[SOLVED] waptselfservice group

[yann83]

Hello,

for the Self service, we need to create a group specifically named "waptselfservice"

(https://www.wapt.fr/fr/doc-2.5/wapt-sel ... inistrator).

However, in our Active Directory, each user is the master of a primary Organizational Unit (OU), and we cannot interact between OUs.
Therefore, someone has already created the group outside of our OU. Consequently, we have no control over this group.
Is it possible to rename "waptselfservice"?

[dcardon]

Hello Yann83,

WAPT version, server OS, client OS, etc. See forum rules.

Regards,

Denis

[yann83]

This is a WAPT Enterprise 2.5.4 15342 server
on a CentOS 7 server with Windows 10 22H2 Pro clients

[dcardon]

Hello Yann83,

the waptselfservice AD ​​group is only used when you are on the WAPT community platform. If you are on the Enterprise version, you can use any groups you want in your Self Service rule packages.

Regards,

Denis

[yann83]

Good morning,

So I created my self-service like this:

04033_WAPTConsole_Enterprise_version_2.5.4.15342.png (69.88 KB) Viewed 11854 times

Knowing that I am part of the IT group, when I open the cafeteria my package does not appear

[/code]

04034_WAPT_Self-service.png (33.56 KB) Viewed 11854 times

My wapt-get.ini file is as follows:

Code: Select all

[global]
repo_url=https://monserveur/wapt
wapt_server=https://monserveur
verify_cert=C:\Program Files (x86)\wapt\ssl\server\monserveur.crt
use_kerberos=1
use_repo_rules=True

On the waptserver.ini

Code: Select all

[options]
secret_key = secret
token_secret_key = secret
server_uuid =secret
waptwua_folder = /var/www/html/waptwua
wapt_huey_db = /opt/wapt/db/waptservertasks.sqlite
wapt_password = secret
clients_signing_key = /opt/wapt/conf/ca-serveur.pem
clients_signing_certificate = /opt/wapt/conf/ca-serveur.crt
clients_signing_crl = /var/www/html/ssl/ca-serveur
clients_signing_crl_url = http://serveur/wapt/ssl/ca-serveur.crl
ssl_additional_crls = /var/www/html/ssl
login_on_wads = True
list_subnet_skip_login_wads = 10.200.5.0/22 
wapt_admin_group_dn = CN=GROUPE-ADMIN-WAPT,OU=Groupes de Sécurité,OU=Groupes,OU=Utilisateurs,OU=entite1,OU=entreprise,DC=nom,DC=nom
ldap_auth_base_dn = OU=Utilisateurs,OU=entite1,OU=entreprise,DC=nom,DC=nom
ldap_auth_server = serveurAD
ldap_account_service_login = compte-lecturead@nom.nom
ldap_account_service_password =motdepasse
ldap_auth_ssl_enabled = True
ldap_nesting_group_support = True
use_kerberos = True
allow_unauthenticated_registration = False

[dcardon]

Hello Yann83,

could you please embed the images directly in the post? I had disabled external images, but it seems that completely disabled the img tags. I've re-enabled the images.

Using external resources doesn't guarantee the longevity of the post's content (which is useful for people who revisit it later) because the link could break in the future, and also, URL shorteners don't really allow users to know what they're clicking on.

Sincerely,

Denis

[sfonteneau]

I see that:

ldap_auth_base_dn = OU=Users,OU=entity1,OU=company,DC=name,DC=name.

Looking at the code, it seems that the basedn is used for group search.

I assume the group isn't in "OU=Users,OU=entity1,OU=company,DC=name,DC=name".

Would it be possible to change it to DC=name,DC=name?

[yann83]

The groups are in sub-OUs of the Users OU.

[sfonteneau]

Regarding the group name (which we cannot see), could you try putting everything in lowercase in the ad and in the self-service rule package?

[sfonteneau]

Another known issue is that the account "reading-account@name.name" must be able to read the "memberof" attribute of users; is this correct?