On Wed, Feb 02, 2005 at 09:56:53AM +0200, Zdravko Stoychev wrote: > Hi Claudio! > > > -----Original Message----- > > From: Claudio Jeker [mailto:[EMAIL PROTECTED] > > Sent: Tuesday, February 01, 2005 9:04 PM > > To: [email protected] > > Subject: Re: User Groups stored in LDAP server? > > > > On Tue, Feb 01, 2005 at 06:09:27PM +0200, Zdravko Stoychev wrote: > > > Hi, > > > I am using latest qmail-ldap (dec 2004) and will not > > rallback to Any > > > previous release. > > > > > > You're right, remember > > > > > > "qmailGroup depends on qmailUser so we use the same > > > ~contol/ldapobjectclass in qmail-group" > > > > > > I propose and request an update where qmail-group would use > > Different > > > control file, for example: > > > ~contol/ldapGROUPobjectclass > > > > > > > This does not work because of the following reasons. > > 1. qmailGroup depends on qmailUser is a schema restriction > > on OpenLDAP it is enforced so it is only possible to have > > a group entry > > with both objectclasses defined. > > objectclass: qmailUser > > objectclass: qmailGroup > > 2. a qmailGroup is just an extension of a qmailUser. > > Ok, I knew that but have to ask it anyway. > > But the real question here is Is the Qmail-ldap stuck to OpenLDAP, > or it is supposed to support any LDAP server? >
It supports any LDAP server that implements the standard. > Since there is no such user-group relation in MS AD scheme, > I think suport for AD would be welcome :) > qmail-ldap has it's own schema because of this. We ship the schema and that one works. If you like to do the same in MS AD you need to adjust their schemas. > > 3. qmail-ldap will use the ~control/ldapobjectclass to simplify > > the search > > and especially qmail-lspawn does not know the difference > > between a user > > and a group > > I see. So I have to find a common objectClass value for my user > And group objects. > Why is it not possible to have both objectClass user and objectClass group? Is this some sort of typical MS joke? > > > Ignore caps. Here I suppose this behaviour: > > > > > > $ /var/qmail/bin/qmail-ldaplookup -m [EMAIL PROTECTED] > > > > > > Would first try to lookup with filter based on > > > ~contol/ldapobjectclass > > > > > > i.e. looking for an user, and if this fails a new lookup will be > > > executed with Filter based on > > > ~contol/ldapgroupobjectclass > > > > > > i.e. looking for group. > > > Or so, I don't know internal qmail logic. > > > > > > > This does not make sense. Why don't you just fix your LDAP > > entry by adding the needed objectclasses? > > In your case you need to added groups with > > objectclass: user > > objectclass: group > > Not applicable. I am using default Microsoft AD Scheme. > The groups are not created manualy, but by using MMC GUI. > If I alter the AD scheme anyway I don't know what the > Circumstances would be. > > Looking on objectClass for user and group objects: > > 1. user: > > dn: CN=zdravko,CN=Users,DC=mps,DC=local > ------------------------------------------------------- > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: user > > 2. group: > > dn: CN=Accountists,CN=Users,DC=mps,DC=local > ------------------------------------------------------- > objectClass: top > objectClass: group > > Can I use 'top' as ~contol/ldapobjectclass ? you can also remove the file. There is no problem with not defining it. ldapobjectclass is mainly used to speed up lookups on directories that consist of many different objects. As an example I don't use it as my ldap tree is only built out of a few ou's and many qmailUser objects. > Still I don't have a clue what does > > #define LDAP_GROUPOBJECTCLASS "group" > > mean at all then? > This is needed to tell qmail-ldap that the returned object is a group. If there is no objectclass group defined a normal delivery is done else qmail-lspawn informs qmail-local to execute qmail-group. -- :wq Claudio
