On 04/12/20 11:29 +0000, David Faller wrote:
I have a question of my configuration,
we’re using multiple domains and the users are stored on our samba ad dc server.
In past I wanted to prevent the issue, that user can login with their username
and not with a fqdn mail address.
I had solved this issue by editing the /etc/default/saslauthd service file and
added ‚-r‘ at options in the end:
# Settings for saslauthd daemon
START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECHANISMS="ldap"
MECH_OPTIONS=""
THREADS=5
OPTIONS="-r -c -m /var/run/saslauthd"
My saslauthd.config file here use an other filter than default one:
ldap_servers: ldap://XXXXX
ldap_search_base: dc= XXX,dc=dir
#ldap_filter: sAMAccountName=%U
ldap_filter: userPrincipalName=%u
#ldap_version: 3
ldap_auth_method: bind
ldap_bind_dn: cn=Administrator,cn=Users,dc=XXX,dc=dir
ldap_bind_pw: XXX
#ldap_scope: sub
ldap_debug: -1
Here I have problem this config works fine all users can only sign in with
their full e-mail address
So max.mu...@web.de can login AND Max.murry can’t login.
This is working fine,
but when I want to use cyradm I need to switch the filter on
/etc/saslauthd.conf to sAMAccountName=%U
If I don’t do this I can’t access the cyradm tool, perhaps someone could help
here?
I think the problem is here the same, authentication are only allowed with a
fqdn but the linux user cyrus has no domain ending.
Hi David,
What error do you get when you attempt to login as the cyrus user? Try
adding 'cyrus@<domain>' to your admins entry in impad.conf. Depending on
your deployment, that may not be sufficient for administering all of your
domains. You may need a unique cyrus@<domain> account for each domain, with
each entry listed within an admins config line.
Since your problem is only with cyradm, consider running a second imapd
instance, using local sasldb authentication to, support cyradm, i.e.:
Within /etc/cyrus.conf:
imap cmd="imapd" listen="192.168.0.1:imap" prefork=0
imaplocal cmd="imapd" listen="127.0.0.1:imap" prefork=0
Then within /etc/imapd.conf, carve out a unique sasl pwcheck method for
imaplocal:
imaplocal_sasl_pwcheck_method: auxprop
imaplocal_sasl_auxprop_plugin: sasldb
#imaplocal_sasl_mech_list: PLAIN
Then you would maintain the cyrus user's password with saslpasswd2.
--
Dan White
Network Admin Lead
