1

Topic: SAMBA schema extension?

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):  current
- Linux/BSD distribution name and version: CentOS 7.5 with kernel 4
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? Want to do that.
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

I was searching your iRedAdmin-Pro demo instance at https://demo-ldap.iredmail.org if it provides options in order to extend the OpenLDAP schema - in my case, I need to add the SAMBA schema, because users accessing the SAMBA file servers have to be authenticated against the IRM OpenLDAP server.

Please tell me, if schema extension by iRedAdmin-Pro is easily possible and where to find it - or point me to a tutorial regarding this procedure.

Thank you very much!

Best regards,
Irma

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: SAMBA schema extension?

I wonder what kind of "extension" you want to achieve.

with the latest iRedAdmin-Pro release (OpenLDAP edition), you can manage additional LDAP attribute names - they are defined in iRedAdmin-Pro config file. Here's the parameter names and comments, hope it helps a little. If you have any question, feel free to ask.

# Additional LDAP attribute names of user object you want to manage.
# Format:
#
#   {'attribute_name': {'desc': 'A short description of this attribute',
#                       'allowed_domains': [...],
#                       'properties': [...]}}
#    'attribute_name2': {...}}
#
# Arguments
# ----------
#
# desc: string. [optional]
#       a short description of this attribute.
#       If not present, defaults to show attribute name.
#
# allowed_domains: list. [optional]
#       a list of domain names which are allowed to use this attribute.
#       if not present, defaults to allow all domains to use the attribute.
#
# properties: list. [optional]
#       a list of pre-defined property names (string).
#       If not present, defaults to ['string'].
#
# Properties
# ----------
#
# - 'require_global_admin': attribute is only managed by global domain admin.
# - 'multivalue': indicates attribute may contain multiple values.
#           If not present, defaults to single value.
#
# - 'string': indicates attribute value is short text. will be displayed as
#           HTML tag "<input type='text'>".
# - 'text': indicates attribute value is long text. will be displayed as HTML
#           "<textarea>".
#
# Warning: 'string', 'text', 'integer' cannot be used at the same time for same
#          attribute.
#
# Sample settings:
#
#   {'carLicense': {}}      # The minimalist setting, just attribute name.
#
#   {'carLicense': {'desc': 'Car License',
#                   'properties': ['string'],
#                   'allowed_domains': ['example.com', 'test.com']}}
ADDITIONAL_MANAGED_USER_ATTRIBUTES = {}

# Additional LDAP objectClass for NEWLY created mail user.
# Sample value: ['inetOrgPerson', 'pwdPolicy', 'ownCloud']
ADDITIONAL_USER_OBJECTCLASSES = []

# Additional LDAP attribute names and values for NEWLY created mail user.
#
# Format:
#       [(attribute_name, [...]),
#        (attribute_name, [...])]
#
# Several placeholders are available:
#   - %(mail)s: mail address of new user
#   - %(domain)s: domain part of new user mail address
#   - %(username)s: username part of new user mail address
#   - %(cn)s: display name of new user
#   - %(plain_password)s: new user's plain password
#   - %(passwd)s: new user's encrypted password
#   - %(quota)d: mailbox quota
#   - %(sgroups)s: a list of assigned mailing lists
#   - %(storageBaseDirectory)s: path of base storage
#   - %(language)s: default language for web UI
#   - %(recipient_bcc)s: recipient bcc email address
#   - %(sender_bcc)s: sender bcc email address
#   - %(next_uid)d: a server-wide free and unique integer for attr `uidNumber`
#   - %(next_gid)d: a server-wide free and unique integer for attr `gidNumber`
#   - %(shadowLastChange)d: number of days since 1970-01-01, defaults to today.
#   - %(shadowLastChange)d+Xd: number of days since 1970-01-01, plus X days (+Xd).
#
# Sample:
#
#   ADDITIONAL_USER_ATTRIBUTES = [('uidNumber', ['%(next_uid)d']),
#                                 ('gidNumber', ['%(next_gid)d'])]
ADDITIONAL_USER_ATTRIBUTES = []

3

Re: SAMBA schema extension?

Hi Huangbin,

the aim is to include the Samba schema into the built-in OpenLDAP server of iRedMail.

I need the objectClasses sambaSamAccount etc. in order to enable user authentication for Samba shares.

Look here: https://wiki.debian.org/LDAP/OpenLDAPSetup --> scroll down to section 'For SAMBA LDAP support'

I tried it that way, but I get the error message 'ldap_add: Insufficient access (50)' using the Manager's credentials on performing the ldapadd command.

It seems that the Manager account doesn't have sufficient privilege to manipulate the Config database.

I didn't succeed in identifying the correct credentials, i.e. what are the default olcRootDN and olcRootPW values in iRedMails OpenLDAP server?

4

Re: SAMBA schema extension?

irma wrote:

It seems that the Manager account doesn't have sufficient privilege to manipulate the Config database.

iRedMail uses slapd.conf by default, not the "slapd.d". You need to update /etc/openldap/slapd.conf instead.

irma wrote:

I didn't succeed in identifying the correct credentials, i.e. what are the default olcRootDN and olcRootPW values in iRedMails OpenLDAP server?

It's wrote in file "iRedMail.tips" under the iRedMail installation directory, for example, /root/iRedMail-0.9.8/iRedMail.tips.

5

Re: SAMBA schema extension?

"iRedMail uses slapd.conf by default, not the "slapd.d". You need to update /etc/openldap/slapd.conf instead."

But isn't that extremly old style and LDAP admins are strongly advised to use slapd.d?

6

Re: SAMBA schema extension?

I used slapd.conf file and followed this guide: https://spredzy.wordpress.com/2013/08/3 … -openldap/

Finally Samba schema is available in iRedMail OpenLDAP Server.

7

Re: SAMBA schema extension?

irma wrote:

But isn't that extremly old style and LDAP admins are strongly advised to use slapd.d?

OpenLDAP supports slapd.conf, but it will be slowly retired.
slapd.conf is easier to manage, the weakness is if you made some changes to this file, you have to restart openldap service to reload it.

irma wrote:

Finally Samba schema is available in iRedMail OpenLDAP Server.

Did you get iRedAdmin-Pro working with it?

8

Re: SAMBA schema extension?

ZhangHuangbin wrote:
irma wrote:

But isn't that extremly old style and LDAP admins are strongly advised to use slapd.d?

OpenLDAP supports slapd.conf, but it will be slowly retired.
slapd.conf is easier to manage, the weakness is if you made some changes to this file, you have to restart openldap service to reload it.

irma wrote:

Finally Samba schema is available in iRedMail OpenLDAP Server.

Did you get iRedAdmin-Pro working with it?

We don't use iRedAdmin-Pro, yet. Currently we're managing LDAP by LDAPAdmin.

9

Re: SAMBA schema extension?

Would like to [CLOSE] this issue. Cannot find how to perform that.