxy address wont have anything to do with we are actually just hosting the helpdesk internally?

Both the helpdesk and AD are on the same internal network? So surely it shouldnt be using the proxy?!

[c-wex]

Originally Posted by Varun [K]

Kind Of, What other ideas do you have? The current implementation is the best approach we could think of.

Regards,

Varun Shoor

As i see it you have tried to implement some kind of restricted group thought.

I like it ! Maybe just more advanced ...

Maybe a securitygroup concept that actually carries the access control to the whole support suite.

Today you only have 1 group membership.
If you could assign more (security)groups to the users and then from the admin CP decide wich areas of the supportsuite was to be accessible for members of theese groups. I think if you are able to set a "read" property to "allow" or "deny" for the different areas you could go by a "least restrictive wins" concept.

There should be a everyone group = like you default template that could be used to setup the default, nonloggedin page, then after the login you validate the users membership of other less restrictive groups.

Also you could then use theese groups to define what kb areas and kb articles should be accessible for certain groups.

The same goes for the news articles, it would be cool to be able to differentiate which users get which news.

I think that meberships is to be handled serverside in sessions or something like that .. it should not be possible at any time to call a group from "outside" through querystrings or posts unless you are validated serverside.

I realize that this is a big operation, but it would make the supportsuite very cool ... at least for me and a customer i have that currently needs this kind of functionality. He is not buying kayako based on the lack of the above.

However today i think that if the group is decided on login, then put the group into a sessionvar, you would be a long way.
Now i have to say that I am an ASP coder, and ASP does sessionvariable handling really good. I do not know if PHP can do this (think i heard something about it had some tricky stuff to it, but maybe this is fixed ?)

btw the knowledgbase widget also shows new articles to users that should not be able to see them.

eg. if i have one user that is running default template, he can see the latest articles even if the category is assigned another templategroup. It is first when the user clicks on the article he is denied access.

Confused ?

Ok i have a lot of issues on this, and maybe i need to sit for a while to make my concrete description, but here was some thougts

[Varun Shoor]

Some Interesting Stuff but that would require some serious revamping of the entire permission framework, we are going to brainstorm it here next week and see if we come up with some more ideas.

Regards,

Varun Shoor

[c-wex]

but that would require some serious revamping of the entire permission framework

Yup ! I Know that !

[Hybrid]

anyone have any more ideas?

Its still not working :/

[Hybrid]

04 Dec 2005 10:21:32 PM: Connecting to LDAP Server: 172.16.0.1:389
04 Dec 2005 10:21:32 PM: Connected!
04 Dec 2005 10:21:32 PM: Binded to: CN=administrator, CN=Users, DC=STBEDES, DC=internal, PASS: ******
04 Dec 2005 10:21:32 PM: Starting the validation process
04 Dec 2005 10:21:32 PM: Connecting to LDAP Server (AGAIN): 172.16.0.1:389
04 Dec 2005 10:21:32 PM: Connected!
04 Dec 2005 10:21:32 PM: User Binded to: CN=administrator, CN=Users, DC=STBEDES, DC=internal, PASS: ******
04 Dec 2005 10:21:32 PM: Registering User:

This seems to be as far as it gets, as you can see it gets stuck on registering user.

The DB username has full access to the DB so that cant be the problem or does Kayako not store usernames there?

Anyone?

[Varun Shoor]

The problem is with email addresses, dont you store the user emails under proxyAddresses?

Regards,

Varun Shoor

[Hybrid]

where abouts in AD will that be and i will check.

Thanks for this.

[Varun Shoor]

proxyAddresses field, thats what SWIFT uses to fetch the emails, if you store them in a different field then let me know.

Regards,

Varun Shoor

[Hybrid]

At the moment we just have the e-mail addresses store in the profile...



That is the only reference to an e-mail address we have in our AD.

Where abouts 'should' they be stored?

Thanks

[Varun Shoor]

Hrmm, I am not sure what "field" they fall under. Basically we work around certain set of fields passed to me (like samaccountname, proxyAddresses etc) each of the fields you see in that capture have a unique id, I need the ID for that email field if possible.

Regards,

Varun Shoor

[Hybrid]

http://www.computerperformance.co.uk..._directory.htm

according to that the field is just called... 'mail'

That the one?

[Varun Shoor]

Seems like it, Can you email me again so I can send you the debug LoginShare Plugin?

Regards,

Varun Shoor

[Hybrid]

Done - e-mail sent