Hi Claudio! > -----Original Message----- > From: Claudio Jeker [mailto:[EMAIL PROTECTED] > Sent: Tuesday, February 01, 2005 9:04 PM > To: [email protected] > Subject: Re: User Groups stored in LDAP server? > > On Tue, Feb 01, 2005 at 06:09:27PM +0200, Zdravko Stoychev wrote: > > Hi, > > I am using latest qmail-ldap (dec 2004) and will not > rallback to Any > > previous release. > > > > You're right, remember > > > > "qmailGroup depends on qmailUser so we use the same > > ~contol/ldapobjectclass in qmail-group" > > > > I propose and request an update where qmail-group would use > Different > > control file, for example: > > ~contol/ldapGROUPobjectclass > > > > This does not work because of the following reasons. > 1. qmailGroup depends on qmailUser is a schema restriction > on OpenLDAP it is enforced so it is only possible to have > a group entry > with both objectclasses defined. > objectclass: qmailUser > objectclass: qmailGroup > 2. a qmailGroup is just an extension of a qmailUser.
Ok, I knew that but have to ask it anyway. But the real question here is Is the Qmail-ldap stuck to OpenLDAP, or it is supposed to support any LDAP server? Since there is no such user-group relation in MS AD scheme, I think suport for AD would be welcome :) > 3. qmail-ldap will use the ~control/ldapobjectclass to simplify > the search > and especially qmail-lspawn does not know the difference > between a user > and a group I see. So I have to find a common objectClass value for my user And group objects. > > Ignore caps. Here I suppose this behaviour: > > > > $ /var/qmail/bin/qmail-ldaplookup -m [EMAIL PROTECTED] > > > > Would first try to lookup with filter based on > > ~contol/ldapobjectclass > > > > i.e. looking for an user, and if this fails a new lookup will be > > executed with Filter based on > > ~contol/ldapgroupobjectclass > > > > i.e. looking for group. > > Or so, I don't know internal qmail logic. > > > > This does not make sense. Why don't you just fix your LDAP > entry by adding the needed objectclasses? > In your case you need to added groups with > objectclass: user > objectclass: group Not applicable. I am using default Microsoft AD Scheme. The groups are not created manualy, but by using MMC GUI. If I alter the AD scheme anyway I don't know what the Circumstances would be. Looking on objectClass for user and group objects: 1. user: dn: CN=zdravko,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user 2. group: dn: CN=Accountists,CN=Users,DC=mps,DC=local ------------------------------------------------------- objectClass: top objectClass: group Can I use 'top' as ~contol/ldapobjectclass ? Still I don't have a clue what does #define LDAP_GROUPOBJECTCLASS "group" mean at all then? Zdravko > -- > :wq Claudio >
smime.p7s
Description: S/MIME cryptographic signature
