1

Topic: iRedMail + ejabberd + mod_shared_rooster_ldap

Hi,

this is rather a question about iredmail, but about the LDAP server used by iredmail.

This is what I want to achieve:
I'm running iRedMail with several domains which are administrated using the iRedAdmin backend. There is an ejabberd Server which uses ldap authentication to auth users against the ldap server, which works pretty well (there is one ejabberd server for all available domains; users can add each other regardless to which domain they belong).
I want to use the mod 'mod_shared_roster_ldap' so that everybody has everybody else in his user list grouped by the domains and doesn't have to add and auth each other.

I tried a lot of configs for it, but I'm not able to get it running. My last version is this, which won't fire any errors in the ejabberd log but also won't work:

  {mod_roster,   []},
  %%{mod_service_log,[]},
  %%{mod_shared_roster,[]},
  {mod_shared_roster_ldap, [
        {ldap_base, "o=domains,dc=X,dc=Y,dc=Z,dc=eu"},
        {ldap_filter, "(objectClass=*)"},
        {ldap_ufilter,"(&(objectClass=mailUser)(accountStatus=active)(cn=*))"},
        {ldap_rfilter, "(objectClass=inetOrgPerson)"},
        {ldap_groupattr,"cn"},
        {ldap_groupdesc,"description"},
        {ldap_memberattr,"memberUid"},
        {ldap_memberattr_format,"%u"},
        {ldap_useruid, "uid"},
        {ldap_userdesc,"cn"}]},

Hopefull you can help me a bit smile Perhaps I'm missing something...

Thanks a lot!

==== Required information ====
- iRedMail version: v1.9.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Linux/BSD distribution name and version:  ubuntu 12.04.2 LTS
- Related log if you're reporting an issue:
====

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: iRedMail + ejabberd + mod_shared_rooster_ldap

This is how Mail List works in iRedMail OpenLDAP:

*) A placeholder for Mail List:

mail=list01@domain.ltd,ou=Groups,domainName=domain.com,o=domains,dc=xx,dc=xx

This LDAP object doesn't contain mail list members at all.

*) A normal mail user:

mail=username@domain.ltd,ou=Users,domainName=domain.com,o=domains,dc=xx,dc=xx

If this LDAP object has "memberOfGroup=list01@domain.ltd", then this user is considered as a member of mailing list "list01@domain.ltd".

Hope it helps.

3

Re: iRedMail + ejabberd + mod_shared_rooster_ldap

Thanks a lot for your reply.

I'm aware of the fact that iRedMail doesn't use any groups which hold member id's. If a user is member of a group is stored in the user object. Until now I thought I don't have to care if a member is part of any group or not, since I want to group them after their domain. I tried to user the following attribute for "grouping" them:

mail=username@domain.ltd,ou=Users,domainName=domain.com,o=domains,dc=xx,dc=xx

Should I try to group them after the memberOfGroup attribute of the user object?


Also I think I have some problems identifing the user. In my ldap config (for authentication) I use

{ldap_uids, [{"mail", "%u@%d"}]}

to get the uid of the user. I will get mail=username@domain.ltd as a user ID. Is this the same as the uid saved for each user Object? If not, how is the uid stored?

4

Re: iRedMail + ejabberd + mod_shared_rooster_ldap

shrinks wrote:

I want to group them after their domain.
...
Should I try to group them after the memberOfGroup attribute of the user object?

No idea.
Not sure whether below settings work for you or not (i didn't test it, just my GUESS):

{ldap_groupattr,"domainName"},
        {ldap_groupdesc,"description"},
        {ldap_memberattr,"mail"},
        {ldap_memberattr_format,"*@%d"},

shrinks wrote:

Also I think I have some problems identifing the user. In my ldap config (for authentication) I use

{ldap_uids, [{"mail", "%u@%d"}]}

to get the uid of the user. I will get mail=username@domain.ltd as a user ID. Is this the same as the uid saved for each user Object? If not, how is the uid stored?

Did you try below setting?

"{ldap_uids, [{"mail", "%u"}]}"?

if user login with full email address, '%u' should be replaced by full email address.