Hi! > -----Original Message----- > From: Mike Dawson [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 01, 2005 3:39 PM > To: Zdravko Stoychev > Cc: [email protected] > Subject: Re: User Groups stored in LDAP server? > > Yes, you just need to set the appropriate attribute names in > qmail-ldap.h. > > Mike
Ok, I have set up in qmail-ldap.h: #define LDAP_GROUPOBJECTCLASS "group" That's the class used in AD (Active Directory). Still if I try to lookup for it: $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))) under dn: cn=users, dc=mps, dc=local No entries found. It fails because it actualy searches for "objectClass=user"! Why? I have found some info about this on the net from Claudio Jeker Posted on Mon, 23 Feb 2004 09:09:32 -0800: "1. Yes. qmailUser is needed for qmailGroup, there seems to be a bug in the schema because we should enforce that right there. 2. your entry is missing the qmailUID and qmailGID values or the corresponding ~control files, so qmail-lspawn is unsable to setup and run qmail-local which would then call qmail-group. 3. normaly it is the best to setup a "normal" user and extend it to a group account. 4. the question about ldapobjectclass posted before should now be obvious. qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group. The special group login and password control file are here to make it possible to use filter that produce a large number of results and would therefor end in the ldap limit." If I do manual search for the group object in AD: $ /var/qmail/bin/qmail-ldaplookup -f "(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))" Searching ldap for: (|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)) under dn: cn=users, dc=mps, dc=local Found 1 entry: dn: CN=soft,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: group mail: MAILPROTECTED name: soft accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined It is found without any problems. Here "soft" is a Global Group created in AD. If I lookup for an user, it works fine: $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))) under dn: cn=users, dc=mps, dc=local Found 1 entry: dn: CN=zdravko,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user mail: MAILPROTECTED name: zdravko accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined User entry is found without any problems. I can conclude that Microsoft's AD 'group' object is not 'user' as it seams to be required. As Claudio Jeker said "qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group". $ cat /var/qmail/control/ldapobjectclass user So it seams to me that Qmail will always search for "&(objectClass=user)" which Will fail looking for Groups in AD. What should I do next? > Zdravko Stoychev wrote: > > Hi all! > > > > We're using MS 2003 Server's Active Directory to store > Domain Users. > > User authorization and user details retrieval is working just fine. > > > > Currently we're using FastForward and /etc/aliases.cdb to maintain > > User Groups. > > > > Is it possible to store User Groups into LDAP (Active > Directory) too > > in order to maintain Group Members from MS 2003 Server directly? > > > > Best wishes! > > --- > > Zdravko Stoychev > > System Administrator > > [EMAIL PROTECTED] > > tel +359-2-9712324 > > Icq 11693613 >
smime.p7s
Description: S/MIME cryptographic signature
