[Fwd: Re: [Dovecot] Dovecot and ActiveDirectory]

[Chris Wakelin]

Oops! Thought I'd CC'd this to the list. Sorry, Oliver!

Chris

-------- Original Message --------
Date: Wed, 13 Jul 2005 20:09:35 +0100
From: Chris Wakelin <c.d.wakelin at reading.ac.uk>
To: Jeroen Scheerder <Jeroen.Scheerder at phil.uu.nl>
CC: Chris Wakelin <c.d.wakelin at reading.ac.uk>
Subject: Re: [Dovecot] Dovecot and ActiveDirectory

Jeroen Scheerder wrote:
> Chris Wakelin (13/7/05 16:08 +0100) [Re: [Dovecot] Dovecot and
> ActiveDirectory]:
> 
> 
>>I've got it working via PAM and pam_ldap on Solaris. [..]
> 
> 
> That's exactly what I'm striving to do.
> 
> I've never set up LDAP authentication for Solaris itself, and actually
> never used PAM before.
> 
> If I may be so bold, could I bother you for details about your
> configuration in these respects?

/opt/RDGpldap/etc/ldap.conf:

host xxx.rdg.ac.uk
base dc=xxxxx,dc=ad,dc=rdg,dc=ac,dc=uk
binddn cn=xxxuser,cn=users,dc=xxxxx,dc=ad,dc=rdg,dc=ac,dc=uk
bindpw xxxpasswd
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad

xxxuser is a read-only account in the AD.

/etc/pam.conf:

...
dovecot         auth    required        /opt/RDGpldap/lib/pam_ldap.so
dovecot         account required        /opt/RDGpldap/lib/pam_ldap.so
dovecot         session required        /opt/RDGpldap/lib/pam_ldap.so

dovecot.conf:

auth_username_translation =
AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz

auth default {
   mechanisms = plain login
   passdb = pam
   userdb = passwd
   user = root
}

The auth_username_translation is because AD users are case-insensitive
but UNIX ones aren't! We have users in both AD and UNIX (but could use
something like "userdb=static uid=xxxx gid=yyyy home=/var/mail/%Lu"
assuming xxxx:yyyy has appropriate permissions on the spool files)

pam_ldap-178 was configured with

./configure --prefix=/opt/RDGpldap \
             --with-ldap-conf-file=/opt/RDGpldap/etc/ldap.conf

Hope this helps,
Chris

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 8439
Whiteknights, Reading, RG6 2AF, UK              Fax: +44 (0)118 975 3094