Requirements (on-premise)

Here are the configuration steps including configuration phases on the Azure side.

Install the plugin

• See you in the marketplace. Download Oauth IMAP and enable it

• Meet now on your Azure tenant

• In the search box type registration then select app registrations

Register your Entra application

Create the application

• Click on new registration

• Indicate the desired name, select the type of account supported then indicate the redirection URL (present in the configuration of the plugin from your GLPI interface: https://XXXXXXXXXXXXXX/marketplace/oauthimap/front/authorization.callback.php) specifying the Web option.

• Then click on register.

Add a secret

• In the Certificates and secrets tab , click on Client secrets

• then New client secret

• Enter a description and then an expiration date.

• A secret value is then generated. Keep this value well because once you have left this page, it will no longer be recoverable.

• Return to the " Overview " tab and copy the following values ​​and the secret seen above

Setup GLPI

• Now go back to your GLPI interface configuration > Application Aouth IMAP and indicate the information collected previously :

• Click add .

• Now in the Oauth authorization tab , we will create an authorization

• When you click on create authorization, you will be redirected to the Microsoft services sign-in page.

• Enter the email address and password of the account that will be used for the collector.

• You will also need to accept the necessary permissions related to the plugin.

Setup the receiver

• See you now in setup > receivers to configure it:

The information concerning the files to be collected is according to your needs.

Requirements (on-premise)

Here are the configuration steps including configuration phases on the Azure side.

Install the plugin

• See you in the marketplace. Download Oauth IMAP and enable it

• Meet now on your Azure tenant

• In the search box type registration then select app registrations

Register your Entra application

Create the application

• Click on new registration

• Indicate the desired name, select the type of account supported then indicate the redirection URL (present in the configuration of the plugin from your GLPI interface: https://XXXXXXXXXXXXXX/marketplace/oauthimap/front/authorization.callback.php) specifying the Web option.

• Then click on register.

Add a secret

• In the Certificates and secrets tab , click on Client secrets

• then New client secret

• Enter a description and then an expiration date.

• A secret value is then generated. Keep this value well because once you have left this page, it will no longer be recoverable.

• Return to the " Overview " tab and copy the following values ​​and the secret seen above

Setup GLPI

• Now go back to your GLPI interface configuration > Application Aouth IMAP and indicate the information collected previously :

• Click add .

• Now in the Oauth authorization tab , we will create an authorization

• When you click on create authorization, you will be redirected to the Microsoft services sign-in page.

• Enter the email address and password of the account that will be used for the collector.

• You will also need to accept the necessary permissions related to the plugin.

Setup the receiver

• See you now in setup > receivers to configure it:

The information concerning the files to be collected is according to your needs.

Creating an Entra application

Register an Entra application

• Log in to your Entra portal

• In the Applications > Application registration > new application menu

• Enter an application name, then in URI redirection, enter web.

• Retrieve the GLPI redirection URL available in configuration > notifications > configuration of email notifications. In way of sending emails, select SMTP+OAUTH.

• You will see the redirection URL in the new menu that appears. Copy it and paste it into the redirection URI of your Entra application.

• Click on Save.

Creating the secret

• Now go to certificate and secret.

• Click on new client secret.

• Enter a name and an expiry date.

• Then click on add

• Once validated, the secret value appears.

Adding claims

The addition of claims is necessary so that GLPI can use the SMTP service via the Entra application.

• In the claims tab, click on your application (in this case Microsoft graph).

• On the right-hand side of the screen, search for smtp.

• select it then click on update permissions.

Last GLPI settings

• Return to the application's overview menu to find the information you need to enter into GLPI.

• We filled in the secret value in the previous step, all that remains is to fill in the application ID and the directory ID.

• When you click on save, you will be redirected to the Microsoft account to be connected.

Authenticated SMTP configuration

In order for the account using SMTP services to be authorised to send mail, it is imperative to activate authenticated SMTP from the Entra Tenant.

• Connect to your tenant

• Go to users and click on the relevant account

• Then go to mail > manage mail applications and select SMTP Authenticated

Send test

• Once you have entered your Microsoft account details, you will need to accept the necessary authorisations. All that's left is to carry out a test send.

References

GLPI documentation "Email followups configuration"

Creating an Entra application

Register an Entra application

• Log in to your Entra portal

• In the Applications > Application registration > new application menu

• Enter an application name, then in URI redirection, enter web.

• Retrieve the GLPI redirection URL available in configuration > notifications > configuration of email notifications. In way of sending emails, select SMTP+OAUTH.

• You will see the redirection URL in the new menu that appears. Copy it and paste it into the redirection URI of your Entra application.

• Click on Save.

Creating the secret

• Now go to certificate and secret.

• Click on new client secret.

• Enter a name and an expiry date.

• Then click on add

• Once validated, the secret value appears.

Adding claims

The addition of claims is necessary so that GLPI can use the SMTP service via the Entra application.

• In the claims tab, click on your application (in this case Microsoft graph).

• On the right-hand side of the screen, search for smtp.

• select it then click on update permissions.

Last GLPI settings

• Return to the application's overview menu to find the information you need to enter into GLPI.

• We filled in the secret value in the previous step, all that remains is to fill in the application ID and the directory ID.

• When you click on save, you will be redirected to the Microsoft account to be connected.

Authenticated SMTP configuration

In order for the account using SMTP services to be authorised to send mail, it is imperative to activate authenticated SMTP from the Entra Tenant.

• Connect to your tenant

• Go to users and click on the relevant account

• Then go to mail > manage mail applications and select SMTP Authenticated

Send test

• Once you have entered your Microsoft account details, you will need to accept the necessary authorisations. All that's left is to carry out a test send.

References

GLPI documentation "Email followups configuration"

Creating a project

• Enter the name of your project

• Click on create
• Return to your organisation,

• Select your project

Setting up Oauth access

• From the menu, click on APIs & Services.

• Then OAuth consent screen.
• select the type of access that will be granted to the application (internal or external users)

• Then click on create.
• Enter (as a minimum) a name for the application, an email address for application support and the developer's email address (this information is compulsory).

• Click on save and continue.

• In the scope section, click on add or remove scopes.

• Add auth/userinfo.email auth/userinfo.profile and openid.
• Click on update

• Then save and continue

ID settings

• From the credentials menu, click on create credentials then Oauth client ID.
• Enter an application name,

• In the authorized redirect URL section, enter the GLPI callback URL.

• Click on create

• A page appears with the username values. Keep this information as it will be requested in GLPI.

Setting up GLPI

• From setup > notifications > configuration of email notifications

• Select SMTP + OAUTH

• Select Google and enter the information requested, using the screenshot above as a guide

Additional information :

• Click on save

You will be asked for a Gmail account, and you will then need to accept the necessary authorisations.

Yes, it is possible, but note that GLPI Network Cloud offer does not allow compatibility between following tools:

• basic Apache authentication;

• Windows domain authentication.

You can use the following tools:

Authentication server like LemonLDAP NG, Shibboleth, etc;

• CAS;

• X509 certificate;

• oAuth (with oAuth plugin).

You can configure your authentication in the Setup > authentication menu.

For authentication via oAuth, make sure that oAuth plugin is installed and activated on your instance in setup > plugins.

Access the plugin's configuration by clicking on it or by setup > Oauth SSO applications

In this article we will show how to subscribe to the GLPI Network Cloud paid offer.

I already have an account and instance

Go to your account here.

Before subscribing to paid offer, we ask you to check MY ACCOUNT menu on your Dashboard. Your profile may still be incomplete.

We invite you to fill it with your real data before subscribing to paid offer, so we can correctly issue the invoices.

Once your profile is complete, return to your Dashboard.

You will see an orange pop-up indicating the time remaining of your trial period and allowing you to switch to the paid offer by adding payment information to your customer area.

You will be offered to select between two methods of payment:

• Credit or debit card

• SEPA Mandate (soon available automatically)

Do not hesitate to contact us to discuss another payment options.

Once your payment method is selected, your trial period will be canceled and you will be transferred to the paid offer. You will also receive an email with the validation of your payment and your first invoice.

In the customer area, you will be redirected to Dashboard.

Go to My applications and options, you will find summary of your offer.

You are now a GLPI Network Cloud customer, thank you for your trust!

I do not have an account or an instance

To create your customer account and your first GLPI Network Cloud instance, go here: https://myaccount.glpi-network.cloud/register.php

Please enter your authentication information and the URL for your first GLPI instance.

Once your information is validated, click on Create my instance. You will be asked to wait during the installation of your instance.

Once the installation is complete, you will be taken to your customer area. You will see the following information:

• The URL of your GLPI Network Cloud instance

• The Super Admin account ID

• The associated password

By clicking on Go to my GLPI Network C1 Instance, you will be redirected directly to the URL you have chosen. Feel free to test it and contact us if you have any questions! You will also find useful articles in our FAQ to help you to understand and start using GLPI.

If you have decided to switch to the paid offer, please, return to your customer area: https://myaccount.glpi-network.cloud/ Your login details for the customer area are:

• Login: the email address entered at registration

• Password: The password entered at registration

After this step is complete, we invite you to read the first section of this article: I already have an account and instance.

In this article, we will expose solutions to benefit from your local LDAP authentication on your GLPI Network Cloud instance.

Opening your local directory

To benefit from your local LDAP directory, it is necessary to make it accessible from Internet.

That passes by the installation, on your infrastructure, of protocol LDAPS what will allow your directory LDAP and your instance GLPI Network Cloud to communicate in a protected way.

According to your infrastructure, it is also interesting to set up filtering to guarantee that only your instance GLPI Network Cloud can attack your LDAP directory from outside. ( IP address of your instance here )

1. You must prepare your environment for the use of the LDAPS protocol;

   1. LDAPS protocol enabled/accepted (depending on your environment);

   2. Port 636 open/accepted on your network from Internet/your GLPI Network Cloud instance.

2. You can finally configure the LDAP(S) authentication in your GLPI Network Cloud instance.

Synchronize your local directory on a Cloud directory (Azure AD)

This adds an intermediary and requires more configuration but allows you to benefit from your local directory if you do not want to expose it directly.

1. Subscribe to Azure AD

2. Synchronize your local directory with Azure AD;

Dedicated VPN via the subscription of a GLPI Network Cloud Private offer

Subscribing to a GLPI Network Cloud Private offer will allow you to call upon our team to set up a dedicated VPN between your GLPI Network Cloud instance and your infrastructure.

1. Subscribe to a GLPI Network Cloud Private offer;

2. Migration or deployment of your private instance;

3. Ask for the implementation of a dedicated VPN;

4. Planning / Implementation / Validation of the VPN with a technician of our team.

Reminder of use

Let's first remember that using an Entra directory allows two features with GLPI:

• Synchronize users

• Authenticate them.

Authentication can be done in two ways:

• LDAPS authentication via directory synchronization (of users) in GLPI

• Oauth SSO authentication (sync is not required)

We will now detail the configurations of these features.

Directory synchronisation and/or LDAPS authentication

Entra AD requires the use of the LDAPS protocol to be synchronized. Microsoft has fully documented the configuration of its environment for the use of LDAPS. We therefore invite you to follow the official documentation here in order to prepare your Entra AD environment.

• Remember that you can determine the IP address of your GLPI Network Cloud instance by following the article here, if you want to establish LDAPS access rules on your Entra AD environment.

• Also remember to create a service account (a user) in your directory, only dedicated to the interconnection between GLPI and your Entra AD directory.

Once your Entra AD environment has been prepared for LDAPS, go back to GLPI!

You must create an LDAP Directory type authentication source.

• Go to the Setup > Authentication > LDAP Directory

• Clicking on add to add a new directory

• We had to setup the new directory for LDAPS connections

Explanation of fields :

• Name The name to enter here will be the one displayed in the liste of your directories, it doesn't influence the configuration.

• Default server This parameter allows you to define if this directory should be used as a priority.

• Active With this parameter, you can activate or not the directory

• Server In front of IP or FQDN of you rLDAP server, add ldaps:// , e.g : ldaps://Entra.mycompany.com or ldaps://xxx.xxx.xxx

• Port Enter the port of your LDAP. LDAPS requires port 636

• Connexion filter You can set a condition for the search. It possible to filter the user's search to a reduced number of records.

For Active Directory, use the following filter, which returns only no-disabled users (because machines are also considered users by AD):

(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

This filter is a standard example, you can modify it to your need.

• BaseDN

For standard use, the parameters to enter are very simple, for example :

If your Server = Entra.mycompany.com

So your BaseDN = dc=mycompany,dc=com

• RootDN (for non-anonymous binds) Enter here the full DN of the service account that will authenticate with your directory

• Password (for non-anonymous binds) Enter here the password of the service account that will authenticate with your directory. Note that when saving the configuration, this field will appear empty, this is normal, the password will be saved in the database.

• Login field

  • For Entra AD with SSO Authentication! We will indicate the field userprincipalname

  • For Entra AD without SSO authentication! We will indicate the field samaccountname

• Comments This field does not influence the configuration, it is only a text field allowing you to place an indication, a remark, etc.

• Synchronization field In the schemas provided by default, we recommend, for example, using the “objectGUID” attribute (corresponding to the official unique identifier of an object); Be careful with this field, once configured it cannot be modified.

Once the fields are entered, click Add to save your directory.

During registration, a connection test to your directory will be carried out by GLPI !

Additional options

• Once your LDAPS connection has been registered, return to the configuration of your directory on GLPI side.

• In advanced information, change the Use Paginated Results field to Yes

• We recommend changing the page size to 100

• We recommend changing the field maximum number of results to unlimited

Your directory is connected but you have to define options to synchronize.

• To do this, go to your directory configuration and use the Users and Groups tabs by customizing the LDAP attributes you want to synchronize and the settings that are useful to you. This section is complete.

On-premise and GLPI Network Cloud

To check the status of your automatic actions, there is an automatic action whose role is to check the status of the others.

• Go to the menu setup > Automatic actions, and select the watcher automatic action.

This automatic action will send you, by e-mail (if you have correctly configured Notifications), the actions in error. More precisely, these are all actions whose status remains indefinitely on "In progress".

It is also possible to manually check the status of an automatic action in its configuration page, and to restart it by clicking on the Reset cross just to the right of the current execution status:

GLPI Network Cloud ONLY

References

Dashboards are already present when you install GLPI:

• Central: displays overall information (represents number of PCs, telephones, monitors, etc., number of users and groups, number of tickets, problems, changes, etc.)

• Assets: shows the elements of the portfolio with computer-type graphics by status, by manufacturer. Computers by type, network hardware by manufacturer, and more.

• Assistance: lists tickets and their status. Graphs are available such as tickets by status and month, top ticket categories, number of incoming tickets, assigned tickets, etc.

• GLPI inventory reports: shows the number of agents, tasks, elements in the fleet, etc.

All these tables are of course modifiable.

Creating a new dashboard

Added new dashboard

In this example, we will add a global view of the number of tickets and their status as well as an assignment filter by user or group.

• From the main GLPI view (by clicking on the logo at the top left), click on

• Enter a name for your dashboard then click on add

• Position your mouse where you want to position your tile and click on

• In the window for selecting the type of data to display, choose the one that suits you (here ticket summary)

• Depending on the data selected, you may be asked to choose the type of chart that will be displayed

1. Select the background of your tile 2. Select chart type 3. Select the gradient from the palette (shade of gray displayed per tile) 4. Select the number of data to display (the number of data reflects the number of statuses your tile will display)

• Click on edit

• You can enlarge your tile by selecting and stretching it

You can then add as many tiles as you want.

Add filter

The filter will display the result of the tile for a given element. In our example, for a particular group.

• Click on add filter

• Select technician group

• Click on add

• When you are satisfied with your dashboard, click on to exit edit mode

If you want to display all the tickets in a group, you can now do so by selecting the desired group from the technician group filter

You can also access the items by clicking on the desired status. For example, if I want to display all tickets in pending status for group 1, I choose group 1 in the filter and then click on the pending line to display the result in the support tab.

Dashboard options

In the menu at the top right, you can see a number of possible options:

Refresh data

Clone a dashboard

Share a dashboard

1. Direct link: this public link can be communicated. It will be accessible without identification and will be displayed in full screen. Only viewing this dashboard will be possible (except if the recipient has a GLPI account on the instance with the necessary authorizations to modify it) 2. Iframe: allows insertion into a web page 3. Share with targets: allows sharing with other profiles, entities, users or groups. 4. Personal: Specify whether this dashboard is private or not. A personal dashboard is not visible to other administrators unless you explicitly share it

Delete a dashboard

Edit a dashboard

Show full screen

Define a business opening period

• From setup > dropdowns, enter calendar and click on calendars.

• Click on add

• Name your calendar,

• In the time ranges tab, select the 1st day of opening and the start and end times of the day. If you need to create a lunch break, you will need to create 2 entries per day (e.g. Monday 9am-12pm then Monday 2pm-7pm).

• Click on add for each entry you make

!!! Tip "Different days and times for each entity" You can create several opening times on different entities. For example :

  - **Entity A**: Monday to Friday, 9am to 7pm
  - **Entity B**: Monday to Saturday from 8am to 6pm

  ![Alt text](Pics/Calendar-2-bis.png)

Create a closing date/period

• From setup > dropdowns, enter closing and click on closing periods.

• Click on add,

• enter a name,

• a start date,

• an end date,

• and a recurrence.

!!! tip "Recurrence information" If you add a recurring period, for example from Monday 7 August 2023 to Sunday 20 August 2023. The recurrence will apply to the same dates the following year, i.e. from Wednesday 7 August 2024 to Tuesday 20 August 2024. Please check that your information is consistent before validating a recurrence.

Defining a closing date/period for an entity

Requirements within a company are not always the same. For example, in entity A, closing days may differ from entity B. You can therefore set up different closing days and separate holidays.

If this is your case, make sure you create opening days and times in the correct entities (you can always skip the transfer list if you make a mistake).

• From setup > dropdowns, enter calendar and click on calendars

• click on the calendar that is to receive a different day/period of holidays, click on closing periods,

• in the closing periods tab, select the period created earlier,

• click on add

Delete a holiday date/period

• From setup > dropdowns, enter closing and click on closing periods.

• Click on the period you wish to delete,

• click delete permanently.

If you have several to delete, you can skip the select-entries, actions then delete permanently.

!!! Warning "Caution" This will permanently delete the entry for ALL entities

For more options

You can also download the Holiday plugin to enter mass holidays or specific to certain countries or regions.

Creation

Enter the ticket that requires a task to be added. Click on answer > create a task (or on create tasks directly depending on the configuration of your interface):

or

Add a follow

As with tracking, you have a text field to indicate the nature of the Task. You can define whether the Task will be public or private. What differentiates the Task from the Tracker is its right-hand menu.

Type of task

This will allow you to define the status of the Task when it is added: Information / To Do / Done.

Execution time

GLPI lets you define its execution time (this data can be modified later):

Users and groups

You can define which user or group will be assigned to this Task:

Planning

As mentioned above, the best thing about a Task is its scheduling. To do this, click on the Schedule this Task button, which will display the scheduling options.

Duration

You will be able to set a date, start time and duration for the Task. Click on the icon on the right to unfold the calendar:

Save

Once you have entered your details, click on the Add button to save the Task.

Unlike Follow-ups, when adding a Task, you can only select a status for Tickets, the choice of status is not available for Problems and Changes. The ticket will automatically change its status to processing (planned).

• Download the branding plugin from the marketplace

• Activate it.

This allows you to customize the logo in GLPI, on the login page, etc.

To modify the logo :

• Go to your list of plugins: setup > Plugins

• Click on the wrench for the Branding plugin, which will take you directly to the plugin's configuration menu.

• Here you can replace :

• the logo at top left (including folded bar)

• the logo on the login page,

• the background of the login page,

• the icon in the browser bar

• Download the branding plugin from the marketplace

• Activate it.

This allows you to customize the logo in GLPI, on the login page, etc.

To modify the logo :

• Go to your list of plugins: setup > Plugins

• Click on the wrench for the Branding plugin, which will take you directly to the plugin's configuration menu.

• Here you can replace :

• the logo at top left (including folded bar)

• the logo on the login page,

• the background of the login page,

• the icon in the browser bar

To avoid duplicates, the uniqueness of fields function allows you to refuse hardware imports if one of the fields set is identical to another field of the same type of hardware. For example, 2 computers with the same serial number.

• From setup > field unicity, click on add

• Add a :

  • a name

  • A comment (optional)

  • Set active to yes

  • The type of item targeted (computer, telephone, user, etc.)

  • Select the filed that will be considered unique

  • Indicate whether the import should be refused or accepted.

  • Indicate whether a notification should be sent

If a duplicate is created, an error message will appear:

Creating the category

• From configuration > titles, enter ITIL in the search box.

• Click on ITIL category.

• Click on add.

• Enter the necessary information

• Once your category has been created, click on add.

Link a category to a template

A change is a modification, addition or deletion of an element of a company that may have an impact on procedures, infrastructure, etc. A change is often a relatively major event and requires follow-up. It may be linked to a problem and/or one or more tickets.

The change is created as a problem. Additional inserts are available to identify the impacts, monitor the points that will have been modified, and draw up a plan for deployment and fallback if necessary.

Create a change

• From assistance > changes, click on add

• Fill in the title and description fields (they will already be pre-filled if you create a change from a problem).

• The tabs on the right of the screen are standard, you probably already know them from tickets.

• In analyses, 2 new inserts are available:

  • Impacts**: generally lists the impacts of the problem

  • Checklist': the checkpoints to be carried out (or that have been carried out) before any changes are implemented.

Track the change

statuses

Different statuses are available for the changes and can be adapted as the change evolves.

Action plan

When a change is implemented, an action plan must be devised to minimise the impact on production systems.

In our example, the change is the result of a problem that has arisen. Once the causes have been identified, an action plan must be put in place to prevent the problem recurring.

• In your change, a plan insert is available covering 3 phases:

  • deployment plan,

  • fallback plan,

  • checklist.

This insert should be filled in with as much detail as possible.

Change validation (optional)

Once this insert has been updated with the necessary actions, it can be submitted for validation if required. A minimum threshold can be assigned to validate the change.

• From the validation tab, click on send a request for approval.

• Select the validation recipient

• enter a comment

• Click on add

If the validation is positive, you can then put the actions in place. If the validation is negative, you will need to improve your process to obtain validation of the change.

Estimating the cost

You can also estimate the cost of the change. In our case, adding a new server (hardware cost + human cost)

• From the cost tab for your change, add all the expenses associated with implementing the change.

Project

If necessary, you could add a project. For example, if the change you make has repercussions on other departments, you could decide to implement the same solutions for all the other departments. In this case, it could be linked to a business development project.

Tickets

If this change is the result of one or more tickets, you can join them in the tickets tab.

Items

You can indicate all the elements that are impacted or linked by this change.

• Click on add an item.

• Click on the type of element to be added (here indicators)

• And choose the element(s) concerned

Impact analysis

The impact analysis allows you to see the linked elements and to have an overview of the impact that a breakdown in the infrastructure could have.

• To add an item, click on

• Select the type of equipment you wish to add

• Choose the item from the available list

• Use the icon to join elements.

• With the icon you can manage the colours of the relationships between elements.

Knowledge base

You can attach one or more items from the knowledge base

• Click on attach to a knowledge base entry.

• Select the item you want

• Click on add

Closing

Each company has its own validation process. From an ITIL perspective, changes can be considered closed once testing and qualification have been completed. Once the change has been applied and reviewed, it can then be considered closed and the release to production is considered definitive.

It is possible, in GLPI, to add an external calendar so that the events of a diary can go up in GLPI (personal calendar of the diary Google, Microsoft, etc. of a technician for example). This avoids the need to schedule an intervention when the technician is already scheduled for another task but does not appear to be busy in the GLPI schedule.

It is possible to integrate any calendar that can be shared in .ics.

Google

To integrate Google calendar into GLPI, it must be public:

• From your calendar, click on in the top right-hand corner.

• Then Settings.

• In Settings for my calendar, click on the calendar concerned

• In Access permissions for events, click on Make available to public.

• In Integrate calendar, copy the URL from Public address in iCal format.

• Then go to the chapter Setup GLPI

Microsoft

To integrate a calendar from Microsoft, you need to publish it. Cela rend le calendrier public. You can then choose which information will be visible.

• Go to settings at top right

• From your mailbox (Web version here), go to calendar

• Then Calendar

• And then Shared calendars.

• In the box Publish a calendar, select the calendar concerned

• Choose the type of permissions

• Cliquez sur Publish

• 2 links will appear, copy the ICS link

• Then go to the Setup GLPI

Setup GLPI

• From Assitance > Planning

• Click in the Schedules box

• Add the necessary information, remembering to paste the link from your schedule that you copied earlier

• Click on Add

Your calendar events are now visible in the GLPI schedule

Add templates

Templates can simplify user requests by pre-filling fields, hiding some or forcing certain fields to be filled in.

In our example, we'll create an incident template to help users report incidents correctly.

• From configuration > titles > ITIL category, select your category

• Click on incident template.

• Enter the name of your template

• Close the template creation confirmation window, then click on de template for an incident.

• Select the newly created template

Mandatory fields

You can add mandatory fields for the simplified interface and/or the standard interface. They will be marked with a

In our example, we're going to force the user to fill in the description and the emergency.

• Select description from the drop-down list, then add.

• Do the same with emergency.

Predefined fields

To guide your users, you can pre-fill fields to make the interface more interactive. This will give you as many elements as possible to help you resolve the incident. In our example, we'll fill in the description field to make it as complete as possible.

• In the predefined fields tab, select description.

• Fill in the information you deem necessary

• Click on add

Hidden fields

Hidden fields avoid overloading the user interface and simplify the writing of the incident.

• In the hidden fields tab, add the fields you don't want to appear in the standard and/or simplified interface.

• Click on add

Preview

You can view the rendering of the simplified and standard interface in the corresponding tabs

ITIL Category

The "ITIL category" tab lets you see which category your template is available in.

You can add different templates for each type of category (request, incident, change, problem). You can also use the same template for several category types.

Link your template to your category

• From configuration > titles, select the relevant category

• In the field for which you want your template to appear, select it from the drop-down list

• Click on save.

From now on, when a user selects the ITIL mailbox category, the template will be selected.

A problem is the source of incidents that can be tracked in GLPI. Symptoms, causes and impacts can be referenced. Problems are most often reported by technicians rather than users.

Create a problem

A problem is created like a ticket.

• From assistance > problems click on add

• Fill in the fields required to report a problem

The special feature of problems is that a analyses insert is available. In this box, you can enter :

• Symptoms

• Impact

• Causes

• Click on add

Link tickets

Problems are often created following feedback from user tickets. You can attach all related tickets to your problem to get a more global view of the impact.

Linking a change

You can link a change if the problem requires a modification to an element of the infrastructure, a procedure, etc.

Please refer to the article change if this applies to you. This section continues the example and shows you how to create and track a change.

Add a cost

The estimated cost of the problem can be added in order to evaluate the expenses incurred.

• Click on add a cost

• Add a name

• Indicate the duration of the problem

• Indicate the different types of cost (time, fixed, material)

• Indicate the budget affected (the total cost will be directly deducted from the budget indicated)

• Indicate the start and end dates of the problem

Project

If the case requires it, you could add a project. For example, if the problem had repercussions on other departments, a project may need to be set up to improve the company's processes or infrastructure. The problem may be linked to a change that gives rise to a project that may impact several departments.

Items

You can add elements affected by the problem. By elements, we mean any element of the park

• From the add an item section, select the type of item concerned from the drop-down list

• Select the item(s) concerned

• Click on add.

Impact analysis

The impact analysis enables you to see the linked elements and to have an overview of the impact that a breakdown in the infrastructure could have.

• To add an item, click on

• Select the type of equipment you wish to add

• Choose the item from the available list

• Use the icon to attach items

• With the icon, you can manage the colours of the relationships between elements.

Note

It is possible to add notes. The note is a free text field with no formatting facility.

Knowledge base

You can add one or more articles to the knowledge base.

• In the Link to a knowledge base entry section, add the article(s) you wish to add.

A reason to wait allows you to put a ticket on hold, send automatic reminders and resolve the ticket if it has not received a response. All these actions are subject to conditions:

• the interval between automatic follow-ups,

• the number of follow-ups before resolution,

• setting up a follow-up template,

• implementation of a solution template.

Create the pending reason

Go to setup > dropdowns and enter pending reasons in the search box.

Click on add

Name your pending reason

Setting up the dunning option

What happens next will depend on your needs. Start by defining the automatic follow-up frequency. In our example, we're going to carry out every 3 days.

Setting up the resolution option

We're going to define that a ticket can be closed after 3 follow-ups.

Define a follow-up template

This template will be used to send out reminders. Click at the end of the follow-up template field

Name your template and indicate the source of the tracking (helpdesk in our case)

Then enter the content of your follow-up, which will be sent to your contact person

Add this follow-up and then select it from the drop-down list

Define a solution template

When this template is added to the ticket, it will close the ticket.Repeat the same process as for the follow-up templateClick on the at the end of the solution template field

Name your templateSelect the solution incident option so that the ticket can obtain the resolved statusAdd your follow-up and select it from the drop-down list.

Your pending reason is now ready, all you have to do is click on add

Adding a reason for pending to a ticket

When you respond to a ticket, you'll be able to click on the pause symbol and select the pending reason you've just created

Automatics actions

In most cases, this problem comes from the execution mode of the automatic action.

In GLPI mode, it is normal for your actions to have trigger problems at night / weekend, because these actions are only triggered by user activity in GLPI interface.

In CLI mode, however, automatic actions will be triggered by our internal system, regardless of activity in GLPI.

CLI mode is therefore recommended, it is activated by default on paid instances (triggering every 15 minutes), if you are in a test period, do not hesitate to contact us, we can activate it on demand.

References

GLPI interfaces with LDAP directories in order to authenticate users, control their access, retrieve their personal information and import groups.

All LDAP v3 compatible directories are supported by GLPI. This is also applies for Microsoft Active Directory (AD). There is no limit for the number of directories filled: of course, the higher the number, the longer the search for a new user to authenticate.

LDAP (port 389)

First, it is necessary to configure the directory in GLPI and test the connection:

• Hover over the "Configuration" menu located in the main menu of GLPI.

• Choose "Authentication".

• Several options of external authentication will be offered to you. Choose "LDAP Directories".

• To add an AD / LDAP directory to your list, click on the "+ Add" icon.

• You will access the configuration page of an AD / LDAP server.

Explanation of the fields:

• Preconfiguration

These two clickable links will allow you to load or delete default values ​​for other fields, in particular for configuring an Active Directory.

• Name

The name you enter here will be the one displayed in the list of your directories, it does not affect the configuration.

• Default server

This parameter allows you to define whether this directory should be used as a priority or not.

• Active

This parameter allows you to activate / deactivate this directory after its creation. This parameter will of course be modifiable at any time.

• Server

Here you will need to enter the FQDN of your server or its IP address.

• Port

Enter the port required for connection to your directory here. By default the port is preloaded in 389.

• Connection filter

We can set up a condition for the search. This allows you to filter the search for users by a reduced name of records.

For Active Directory use the following filter, which returns only users who are not deactivated (because machines are also considered as users by AD):

(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

• BaseDN

Attention, the basedn must be written without spaces after the commas. In addition, breakage is important.

The parameters to enter are very simple, for example:

If your server is = ldap.mycompany.fr

So your basedn = dc=mycompany,dc=fr

• Account DN (for non-anonymous connections)

Enter here the full DN of the service account that will authenticate with your directory

• Account password (for non-anonymous connections)

Enter the password for the service account that will authenticate your directory here. Note that when saving the configuration, this field will appear empty, this is normal, the password will be saved in the database.

• Identifier field

By default, for an LDAP directory, the value will be placed on the "uid" field

For an Active Directory, we will prefer the "samaccountname" field

• Comments

This field does not influence the configuration, it is only a text field allowing you to place an indication, remarks, etc.

• Synchronization field

In the diagrams provided by default we recommend for example to use:

• For Microsoft Active Directory: the attribute "objectGUID" (corresponding to the official unique identifier of an object);

• For a directory based on OpenLDAP: the attribute "entryUUID".

Pay attention to this field, once configured it cannot be modified.

LDAPS (port 636)

If you want to use LDAPS, you have to modify some data:

Server: In front of FQDN of your LDAP server, add ldaps: //, ex: ldaps: //mon.ad.com

Port : The port becomes 636

Once your directory has been saved, return to it to edit its configuration.

In the Advanced Information tab, change Use TLS to Yes.

References

The blacklist identifies the information that will not be retrieved when a PC is inventoried or when users are synchronised.

It is possible to prohibit a certain amount of information, such as IP addresses in 0.0.0.0 or a user with an @yopmail.com email address.

Add a new blaclist

For our example, we will block IPv6 forwarding

• To configure a blacklist, go to Setup > Dropdowns > Blacklists

• Click on +ADD

• Name your new blacklist

• Indicate the value (::1 for IPv6)

• Select the expected value (IP for our example)

Delete a Blacklist

• To delete a blacklist, click on Delete permanently

• You can use massive action to delete one or more blaclists

Plugin GLPI Inventory

Software deployment configuration can be done in three steps:

1. determination of files and / or commands to deploy

2. determination of deployment targets

3. deployment itself

Files

• Go to Administration > GLPI Inventory

• In the tab Deploy > Package management

• Create a new package with add

• Name it

• Add

In this newly created package, in the Actions on package tab we need to configure the four parts that form a package:

• Audits

• Files

• Actions

• User interactions

Each part is configured via small icon

Audits

It is possible to perform checks before starting the package installation process. This part is not essential but may be necessary for optimal deployment.

• Registry check (Windows only)

• Verification of files (all OS)

• Checking free disk space (all OS)

If the audit fails, the following options are available:

• stop the process: do not continue checking, and skip the deployment process

• skip the process: do not continue the process and pass the deployment successfully (package already installed)

• report information: checks continue, failure is reported to the central console

• report warning: checks continue, a warning appears on the central console

Files

In this part, you have to select the data (files) that will be deployed.

Two possible options:

• Download from your computer (pay attention to the maximum size allowed): if you want to upload larger size, please contact Cloud Support.

The administrator can select the files from his computer.

Import options are available for each file:

• Unzip: the agent can decompress zip or tar.gz archives

• P2P: indicates whether the file fragments may be available via P2P or only via the server

• Retention time: during a P2P move, the number of minutes within which the

• Downloaded fragment is available to other agents in the subnet

Download from the server (not available in Cloud environment at the moment)

Actions

Once the files to download are defined, it is necessary to define which actions have to be executed on it or not.

The actions are executed after successful download of the file (s). Here are their types:

• execute an order

• create or delete directory

• move or copy a file

As an example, installation of Firefox :

A mechanism makes it possible to check whether the execution of command has passed correctly. To do this, you can test:

• the return code of the order

• standard output command

User interactions

This feature is not mandatory.

The administrator can decide if to interact with user in deployment process:

• after the execution of audits

• after downloading files

• after the actions

• in case the file download failed

• in case the execution of actions has failed

This functionality is divided into two parts:

• Definition of interaction model

Model records he characteristics of an interaction to be reused next time. It describes both the type of window shown to the user and its behaviour.

The models are accessible via Administration > GLPI Inventory > Deploy > user interaction templates

Example:

Model has :

• a name

• an interaction formation (Windows WTS only)

• a type of interaction: definition of the buttons accessible on the window

• whether or not an icon is displayed

• a number of possible postponements of an interaction

• the time between 2 interaction requests from the user

Then, you must define what would be the behaviour of the system according to the different behaviours adopted by the user, via the Behaviours tab.

Three types of behaviour are possible for each action:

• continue the deployment process

• stop it

• try it again later

Certain events are pre-defined, regardless of the type of choice that the user makes:

• Behaviour in case of no active session

• Behaviour in case of several active sessions (TSE)

• Behaviour in case of the window display time is exceeded (automatic closing)

• Applying the template for package event Once the template is configured, it must be applied.

Going back to our package, select Actions on the package tab in the User Interactions section.

The administrator defines the title and content of the window that will be displayed to the user.

Deployment targets

Once the package is defined, you must define on which workstation (s) it will be installed.

GLPI Inventory offers several types of targets:

• a particular computer

• a computer group based on GLPI group

• a group of GLPI Inventory computers

Usually we mainly use GLPI Inventory groups, which are either static or dynamic.

This configuration is carried out from the Administration > GLPI Inventory > General > Computer group menu.

Static groups

A static group contains machines that have been selected by the administrator. It does not change over time, unless the administrator adds / removes machines.

Create a static group

• From Administration > GLPI Inventory > General > Computer groups

• Click on Add

• Name your group

• Choose Static group

• In the Criteria tab, select the information you want in the search (here we will indicate all jobs located in Paris)

• You can add as many criteria as you like, paying attention to the logical operator (and, or, and not, or not). You can create global rules (entity criteria, user criteria, application criteria, etc.) and/or create groups of criteria (for example, all PCs whose name is Microsoft, whose name contains commerce, with an active status, connected to the switch on the 3rd floor. All these criteria must be met for the PC to be included in the dynamic group).

• Click on Preview to see the list of workstations appear

• Select the workstations concerned

• Use the Actions button to add them to the static group

• The search results will appear in Associated Items.

Dynamic groups.

A dynamic group is the result of a search engine query. The machines in the group are calculated and the list varies over time.

Create a dynamic group

• From Administration > GLPI Inventory > General > Computer groups

• Click on Add

• Name your group

• Choose Dynamic Group

• In the Criteria tab, select the desired information in the search (here we will indicate all workstations whose OS name contains Microsoft and are located in Barcelona).

• You can add as many criteria as you like, paying attention to the logical operator (and, or, and not, or not). You can create global rules (entity criteria, user criteria, application criteria, etc.) and/or create groups of criteria (for example, all PCs whose name is Microsoft, whose name contains commerce, with an active status, connected to the switch on the 3rd floor. All these criteria must be met for the PC to be included in the dynamic group).

• Click on Save.

• The results of the search will appear in Associated items.

Your group is created. If you wish, you can transform it into a static group using the Actions menu.

Deployment

Tasks

Package deployment is done by adding dedicated tasks. Tasks are accessible via Administration > GLPI Inventory > Tasks > Task management.

A deployment task can contain several jobs, which are several actions that agent will execute one after the another.

A task is divided into 3 stages:

• preparation: it is the stage of calculation of targets for which the task must be executed

• execution: it is the stage of sending deployment order from the server to the agent

• the follow-up: it is the stage of display of the follow-up of deployment After creating a task, make it active and define its execution.

It is possible to indicate range of validity of task:

• scheduled start time: start preparation actions from this date

• scheduled end time: stop the validation of task after this date

Jobs

In the task, in the Job configuration tab.

A job is an action to deploy a package to computer or a set of computers.

A job contains:

• Method (package deployment here)

• Targets (package to deploy)

• Actors (target groups)

Deployment is monitored either in the Job execution tab of a task, or via the Administration > GLPI Inventory > Tasks > Monitoring / Logs menu.

In this article we will see how to inventory an Android mobile quick and easy with GLPI Agent and the Agent config plugin.

This requires GLPI inventory plugin installed and activated (in the Setup > Plugins menu).

Plugin Agent Config

In GLPI, in your list of Plugins, you will find Agent config.

This plugin allows you to facilitate the inventory of mobiles by configuring in advance the values ​​to enter to configure the agent.

This plugin will allow you to be scanned via QRcode or a DeepLink to quickly integrate your mobile into your inventory.

Once the plugin installed and activated, go to the configuration.

In the Configuration tab of the GLPI Agent, we must configure at least:

• The URL of server, example: mon.glpi.fr/GLPI inventory/

• Identifier

• Password

Once this data has been entered and saved, the QRCode or Deeplink functionalities will allow you to inventory your smartphones.

Configuring the Agent with an EMM / MDM Tool

The GLPI agent can be deployed/configured from an MDM / EMM tool

• Samsung Knox

• AirWatch

• InTunes

• MobileIron

• etc.

Here is the list of configurable settings:

• auto_start_on_boot => Run an inventory at startup (Bool true / false)

• automatic_inventory => Enable automatic inventory (Bool true / false)

• frequency => Frequency of automatic inventory (String Day / Week / Month default Day)

• server_configuration_list => (Bundle)

  • server_url => GLPI server URL (String)

  • server_tag => TAG (String)

  • server_login => Username for basic authentication (String)

  • server_password => Password for basic authentication (String)

  • server_itemtype => Asset type in GLPI (String Computer / Phone default Computer)

  • server_custom_asset_serial => Custom serial number to replace the one generated by the agent (String)

GLPI agent for Android

The GLPI agent is an application available on Google Play. Once downloaded and installed on your smartphone, we will be able to configure the agent to start inventory of the equipment.

You will be redirected to the server configuration page asking you to enter all the authentication data.

Thanks to the Agent config plugin configured previously, we do not need to enter information because the features of QRcode and DeepLink allow you to fill in the fields automatically.

QRcode

• Scan the QRcode available on your GLPI web interface on the home page.

• Save the configuration entered automatically to validate the server.

DeepLink

• Go to your GLPI via web browser on your smartphone.

• In the GLPI Agent tab of your GLPI home page, click the Configuration link for GLPI Agent.

• Your smartphone will ask you with which application you want to open this link, choose the GLPI Agent application.

• You just have to save the configuration to add the server.

References

Documentation Agent Config Plugin

Declaration of a data to be queried

Go to the administration > GLPI Inventory > tasks > computer information

Then create a new item ajouter :

The next window will allow you to enter the following information:

• A name

• A comment

• A type

  • Registry

  • Search for a file

• Active or not

• Visible in a sub-entity or not

Once you've clicked on Add, a Collect configuration tab appears in the left-hand menu, allowing you to configure data collection for one of the following three options, depending on the chosen type:

• WMI Windows

• File search

• Windows registry

Creating the task

Go to administration > GLPI Inventory > tasks > task management

Then create a new task with ajouter :

Create the task :

Then in Job configuration, add a job:

And configure the collect job in this task:

Once the job has been activated, prepared and taken over by the agent, you can see the result of the job execution here:

In the computer file, a new tab Collection information appears with the value found for the file:

Since GLPI 10, the inventory is now native.

Please refer to the documentation for the GLPI agent to upload your PCs, printers, etc. https://glpi-agent.readthedocs.io/en/latest/installation/

Install Agent

You will need to install the agent to retrieve inventory. You can download it here

During installation, you will be asked to complete several steps.

Setup the agent

• We suggest that you go through the full installation so that you can validate any requirements you may have (certificates, type of installation, etc.).

• The next step will allow you to identify your GLPI server. The URL to enter may vary depending on whether or not you have installed the GLPI Inventory plugin:

  • without the plugin: https://myinstance.com/front/inventory.php

  • with the plugin: https://myinstance.com/marketplace/glpiinventory

• You can then choose how the agent runs. 3 modes are possible:

1. As a service: the task is launched in the background and runs without any user or administrator action

2. As a task: a scheduled task is programmed so that the agent is launched every X hours/days

3. Manually: the agent will only be launched on request

• During installation, it is also possible to ask for an inventory to be taken at the end of the operation.

• A monitor agent can be installed. It enables tasks run to be forced by the user. This icon will be visible in the notification bar:

The next steps will be up to you (certificate, proxy, etc.).

• You will also be able to identify a tag depending on how your GLPI is set up so that your PCs can be sent to the right entities, locations, etc.

• You can also ask for the user's virtual machines to be inventoried. They will be visible in the Virtualisation tab of the PC file:

• You can also scan the user profiles to bring up any software found in the software tab of your GLPI server.

Once the installation is complete, if an inventory has been requested, it will now appear in the computers tab a few minutes after installation.

References

Documentation GLPI "Module assets - Computer"

• Copy the file toolbox-plugin.cfg and rename it toolbox-plugin.local

• Open the file toolbox-plugin.local and uncomment the line disabled = no.

• Restart the GLPI service

• Connect to http://localhost:62354

A new menu will be available from the web interface

Here you will also find a video about how setting up the GLPI Agent Toolbox

To secure exchanges between your agents and the GLPI server, several tips and methods are available:

Man in the Middle / Spoofing DNS

This method consists in intercepting requests and pretending to be the legitimate GLPI server.

To avoid this, use an SSL server and ensure that the agent authenticates the server with its certificate.

• If the server's certificate is signed by a public certification authority, just configure the agent with an https url.

• If the server's certificate is private, you need to provide the agent with the certificate via the ca-cert-file option (it can also be found in the windows keystore or MacOSX keychain) or a fingerprint of the certificate via the ssl-fingerprint option and, above all, never activate the no-ssl-check option. This last option should only be used to debug SSL communication problems, or only once, so that the agent displays the server's ssl certificate fingerprint in its log to indicate how to configure the ssl-fingerprint option.

Password authentication

It is also possible to add password authentication. In this case, you need to configure the agent's username and password options. The only problem in this case is that a compromised machine could reveal the user and password to an attacker, who could then inject bogus inventory or data into GLPI.

SSL certificate authentication

There's also the possibility of defining authentication by client ssl certificate, but this solution has never been properly tested, and above all it's complex to implement because it requires very advanced Apache configuration. On the agent side, it's the ssl-cert-file option that supports this possibility. But this doesn't change the problem of compromising the workstation that could reveal the client certificate.

Bi-directional authentication is therefore currently possible using the technologies mentioned above.

Going further

Future versions will include the idea of registering agents with a password or token dedicated to this phase, and enabling the agent and server to negotiate an exchange of private keys in order to authenticate and encrypt exchanges, including in an http flow and possibly even through a proxy agent. The JSON protocol of the native inventory has been designed to remain open to this kind of functionality. This functionality would enable direct bi-directional authentication and the possibility of managing an expiry, renewal or revocation policy for tokens and keys to help counter the attacks you mention. Unfortunately, this kind of functionality, to be developed in the agent and in GLPI, is currently seeking funding. Please don't hesitate to contact us. Nevertheless, there should be new authentication possibilities for the agent in the not too distant future.

Regarding the detailed flows between agent and server: the agent remains an HTTP/HTTPS client, depending on the type of url configured. The agent can also be an http server, including for the GLPI server to force execution of tasks from GLPI, and here the default TCP port 62354 needs to be opened from the GLPI server to the agent.

References

The impact analysis is available from the tab of the same name in each of the park elements.

Notions

2 concepts need to be understood:

• Impact: represented by default by a red arrow. If this element encounters a problem, it will impact all linked elements.

• Dependency: represented by default by a blue arrow. A dependency is an element which will be directly affected by the impact. A dependency does not necessarily affect the elements linked to it.

!!! Information An important element to understand is that you need to place yourself in the context of the element in question. If you select a switch, the impacts and dependencies will be different if you select an element linked to the switch.

Create an impact analysis

Adding hardware

Your equipment must be powered up before you can use the impact analysis.

If we go back to our example given above, we'll start from the 1st item, i.e. the router.

• Go to Assets > Network devices

• Select the network hardware you require

• In the impact analysis tab, the hardware you are on will appear

• On the right-hand bar, click on

• The list of categories appears, choose the one that suits you (here network hardware to link our switch to our router)

• Drag and drop the hardware you want.

• Do the same with all the hardware you want

You'll get a result like this (depending on how you've placed your items)

Adding links

Now that our materials have been placed, we need to add the links in order to check their impact and dependencies (or both).

• From the right-hand menu, click on

• Your mouse will then appear with a

• Hold your mouse over the 1st element, and release the mouse over the element to be linked.

• Repeat the operation for all the desired elements

Explanation of links

As mentioned above, you need to understand the context of the selected element. What we see in the diagram above is that all the links are in red. This means that if the router were to fail, all the following elements would be affected.

If we position ourselves on Rack 1, the behaviour will not be the same:

In this example, from the point of view of Rack 1, the only hardware that would impact the infrastructure if it were to fail is SRV-GLPI. Rack 1 depends on Router EDGE-51 and Switch A3. They are in blue (dependency) because they would not be impacted if Rack 1 were to experience a problem.

Dependency and impact on the same hardware

We can add a router to our example, which will be linked to the 1st original router:

• To do this, create a relationship in one direction and then in the other using the option seen above.

The purple arrows mean that they are dependent on each other and that they would both be affected if one of them were to encounter a problem. They are therefore both dependent and impacted.

No impact

There is one last type of link, those that have no dependency or impact:

The black arrows mean that from the element you are on, there will be no imapct if that element were to fail. In our example, we are on Rack 1. This does not communicate with Rack 2, so there will be no dependency or impact in the event of a failure.

Groups

Groups can be created using the :fontawesome-regular-object-group: icon in the right-hand menu.

Groups allow you to see all the elements that depend on another piece of equipment. You can create a name for the group and choose a background colour.

To delete a group, right-click on it and select delete. This only deletes the group, not the items it contains.

Save your imapct analysis

Remember to save your project with

Deleting elements

You can delete an element using . This deletes the element and the link.

Download your project

You can download your impact analysis using . The download format is PNG.

Enlarge your analysis

Use the icon to make your analysis full screen.

You can also use your mouse wheel to zoom in and out.

Link configuration

You can configure certain options using

Visibility

In visibility, you can choose to show only impacts and/or dependencies.

Colours

In the colours tab, you can change the colours of dependencies, impacts and impacts and dependencies.

Maximum depth

The maximum depth is the number of elements that can be displayed on your imapct analysis. If you select "infinity", there will be no display limit.

Prerequisites

Here are the prerequisites that will permit deployment of GLPI agents with a GPO:

• You have to download the glpi-agent-deployment.vbs VBS script which ease deployment via GPO.

Script VBS

Before using this script in a GPO, you have to edit the few configuration lines at the beginning of the script.

In this file, the following lines then need to be adapted:

• Line 67: GLPI Agent version to be installed. It has to be update in the case agent version is changing.
• Line 91: Indicates the path to the shared folder containing the agent MSI packages: For example:
• Line 112 : Agent installation options Example for GLPI 10 with native inventory support:

Here is a list of common attributes:

The rest of the script does not need to be modified.

Creating the GPO

The GPO to be created must have the following parameters:

• Type Computer

• Startup script (where we will give the path to the vbs script mentioned above)

Full documentation is also available at this address :

Options

Add authentication with user and password.

Then you'll have to add USER= and PASSWORD= options to options line like in the following example:

Reference

An IT Service Level Agreement (SLA) is a documented agreement between an IT service provider and a customer, defining the services required and the level of service expected. In GLPI, it is possible to enter these SLAs so that the level of service expected by a customer is in line with the contract signed between the 2 parties.

Setting up SLAs involves several stages:

1. Define intervention times via the calendar (working hours, on-call, etc. several possible calendars).

2. Definition of SLAs (Service Level Agreements)

   • Maximum Time To Own (TTO)

   • Maximum time to resolution (TTR - Time To Resolve)

3. Definition of OLA (Operational Level Agreement)

   • Maximum Time To Own (TTO)

   • Maximum time to resolve (TTR - Time To Resolve)

4. Implementation of SLA assignment rules (escalation level)

5. Set up SLA reminder notifications

6. Automatic action settings

7. Checking the cron

Create SLA

• From Setup > Service levels, click on Add.

• Add a name to your SLA

• In the calendar insert, select the one you want from the list.

Add SLA service level

Add a TTO

• In your SLA, click on Add a new item.

• Select Time to own.

• Add the desired value (generally defined by the contract). In our example, we'll take 4 hours.

• Click on Add

Add a TTR

• Click on Add a new item.

• Select Time to resolve

• Add the value you want (usually defined by the contract). In our example we'll take 5 days

• Indicate whether the last day of the SLA should be a working day

• Click on Add

Add OLA service level

OLAs are internal service levels; they have no impact on SLAs, but define a level of service internal to the IT department.

Adding an OLA is strictly identical to the SLA, so you can repeat the above process.

Escalation levels

The escalation level enables you to apply a rule before/after the deadline imposed by the TTO or TTR, whether positioned in the SLA or the OLA.

You can, for example, add a TAG, assign a priority, assign a default technician, etc.

The following operation can be repeated for each TTO or TTR included in an SLA or OLA.

You can, of course, add/modify/delete anything you like, just like any other GLPI rule.

SLA escalation level - TTO

• From Setup > Service levels

• In the SLA tab, click on the name of your TTO

• In the escalation level tab

  • Enter a name

  • Indicate when the execution is to take place (before/after or at the end of the TTO)

  • Active to Yes

  • Click on Add

• Click on the name of your Escalation level to add a rule that will be applied.

• In the Criteria tab, click on add a new criterion.

• In our case, we'll specify Criteria - Take into account delay is No.

• Click on + Add

• In the Actions tab, click on Add a new action.

• Specify Technician group > Add > the_desired_group.

• Click on Add a new action.

• Specify Priority > Assign > Very high

SLA - TTR Escalation levels

• From Setup > Service levels

• In the SLA tab, click on the name of your TTR

• In the escalation level tab

• Enter a name

• Indicate when execution is to take place (before/after or at the end of the TTR)

• Active to yes

• Click on Add

• Click on the name of your Escalation level to add a rule that will be applied

• In the Criteria tab, click on add a new criterion.

• In our case, we'll specify Criteria - Status not closed OR resolved (2 different criteria)

• Click on Add

• In the Actions tab, click on Add a new action.

• Specify Automatic reminders of SLA > Send > Yes.

• Click on Add!