Could you get round it just by removing the control/ldapobjectlclass file?
Mike
Zdravko Stoychev wrote:
Hi, I am using latest qmail-ldap (dec 2004) and will not rallback to Any previous release.
You're right, remember
"qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group"
I propose and request an update where qmail-group would use Different control file, for example: ~contol/ldapGROUPobjectclass
Ignore caps. Here I suppose this behaviour:
$ /var/qmail/bin/qmail-ldaplookup -m [EMAIL PROTECTED]
Would first try to lookup with filter based on ~contol/ldapobjectclass
i.e. looking for an user, and if this fails a new lookup will be executed with Filter based on ~contol/ldapgroupobjectclass
i.e. looking for group. Or so, I don't know internal qmail logic.
-----Original Message-----
From: Mike Dawson [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 01, 2005 4:57 PM
To: Zdravko Stoychev
Cc: [email protected]
Subject: Re: User Groups stored in LDAP server?
I'm using qmail-ldap from December 2003 - maybe this was before the filter for objectclass=user was added, or is it getting the filter from control/ldapobjectclass in your case?
Mike
Zdravko Stoychev wrote:
Hi!
-----Original Message----- From: Mike Dawson [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 01, 2005 3:39 PM To: Zdravko Stoychev Cc: [email protected] Subject: Re: User Groups stored in LDAP server?
Yes, you just need to set the appropriate attribute names in qmail-ldap.h.
Mike
Ok, I have set up in qmail-ldap.h:
#define LDAP_GROUPOBJECTCLASS "group"
That's the class used in AD (Active Directory). Still if I try to lookup for
it:
$ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED
Searching ldap for:
(&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)
)) under dn: cn=users, dc=mps, dc=local No entries found.
It fails because it actualy searches for "objectClass=user"! Why?
I have found some info about this on the net from Claudio
Jeker Posted
on Mon, 23 Feb 2004 09:09:32 -0800:
"1. Yes. qmailUser is needed for qmailGroup, there seems to
be a bug
in the schema because we should enforce that right there.
2. your entry is missing the qmailUID and qmailGID values or the corresponding ~control files, so qmail-lspawn is unsable to
setup and
run qmail-local which would then call qmail-group.
3. normaly it is the best to setup a "normal" user and
extend it to a
group account.
4. the question about ldapobjectclass posted before should
now be obvious.
qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group. The special group login and password control file are here to make it possible to use
filter that
produce a large number of results and would therefor end in
the ldap limit."
If I do manual search for the group object in AD:
$ /var/qmail/bin/qmail-ldaplookup -f
"(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))"
Searching ldap for: (|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))
under dn: cn=users, dc=mps, dc=local
Found 1 entry:
dn: CN=soft,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: group mail: MAILPROTECTED name: soft accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined
It is found without any problems. Here "soft" is a Global Group created in AD.
If I lookup for an user, it works fine:
$ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED
Searching ldap for:
(&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)
)) under dn: cn=users, dc=mps, dc=local Found 1 entry:
dn: CN=zdravko,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user mail: MAILPROTECTED name: zdravko accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined
User entry is found without any problems.
I can conclude that Microsoft's AD 'group' object is not
'user' as it
seams to be required.
As Claudio Jeker said
"qmailGroup depends on qmailUser so we use the same ~contol/ldapobjectclass in qmail-group".
$ cat /var/qmail/control/ldapobjectclass user
So it seams to me that Qmail will always search for
"&(objectClass=user)"
which Will fail looking for Groups in AD.
What should I do next?
Zdravko Stoychev wrote:
Hi all!
We're using MS 2003 Server's Active Directory to store
Domain Users.
User authorization and user details retrieval is working just fine.
Currently we're using FastForward and /etc/aliases.cdb to maintain User Groups.
Is it possible to store User Groups into LDAP (Active
Directory) too
in order to maintain Group Members from MS 2003 Server directly?
Best wishes! --- Zdravko Stoychev System Administrator [EMAIL PROTECTED] tel +359-2-9712324 Icq 11693613
