Hi! > -----Original Message----- > From: Claudio Jeker [mailto:[EMAIL PROTECTED] > Sent: Wednesday, February 02, 2005 10:28 AM > To: [email protected] > Subject: Re: User Groups stored in LDAP server? > > On Wed, Feb 02, 2005 at 09:56:53AM +0200, Zdravko Stoychev wrote: > > Hi Claudio! > > > > > -----Original Message----- > > > From: Claudio Jeker [mailto:[EMAIL PROTECTED] > > > Sent: Tuesday, February 01, 2005 9:04 PM > > > To: [email protected] > > > Subject: Re: User Groups stored in LDAP server? > > > > > > On Tue, Feb 01, 2005 at 06:09:27PM +0200, Zdravko Stoychev wrote: > > > > Hi, > > > > I am using latest qmail-ldap (dec 2004) and will not > > > rallback to Any > > > > previous release. > > > > > > > > You're right, remember > > > > > > > > "qmailGroup depends on qmailUser so we use the same > > > > ~contol/ldapobjectclass in qmail-group" > > > > > > > > I propose and request an update where qmail-group would use > > > Different > > > > control file, for example: > > > > ~contol/ldapGROUPobjectclass > > > > > > > > > > This does not work because of the following reasons. > > > 1. qmailGroup depends on qmailUser is a schema restriction > > > on OpenLDAP it is enforced so it is only possible to > have a group > > > entry > > > with both objectclasses defined. > > > objectclass: qmailUser > > > objectclass: qmailGroup > > > 2. a qmailGroup is just an extension of a qmailUser. > > > > Ok, I knew that but have to ask it anyway. > > > > But the real question here is Is the Qmail-ldap stuck to > OpenLDAP, or > > it is supposed to support any LDAP server? > > > > It supports any LDAP server that implements the standard.
Okay > > Since there is no such user-group relation in MS AD scheme, > > I think suport for AD would be welcome :) > > > > qmail-ldap has it's own schema because of this. We ship the schema and > that one works. If you like to do the same in MS AD you need to adjust > their schemas. Okay > > > 3. qmail-ldap will use the ~control/ldapobjectclass to simplify > > > the search > > > and especially qmail-lspawn does not know the difference > > > between a user > > > and a group > > > > I see. So I have to find a common objectClass value for my user > > And group objects. > > > > Why is it not possible to have both objectClass user and objectClass > group? Is this some sort of typical MS joke? Sure it is possible, but I don't see a sense in statement that Group should be based on User. Those are different type of objects. If qmail-ldap has it's own schema why is it created with this Limitation built-in? Maybe there is a reason... I am not M$ fan, it's just illogical for me that a Group is an User. > > > > Ignore caps. Here I suppose this behaviour: > > > > > > > > $ /var/qmail/bin/qmail-ldaplookup -m [EMAIL PROTECTED] > > > > > > > > Would first try to lookup with filter based on > > > > ~contol/ldapobjectclass > > > > > > > > i.e. looking for an user, and if this fails a new > lookup will be > > > > executed with Filter based on > > > > ~contol/ldapgroupobjectclass > > > > > > > > i.e. looking for group. > > > > Or so, I don't know internal qmail logic. > > > > > > > > > > This does not make sense. Why don't you just fix your LDAP > > > entry by adding the needed objectclasses? > > > In your case you need to added groups with > > > objectclass: user > > > objectclass: group > > > > Not applicable. I am using default Microsoft AD Scheme. > > The groups are not created manualy, but by using MMC GUI. > > If I alter the AD scheme anyway I don't know what the > > Circumstances would be. > > > > Looking on objectClass for user and group objects: > > > > 1. user: > > > > dn: CN=zdravko,CN=Users,DC=mps,DC=local > > ------------------------------------------------------- > > objectClass: top > > objectClass: person > > objectClass: organizationalPerson > > objectClass: user > > > > 2. group: > > > > dn: CN=Accountists,CN=Users,DC=mps,DC=local > > ------------------------------------------------------- > > objectClass: top > > objectClass: group > > > > Can I use 'top' as ~contol/ldapobjectclass ? > > you can also remove the file. There is no problem with not > defining it. > ldapobjectclass is mainly used to speed up lookups on directories that > consist of many different objects. > > As an example I don't use it as my ldap tree is only built > out of a few > ou's and many qmailUser objects. > > > Still I don't have a clue what does > > > > #define LDAP_GROUPOBJECTCLASS "group" > > > > mean at all then? > > > > This is needed to tell qmail-ldap that the returned object is > a group. If > there is no objectclass group defined a normal delivery is done else > qmail-lspawn informs qmail-local to execute qmail-group. Thanks! > -- > :wq Claudio >
smime.p7s
Description: S/MIME cryptographic signature
