Shared mailboxes setups and dictionaries

[Matej Tyc]

Hello,

I am relatively new to the world of MTAs and MDAs, and I try to set up 
shared mailboxes.

So far I have somehow succeeded - I have defined a shared namespace and 
I have managed to create per-mailbox ACL files thanks to the doveadm 
command.

However, I have been following these resources and there were bits that 
have puzzled me:

When learning about how ACL work in e.g. 
https://doc.dovecot.org/settings/plugin/acl/ - when one wishes to use 
the Global ACL file, how does one link it to a particular user's 
mailboxes? Examples that are listed in the documentation are far too 
generic. For example does "* user=foo lrw" imply that all mailboxes of 
all accounts are shared to the user foo? The doveadm command works only 
if dovecot is set up with per-mailbox ACL files, so I can't use it to 
reverse-engineer the correct syntax.

An interesting aspect to ACLs are dictionaries. I understood it as some 
kind of cache - if there is no dictionary or it is empty, then shared 
mailboxes don't work. Conversely, dictionary itself is not enough, one 
needs actual ACLs set up correctly. Is this a correct understanding?

Next what https://wiki.dovecot.org/SharedMailboxes/Shared and 
https://wiki.dovecot.org/Dictionary describe is a possibility to 
reference LDAP data to define an ACL dictionary. Do I understand it 
correctly that if a LDAP database is the single source of truth, then I 
don't have to worry about updating dictionaries as long as LDAP itself 
is up-to-date, but I have to keep ACLs and LDAP in sync manually (or 
using an application)?

Thanks,
Matej