Mike
Zdravko Stoychev wrote:
Hi!
-----Original Message-----
From: Mike Dawson [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 01, 2005 3:39 PM
To: Zdravko Stoychev
Cc: [email protected]
Subject: Re: User Groups stored in LDAP server?
Yes, you just need to set the appropriate attribute names in qmail-ldap.h.
Mike
Ok, I have set up in qmail-ldap.h:
#define LDAP_GROUPOBJECTCLASS "group"
That's the class used in AD (Active Directory). Still if I try to lookup for it:
$ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))) under dn: cn=users, dc=mps, dc=local No entries found.
It fails because it actualy searches for "objectClass=user"! Why?
I have found some info about this on the net from Claudio Jeker Posted on Mon, 23 Feb 2004 09:09:32 -0800:
"1. Yes. qmailUser is needed for qmailGroup, there seems to be a bug in the schema because we should enforce that right there. 2. your entry is missing the qmailUID and qmailGID values or the corresponding ~control files, so qmail-lspawn is unsable to setup and run qmail-local which would then call qmail-group. 3. normaly it is the best to setup a "normal" user and extend it to a group account. 4. the question about ldapobjectclass posted before should now be obvious. qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group. The special group login and password control file are here to make it possible to use filter that produce a large number of results and would therefor end in the ldap limit."
If I do manual search for the group object in AD:
$ /var/qmail/bin/qmail-ldaplookup -f "(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))" Searching ldap for: (|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)) under dn: cn=users, dc=mps, dc=local Found 1 entry:
dn: CN=soft,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: group mail: MAILPROTECTED name: soft accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined
It is found without any problems. Here "soft" is a Global Group created in AD.
If I lookup for an user, it works fine:
$ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))) under dn: cn=users, dc=mps, dc=local Found 1 entry:
dn: CN=zdravko,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user mail: MAILPROTECTED name: zdravko accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined
User entry is found without any problems.
I can conclude that Microsoft's AD 'group' object is not 'user' as it seams to be required.
As Claudio Jeker said
"qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group".
$ cat /var/qmail/control/ldapobjectclass user
So it seams to me that Qmail will always search for "&(objectClass=user)" which Will fail looking for Groups in AD.
What should I do next?
Zdravko Stoychev wrote:
Hi all!
We're using MS 2003 Server's Active Directory to store
Domain Users.
User authorization and user details retrieval is working just fine.
Currently we're using FastForward and /etc/aliases.cdb to maintain User Groups.
Is it possible to store User Groups into LDAP (Active
Directory) too
in order to maintain Group Members from MS 2003 Server directly?
Best wishes! --- Zdravko Stoychev System Administrator [EMAIL PROTECTED] tel +359-2-9712324 Icq 11693613
