Helpdesk Installation and Configuration

Web-Application Activation End-users Management Enrollment

  Download PDF

1. Overview

The purpose of this web application is to provide an easy-to-use interface for the most common “tier 1” support task, typically performed by a Help-Desk function in a company IT organization.

This Web application is designed for internal (corporate) use and includes several self-management features like:

• Activate users for OpenOTP use
• View and manage account information such as email, mobile phone numbers, etc…
• Reset LDAP password
• Send password reset or token registration links
• Enroll, re-synchronize and test a Software / Hardware Token or Yubikey
• Manage user certificates
• Manage SSH keys (SpanKey)

Administration HelpDesk web application must be installed on your WebADM server(s) and can be accessed through WAProxy or another reverse proxy configured with WebADM.

2. Installations

The installation of the Administration Help Desk is straightforward and only consists of running the self-installer or installing it from the RCDevs repository.

2.1 RedHat Repository of RCDevs

On a RedHat, CentOS or Fedora system, you can use our repository, which simplifies updates. Add the repository:

yum install https://repos.rcdevs.com/redhat/base/rcdevs_release-1.1.1-1.noarch.rpm

Clean yum cache and install the Administration HelpDesk (HelpDesk):

yum clean all
yum install helpdesk

The Administration Help Desk application is now installed.

2.2 Debian Repository of RCDevs

On a Debian system, you can use our repository, which simplifies updates. Add the repository:

wget https://repos.rcdevs.com/debian/base/rcdevs-release_1.1.1-1_all.deb
apt-get install ./rcdevs-release_1.1.1-1_all.deb

Clean cache and install the Administration HelpDesk (HelpDesk):

apt-get update
apt-get install helpdesk

The Administration HelpDesk application is now installed.

2.3 Self-Installer

Download the Administration Help Desk package from the RCDevs website, copy it on your WebADM server(s) and run the following commands:

[root@webadm1 tmp]# gunzip HelpDesk-1.0.0.sh.gz
[root@webadm1 tmp]# sh HelpDesk-1.0.0.sh 
HelpDesk v1.0.0 Self Installer
Copyright (c) 2010-2023 RCDevs SA, All rights reserved.
Please report software installation issues to bugs@rcdevs.com.

Verifying package update... Ok
Install HelpDesk in '/opt/webadm/webapps/helpdesk' (y/n)? y
Extracting files, please wait... Ok
Removing temporary files... Ok
HelpDesk has been successfully installed.

Administration Help Desk is now installed and can be configured under the WebADM Admin GUI.

3. Administration HelpDesk Configuration

Once the package is installed, the web application must be enabled and configured in WebADM. Log into WebADM as Administrator and navigate to Applications Tab > Self-Service > Administration Help Desk (HelpDesk) > REGISTER.

Next click CHECK to set the mandatory settings and review/adjust the defaults.

The setting AdminGroups must be configured before the application can be used. It is specific to each deployment so there is no default value.

Navigate to Applications Tab > Self-Service > Administration Help Desk (HelpDesk) > CONFIGURE to set the mandatory settings and review/adjust the defaults.

Since the Administration Help Desk application provides administrative access to the system, it is strongly advised to limit the access to it only to trusted networks and to protect the login with a second factor. With this in mind, the application can be published through the WebADM Publishing Proxy with the setting Publish on WAProxy. This setting is only available when WAProxy is configured with WebADM. Have a look at this documentation to setup WAProxy.

3.1 Mandatory Setting

3.1.1 Admin Groups

The setting AdminGroups must be configured before the application can be used. It is specific to each deployment so there is no default value.

Admin Groups: To log in to the Administration Help Desk, the user must belong to a group configured in the Admin Groups Setting. You can have more than one group here and a user can be a member of multiple groups.

Create an Admin Group therefore go to the Create Tab.

Set a Common Name for example Group_Admins and add at least one Admin User to the Group Member.

Click on the Proceed and finally Create Object button to create the group.

Navigate to Applications Tab > Self-Service > Administration Help Desk (HelpDesk) > CONFIGURE.

Navigate to Main config > Admin Groups and add for example the previously created Group_Admins group.

Finally scroll down and click Apply.

3.2 Main Config

3.2.1 User Search Scopes

User Search Scopes: This setting defines which parts of the LDAP directory are searchable and visible in the Administration Help Desk.

3.2.2 User Search Attributes

User Search Attributes setting is also mandatory, but it has a default value. This setting defines the LDAP attributes which are searched when you perform a user search in the Administration Help Desk. You should adjust it to match what attributes are relevant for search in your LDAP directory.

3.2.3 Defining Administrative Help Desk Access per Group

An alternative to the general settings (i.e. a list of groups/users which can all manage the same list of users) is to allow specific groups to access specific users OU.

For each group, you can then configure the User Search Group setting.

The setting in this example would restrict the members of cn=helpdesk-internal to only see and manage the users under ou=Internal,o=root.

3.3 WebApplication Settings

3.3.1 Change the Look

Change the look of the Administration Help Desk with a custom CSS File. Simply add the new customized CSS files and additional custom resources under /opt/webadm/lib/htdocs/custom/.

3.3.2 Other Settings

The settings under Allowed features define what actions are possible from the Administration Help Desk:

The settings under OTP Token Management define the types of OTP tokens which can be registered through Administration Help Desk and what is the default token type for registration:

The settings under Emergency OTP Management define the Emergency OTP availability and duration when" registered through the Administration Help Desk:

The settings under SSH Key Management define what types of SSH keys can be registered through the Administration Help Desk:

4. LDAP Attributes

The Users’s attributes like Email Address, Mobile Phone Number etc can also be added via the WebADM GUI. Enable Advanced edit mode to add more attributes.

4.1 User Search Scopes

The setting in this example would restrict the members of cn=helpdesk-internal to only see and manage the users under ou=Internal,o=root.

Create the Group cn=helpdesk-internal.

Select the Group Members like admin.

Create the Organizational Unit ou=Internal,o=root.

Activate the Group cn=helpdesk-internal.

Add the Attribute Webamdsettings.

Click on Administration Help Desk, select the User Search Scope and set it to ou=Internal,o=root. At the bottom of the page, hit Apply.

Move the users, for example, test-user to ou=Internal,o=root.

Navigate to Applications Tab > Self-Service > Administration Help Desk (HelpDesk) > CONFIGURE. Verifiy that the User Search Scopes is not set.

Finally, check in the HelpDesk if only the test-user can be searched.

Other users will not show up in the User Search.

4.2 User Search Attributes

The LDAP attribute User Search Attributes defines which attributes are searched when a search in the Administration Help Desk is done. You should adjust it to match what attributes are relevant for search in your LDAP directory.

5. LDAP Permissions

Actions done from the Administration Help Desk application are executed with the proxy_user to the LDAP directory, or with Login DN user permissions in case of LDAP Mount Point. Please see the proxy_user rights document for further details.

6. Token Enrollment

Please see the Administration Help Desk Token for further details.

7. Secure Mail

Please see the Email (OTP, Alerts) for further details.