On Wed, Feb 02, 2005 at 04:48:40PM +0200, Zdravko Stoychev wrote: > Hi! > > > -----Original Message----- > > From: Claudio Jeker [mailto:[EMAIL PROTECTED] > > Sent: Wednesday, February 02, 2005 10:28 AM > > To: [email protected] > > Subject: Re: User Groups stored in LDAP server? > > > > On Wed, Feb 02, 2005 at 09:56:53AM +0200, Zdravko Stoychev wrote: > > > Hi Claudio! > > > > > > > -----Original Message----- > > > > From: Claudio Jeker [mailto:[EMAIL PROTECTED] > > > > Sent: Tuesday, February 01, 2005 9:04 PM > > > > To: [email protected] > > > > Subject: Re: User Groups stored in LDAP server? > > > > > > > > On Tue, Feb 01, 2005 at 06:09:27PM +0200, Zdravko Stoychev wrote: > > > > > Hi, > > > > > I am using latest qmail-ldap (dec 2004) and will not > > > > rallback to Any > > > > > previous release. > > > > > > > > > > You're right, remember > > > > > > > > > > "qmailGroup depends on qmailUser so we use the same > > > > > ~contol/ldapobjectclass in qmail-group" > > > > > > > > > > I propose and request an update where qmail-group would use > > > > Different > > > > > control file, for example: > > > > > ~contol/ldapGROUPobjectclass > > > > > > > > > > > > > This does not work because of the following reasons. > > > > 1. qmailGroup depends on qmailUser is a schema restriction > > > > on OpenLDAP it is enforced so it is only possible to > > have a group > > > > entry > > > > with both objectclasses defined. > > > > objectclass: qmailUser > > > > objectclass: qmailGroup > > > > 2. a qmailGroup is just an extension of a qmailUser. > > > > > > Ok, I knew that but have to ask it anyway. > > > > > > But the real question here is Is the Qmail-ldap stuck to > > OpenLDAP, or > > > it is supposed to support any LDAP server? > > > > > > > It supports any LDAP server that implements the standard. > > Okay > > > > Since there is no such user-group relation in MS AD scheme, > > > I think suport for AD would be welcome :) > > > > > > > qmail-ldap has it's own schema because of this. We ship the schema and > > that one works. If you like to do the same in MS AD you need to adjust > > their schemas. > > Okay > > > > > 3. qmail-ldap will use the ~control/ldapobjectclass to simplify > > > > the search > > > > and especially qmail-lspawn does not know the difference > > > > between a user > > > > and a group > > > > > > I see. So I have to find a common objectClass value for my user > > > And group objects. > > > > > > > Why is it not possible to have both objectClass user and objectClass > > group? Is this some sort of typical MS joke? > > Sure it is possible, but I don't see a sense in statement that Group > should be based on User. Those are different type of objects. > > If qmail-ldap has it's own schema why is it created with this > Limitation built-in? Maybe there is a reason... > > I am not M$ fan, it's just illogical for me that a Group is an User. >
a) neither qmailUser nor qmailGroup are structural object classes so qmailUser is not a user. It is an extension to an other object that give the object the necessary information about how to do mail deliveries in qmail-ldap. You could attach a qmailUser to a o, ou, c or whatever object in LDAP. There is no restriction that the result is a User -- actually the object becomes some sort of qmail-ldap (virtual) user. b) qmailGroup extends qmailUser so that the union of the two defines a qmail-ldap group. This are the basics of object oriented design. qmailGroup just defines and enforces the values that are neccesary. c) it is how qmail-ldap works. As you already noticed qmail-ldap may use the objectclass=qmailUser to tighten the search. d) qmailGroup automaticaly inherits all changes done in qmailUser I'm always annoyed about schema definitions that where incorrectly done and most often end up as structural or overspecified. It seems like most people did not get the idea behind the objectclass model and correct schemas and so they fiddle around something till some version of OpenLDAP loads it. To be honest I have to include myself in that list because we still have some minor strangenesses in our qmail.schema but a lot was fixed lately. It took me years to understand the full concept of LDAP. -- :wq Claudio
