Topic: iRedMail LDAP LoadModule Questions
==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.0
- Deployed with iRedMail Easy or the downloadable installer? Installer
- Linux/BSD distribution name and version: Debian 11
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? Yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Hello all. I am attempting to find a way to use the LDAP server supplied with iRedMail installer with BookStack. There is a GitHub issue BSA#3550 (cannot add any links per post message, apologies for inconvenience) for discussion with BSA dev. I have already set it up to work with Authelia without issue, and with Nextcloud using forum post "Query LDAP Mailinglist Membership for NextCloudOwnCloud". BookStack requires the memberOf array attribute, which is not utilised by default with iRedMail's configured LDAP server, but is available in /usr/lib/ldap. To that end, I found the following forum topic "General LDAP Setup Question" regarding enabling the memberOf module for overlay.
Questions:
Is the above post still something required? I initially tried to use moduleLoad in slapd.conf, but this does not do anything on reset of SLAPD process. Using either:
ldapmodify -a -x -D "cn=Manager,dc=dpcs,dc=xyz" -W -H ldapi://
ldapmodify -Q -Y EXTERNAL -H ldapi:///
gives a permission error.
However, unlike the post above, there are actual files in slapd.d, so it seems like iRedMail LDAP is using dynamic now? Is the process static or dynamic? If dynamic, what is the required login to access cn=config? The Manager login is the root to my knowledge, so I'm not sure what "admin" password is needed if dynamic modify is required. If static, I do not know why changing slapd.conf has no impact on ldap modules.
slapd.conf has entries for moduleLoad back_mdb, back_monitor, and pw-sha2, but the output of
slapcat -n 0 | grep olcModuleLoad
shows only the following (missing back_monitor, pw-sha2):olcModuleLoad: {0}back_mdb
and
less /etc/ldap/slapd.d/'cn=config'/'cn=module{0}.ldif'
shows the following:# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 eaca156b
dn: cn=module{0}
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib/ldap
olcModuleLoad: {0}back_mdb
structuralObjectClass: olcModuleList
entryUUID: 7d7cd06a-77fd-103c-9981-e7f0d4b47def
creatorsName: cn=admin,cn=config
createTimestamp: 20220604025509Z
entryCSN: 20220604025509.340238Z#000000#000#000000
modifiersName: cn=admin,cn=config
modifyTimestamp: 20220604025509Z
Is this correct? Is the only module loaded back_mdb despite the other two being in the slapd.conf file? Why does adding moduleLoad memberof and refint also not do anything?
Are there any concerns with using memberOf overlay with iRedAdmin?
Relevant part of /etc/ldap/slapd.conf prior to any edits to add memberOf overlay module:
# List of arguments that were passed to the server
argsfile /var/run/slapd/slapd.args
modulepath /usr/lib/ldap
moduleload back_mdb
moduleload back_monitor
# Support password verification with SSHA512. Require OpenLDAP-2.4.32 or later.
moduleload pw-sha2
# The syncprov overlay
#moduleload syncprov.la
# SSL cert files. if no need to access OpenLDAP from another host, it's ok to
# disable TLS/SSL support.
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.
