Page 1 of 2
[SOLVED] waptselfservice group
Published: May 3, 2024 - 2:25 PM
by yann83
Hello,
for the Self service, we need to create a group specifically named "waptselfservice"
(https://www.wapt.fr/fr/doc-2.5/wapt-sel ... inistrator).
However, in our Active Directory, each user is the master of a primary Organizational Unit (OU), and we cannot interact between OUs.
Therefore, someone has already created the group outside of our OU. Consequently, we have no control over this group.
Is it possible to rename "waptselfservice"?
Re: waptselfservice group
Published: May 3, 2024 - 3:26 PM
by dcardon
Hello Yann83,
WAPT version, server OS, client OS, etc. See forum rules.
Regards,
Denis
Re: waptselfservice group
Published: May 3, 2024 - 4:01 PM
by yann83
This is a WAPT Enterprise 2.5.4 15342 server
on a CentOS 7 server with Windows 10 22H2 Pro clients
Re: waptselfservice group
Published: May 3, 2024 - 4:07 PM
by dcardon
Hello Yann83,
the waptselfservice AD group is only used when you are on the WAPT community platform. If you are on the Enterprise version, you can use any groups you want in your Self Service rule packages.
Regards,
Denis
Re: waptselfservice group
Published: May 6, 2024 - 8:29 AM
by yann83
Good morning,
So I created my self-service like this:
- 04033_WAPTConsole_Enterprise_version_2.5.4.15342.png (69.88 KB) Viewed 11857 times
Knowing that I am part of the IT group, when I open the cafeteria my package does not appear
[/code]
- 04034_WAPT_Self-service.png (33.56 KB) Viewed 11857 times
My wapt-get.ini file is as follows:
Code: Select all
[global]
repo_url=https://monserveur/wapt
wapt_server=https://monserveur
verify_cert=C:\Program Files (x86)\wapt\ssl\server\monserveur.crt
use_kerberos=1
use_repo_rules=True
On the waptserver.ini
Code: Select all
[options]
secret_key = secret
token_secret_key = secret
server_uuid =secret
waptwua_folder = /var/www/html/waptwua
wapt_huey_db = /opt/wapt/db/waptservertasks.sqlite
wapt_password = secret
clients_signing_key = /opt/wapt/conf/ca-serveur.pem
clients_signing_certificate = /opt/wapt/conf/ca-serveur.crt
clients_signing_crl = /var/www/html/ssl/ca-serveur
clients_signing_crl_url = http://serveur/wapt/ssl/ca-serveur.crl
ssl_additional_crls = /var/www/html/ssl
login_on_wads = True
list_subnet_skip_login_wads = 10.200.5.0/22
wapt_admin_group_dn = CN=GROUPE-ADMIN-WAPT,OU=Groupes de Sécurité,OU=Groupes,OU=Utilisateurs,OU=entite1,OU=entreprise,DC=nom,DC=nom
ldap_auth_base_dn = OU=Utilisateurs,OU=entite1,OU=entreprise,DC=nom,DC=nom
ldap_auth_server = serveurAD
ldap_account_service_login = compte-lecturead@nom.nom
ldap_account_service_password =motdepasse
ldap_auth_ssl_enabled = True
ldap_nesting_group_support = True
use_kerberos = True
allow_unauthenticated_registration = False
Re: waptselfservice group
Published: May 6, 2024 - 11:15 AM
by dcardon
Hello Yann83,
could you please embed the images directly in the post? I had disabled external images, but it seems that completely disabled the img tags. I've re-enabled the images.
Using external resources doesn't guarantee the longevity of the post's content (which is useful for people who revisit it later) because the link could break in the future, and also, URL shorteners don't really allow users to know what they're clicking on.
Sincerely,
Denis
Re: waptselfservice group
Published: May 6, 2024 - 12:56 PM
by sfonteneau
I see that:
ldap_auth_base_dn = OU=Users,OU=entity1,OU=company,DC=name,DC=name.
Looking at the code, it seems that the basedn is used for group search.
I assume the group isn't in "OU=Users,OU=entity1,OU=company,DC=name,DC=name".
Would it be possible to change it to DC=name,DC=name?
Re: waptselfservice group
Published: May 6, 2024 - 1:17 PM
by yann83
The groups are in sub-OUs of the Users OU.
Re: waptselfservice group
Published: May 6, 2024 - 1:47 PM
by sfonteneau
Regarding the group name (which we cannot see), could you try putting everything in lowercase in the ad and in the self-service rule package?
Re: waptselfservice group
Published: May 6, 2024 - 1:48 PM
by sfonteneau
Another known issue is that the account "
reading-account@name.name" must be able to read the "memberof" attribute of users; is this correct?