[Mailzu-users] LDAP Authentication mod
Brought to you by:
trilexcom
|
From: Ron G. <rg...@sh...> - 2005-10-25 00:52:40
|
Here is another suggestion for LDAP Authentication if people are having
problems making it work with non-standard directories:
At our site, our users login to POP or IMAP or Squirrelmail using any of
their full Email Addresses, which is specified as an Attribute of an
LDAP object of a custom type resembling courierMailAccount. Their
mailAttr is "mail", but this same LDAP directory holds customer
information, including business details, CRM details, and Contact info.
Contacts are not necessarily Mail Accounts, and vice versa.
Therefore, neither of the lookup types (statically composed DN, or
directory-wide search using a single attribute) would work. I also
wanted the Quarantine to allow only "Enabled'" users (or rather,
specifically deny "Disabled" users).
It appeared that MailZu was using the filter "mailAttr=%m", but there is
only one place where this filter is passed on to the LDAP module itself,
so with the addition of an extra (and optional) text string in the
config file, ooh, let's call it "ldap_objectType", you can compose a
complex filter to narrow down the type of object that would yield a
successful search and subsequent bind.
Here's the addition I would add to config.php-sample:
// Valid LDAP filter to AND with mailAttr if searching by mailAttr
// Filter will look like (&(ldap_mailAttr=%m)(ldap_objectType)),
// so don't include outer parentheses
// Examples:
// $conf['auth']['ldap_objectType'] = "objectclass=courierMailAccount";
// $conf['auth']['ldap_objectType'] =
"&(objectclass=amavisAccount)(amavisSpamQuarantineTo=*)";
// Defaults to not using a filter
$conf['auth']['ldap_objectType'] = '';
and here's the change to lib/LDAPEngine.class.php
*** lib/LDAPEngine.class.php 2005-08-30 14:03:36.000000000 -0700
--- ../mailzu/lib/LDAPEngine.class.php 2005-10-24 17:38:51.000000000 -0700
***************
*** 109,112 ****
--- 109,113 ----
$this->name = $conf['auth']['ldap_name'];
$this->mailAttr =
$conf['auth']['ldap_mailAttr'];
+ $this->objectType =
$conf['auth']['ldap_objectType'];
$this->searchUser =
$conf['auth']['ldap_searchUser'];
$this->searchPassword =
$conf['auth']['ldap_searchPassword'];
***************
*** 226,229 ****
--- 227,233 ----
// Search for user dn
$searchFilter = $this->login .
"=" . $userlogin;
+ if ( $this->objectType != '') {
+ $searchFilter =
"(&($searchFilter)(".$this->objectType."))";
+ }
$dn =
$this->searchUserDN($searchFilter);
}
I can then use this line in my config.php to specify the exact and
active user, amongst thousands spread out under hundreds of domains in
hundreds of subdirectories:
$conf['auth']['ldap_objectType'] =
"&(objectclass=balServiceMailAccount)(!(servicestatus=Disabled))";
P.S. there is a typo in config.php.sample
$conf['auth']['ldap_searchUsername'] = '';
should be
$conf['auth']['ldap_searchUser'] = '';
|