Re: domain mode mailbox aliasing

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 02/18/13 15:35 +0100, Gabriele Bulfon wrote:
>Hi,
>I recently reimplemented cyrus+postfix+ldap in multi domain mode, and everything works fine.
>I found my self needing to convert a situation where a dom1.com is same as dom2.com,
>and every user in 1st domain are actually the same users of 2nd domain.
>On postfix, I can manage this with virtual aliases.
>On ldap, I could manage common authentication through relay / rwm, so that user@xxxxxxxx
>can still authenticate as user@xxxxxxxx, with same password (and this works for any service
>trying to authenticate on ldap).
>Being cyrus authentication routed through saslauthd+ldap, I can authenticate on imap both
>as user@xxxxxxxx and user@xxxxxxxx, but then cyrus look for a different mailbox as it doesn't
>actually know the two domains are the same one.
>Is there any way to instruct cyrus to treat dom2.com as dom1.com?
>Thanx for any help.
>Gabriele.

You can use the ldapdb canonicalization plugin to transform the
authentication identity (user@xxxxxxxx) into user@xxxxxxxx.

To configure (in /etc/imapd.conf):

sasl_ldapdb_uri: ldap://ldap.example.com
sasl_ldapdb_mech: DIGEST-MD5
sasl_ldapdb_id: searcher
sasl_ldapdb_pw: searcher_secret
sasl_ldapdb_canon_attr: maildrop
sasl_canon_user_plugin: ladpdb

The logic is basically:

ldapwhoami -Y DIGEST-MD5 -U searcher -X u:user@xxxxxxxx
<provide password of searcher_secret>
uid=user@xxxxxxxx,ou=people,dc=example,dc=com

ldapsearch -Y DIGEST-MD5 -U searcher -b \
     "uid=user@xxxxxxxx,ou=people,dc=example,dc=com" maildrop
<provide password of searcher_secret>
maildrop: user@xxxxxxxx

You will need to configure your 'searcher' identity with an authzTo capable
of authorizing as any of your user@xxxxxxxx identities. And you will need
to configure appropriate authz-regexp rules in your slapd config to map
sasl identities (searcher, and user@xxxxxxxx) into DNs. Getting all the
ACLs correct can take a little trial and error.

-- 
Dan White
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
To Unsubscribe:
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus



[Index of Archives]     [Cyrus SASL]     [Squirrel Mail]     [Asterisk PBX]     [Video For Linux]     [Photo]     [Yosemite News]     [gtk]     [KDE]     [Gimp on Windows]     [Steve's Art]

  Powered by Linux