Hi! > -----Original Message----- > From: Mike Dawson [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 01, 2005 6:13 PM > To: Zdravko Stoychev > Cc: [email protected] > Subject: Re: User Groups stored in LDAP server? > > Could you get round it just by removing the > control/ldapobjectlclass file? > > Mike >
Ok, I've tried this, and LDAP search is based only on email. Query do not contains check for (objectClass=user), so now both user and group checks succeeded. Still I got another error on some Groups: $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)) under dn: cn=users, dc=mps, dc=local Found 1 entry: dn: CN=Domain Admins,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: group mail: MAILPROTECTED qmail-ldaplookup: fatal: qldap_get_user: illegal value Which brings us back to the original: http://www.mail-archive.com/[email protected]/msg00935.html Well this error occurs only on built-in AD groups as Domain Admins, But works just fint on user defined groups: $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)) under dn: cn=users, dc=mps, dc=local Found 1 entry: dn: CN=Accountists,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: group mail: MAILPROTECTED name: Accountists accountStatus: undefined -> active mailHost: undefined homeDirectory: /home/vmail/ aliasEmpty: using default qmailDotMode: dotonly qmailUID: 510 qmailGID: 510 mailQuotaSize: 524288000 mailQuotaCount: 0 (unlimited) mailSizeMax: 0 (unlimited) mailReplyText: undefined How Qmail knows if this is an user or a group? By looking into objectClass And checking if it contains LDAP_GROUPOBJECTCLASS ("group") ? Further, looking into qmail-ldap.h #define LDAP_OBJECTCLASS "objectClass" Defines the LDAP query's key to lookup for instance's class. $ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED Searching ldap for: (&(objectClass=user) ..... Here 'objectClass' is LDAP_OBJECTCLASS and the 'user' is grabbed from ~/control/ldapobjectlclass. While changing line #define LDAP_GROUPOBJECTCLASS "group" Do not have any visual effect on the query. > Zdravko Stoychev wrote: > > Hi, > > I am using latest qmail-ldap (dec 2004) and will not > rallback to Any > > previous release. > > > > You're right, remember > > > > "qmailGroup depends on qmailUser so we use the same > > ~contol/ldapobjectclass in qmail-group" > > > > I propose and request an update where qmail-group would use > Different > > control file, for example: > > ~contol/ldapGROUPobjectclass > > > > Ignore caps. Here I suppose this behaviour: > > > > $ /var/qmail/bin/qmail-ldaplookup -m [EMAIL PROTECTED] > > > > Would first try to lookup with filter based on > > ~contol/ldapobjectclass > > > > i.e. looking for an user, and if this fails a new lookup will be > > executed with Filter based on > > ~contol/ldapgroupobjectclass > > > > i.e. looking for group. > > Or so, I don't know internal qmail logic. > > > > > >>-----Original Message----- > >>From: Mike Dawson [mailto:[EMAIL PROTECTED] > >>Sent: Tuesday, February 01, 2005 4:57 PM > >>To: Zdravko Stoychev > >>Cc: [email protected] > >>Subject: Re: User Groups stored in LDAP server? > >> > >>I'm using qmail-ldap from December 2003 - maybe this was before the > >>filter for objectclass=user was added, or is it getting the filter > >>from control/ldapobjectclass in your case? > >> > >>Mike > >> > >>Zdravko Stoychev wrote: > >> > >>>Hi! > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Mike Dawson [mailto:[EMAIL PROTECTED] > >>>>Sent: Tuesday, February 01, 2005 3:39 PM > >>>>To: Zdravko Stoychev > >>>>Cc: [email protected] > >>>>Subject: Re: User Groups stored in LDAP server? > >>>> > >>>>Yes, you just need to set the appropriate attribute names in > >>>>qmail-ldap.h. > >>>> > >>>>Mike > >>> > >>> > >>>Ok, I have set up in qmail-ldap.h: > >>> > >>>#define LDAP_GROUPOBJECTCLASS "group" > >>> > >>>That's the class used in AD (Active Directory). Still if I try to > >>>lookup for > >>>it: > >>> > >>>$ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED > >> > >>Searching ldap for: > >> > >>(&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAIL > PROTECTED) > >> > >>>)) > >>>under dn: cn=users, dc=mps, dc=local > >>>No entries found. > >>> > >>>It fails because it actualy searches for "objectClass=user"! Why? > >>> > >>>I have found some info about this on the net from Claudio > >> > >>Jeker Posted > >> > >>>on Mon, 23 Feb 2004 09:09:32 -0800: > >>> > >>>"1. Yes. qmailUser is needed for qmailGroup, there seems to > >> > >>be a bug > >> > >>>in the schema because we should enforce that right there. > >>> 2. your entry is missing the qmailUID and qmailGID values or the > >>>corresponding ~control files, so qmail-lspawn is unsable to > >> > >>setup and > >> > >>>run qmail-local which would then call qmail-group. > >>> 3. normaly it is the best to setup a "normal" user and > >> > >>extend it to a > >> > >>>group account. > >>> 4. the question about ldapobjectclass posted before should > >> > >>now be obvious. > >> > >>>qmailGroup depends on qmailUser so we use the same > >>>~contol/ldapobjectclass in qmail-group. The special group > login and > >>>password control file are here to make it possible to use > >> > >>filter that > >> > >>>produce a large number of results and would therefor end in > >> > >>the ldap limit." > >> > >>>If I do manual search for the group object in AD: > >>> > >>>$ /var/qmail/bin/qmail-ldaplookup -f > >>>"(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED))" > >>>Searching ldap for: > >>>(|(mail=MAILPROTECTED)(otherMailbox=MAILPROTECTED)) > >>>under dn: cn=users, dc=mps, dc=local > >>>Found 1 entry: > >>> > >>>dn: CN=soft,CN=Users,DC=mps,DC=local > >>>------------------------------------------------------- > >>>objectClass: top > >>>objectClass: group > >>>mail: MAILPROTECTED > >>>name: soft > >>>accountStatus: undefined -> active > >>>mailHost: undefined > >>>homeDirectory: /home/vmail/ > >>>aliasEmpty: using default > >>>qmailDotMode: dotonly > >>>qmailUID: 510 > >>>qmailGID: 510 > >>>mailQuotaSize: 524288000 > >>>mailQuotaCount: 0 (unlimited) > >>>mailSizeMax: 0 (unlimited) > >>>mailReplyText: undefined > >>> > >>>It is found without any problems. Here "soft" is a Global Group > >>>created in AD. > >>> > >>>If I lookup for an user, it works fine: > >>> > >>>$ /var/qmail/bin/qmail-ldaplookup -m MAILPROTECTED > >> > >>Searching ldap for: > >> > >>(&(objectClass=user)(|(mail=MAILPROTECTED)(otherMailbox=MAIL > PROTECTED) > >> > >>>)) > >>>under dn: cn=users, dc=mps, dc=local > >>>Found 1 entry: > >>> > >>>dn: CN=zdravko,CN=Users,DC=mps,DC=local > >>>------------------------------------------------------- > >>>objectClass: top > >>>objectClass: person > >>>objectClass: organizationalPerson > >>>objectClass: user > >>>mail: MAILPROTECTED > >>>name: zdravko > >>>accountStatus: undefined -> active > >>>mailHost: undefined > >>>homeDirectory: /home/vmail/ > >>>aliasEmpty: using default > >>>qmailDotMode: dotonly > >>>qmailUID: 510 > >>>qmailGID: 510 > >>>mailQuotaSize: 524288000 > >>>mailQuotaCount: 0 (unlimited) > >>>mailSizeMax: 0 (unlimited) > >>>mailReplyText: undefined > >>> > >>>User entry is found without any problems. > >>> > >>>I can conclude that Microsoft's AD 'group' object is not > >> > >>'user' as it > >> > >>>seams to be required. > >>> > >>>As Claudio Jeker said > >>> > >>>"qmailGroup depends on qmailUser so we use the same > >>>~contol/ldapobjectclass in qmail-group". > >>> > >>>$ cat /var/qmail/control/ldapobjectclass > >>>user > >>> > >>>So it seams to me that Qmail will always search for > >> > >>"&(objectClass=user)" > >> > >>>which > >>>Will fail looking for Groups in AD. > >>> > >>>What should I do next? > >>> > >>> > >>> > >>>>Zdravko Stoychev wrote: > >>>> > >>>> > >>>>>Hi all! > >>>>> > >>>>>We're using MS 2003 Server's Active Directory to store > >>>> > >>>>Domain Users. > >>>> > >>>> > >>>>>User authorization and user details retrieval is working > just fine. > >>>>> > >>>>>Currently we're using FastForward and /etc/aliases.cdb > to maintain > >>>>>User Groups. > >>>>> > >>>>>Is it possible to store User Groups into LDAP (Active > >>>> > >>>>Directory) too > >>>> > >>>> > >>>>>in order to maintain Group Members from MS 2003 Server directly? > >>>>> > >>>>>Best wishes! > >>>>>--- > >>>>> Zdravko Stoychev > >>>>> System Administrator > >>>>> [EMAIL PROTECTED] > >>>>> tel +359-2-9712324 > >>>>> Icq 11693613 > >>>> >
smime.p7s
Description: S/MIME cryptographic signature
