[Dovecot] LDAP: allow pop3, restrict imap
Hello,
I have all userdata in a ldapserver. Every user has the right to use pop3. There is no explicit attribute allowing that. It's simply possible.
Now I like to add imap. For a starting period I like to restrict, who
may use imap.
http://wiki2.dovecot.org/Authentication/RestrictAccess mention a solution
where I could modify ldap pass_filter. But that require an attribute
"service=pop3"
to be present in the ldap servers. In my case I have to add it for
every existing user :-/ No way...
Are there other options?
Thanks, Andreas
Am Montag, 26. Mai 2014, 13:24:35 schrieben Sie:
Hello,
I have all userdata in a ldapserver. Every user has the right to use pop3. There is no explicit attribute allowing that. It's simply possible.
Now I like to add imap. For a starting period I like to restrict, who may use imap.
http://wiki2.dovecot.org/Authentication/RestrictAccess mention a solution where I could modify ldap pass_filter. But that require an attribute "service=pop3" to be present in the ldap servers. In my case I have to add it for every existing user :-/ No way...
Why not add the attribute to all your users? Simple bash magic, search with ldapsearch, use the results to create a ldif file with the suitable ldapadd commands, add it. 5 minutes of work, regardless how many users you have in your directory.
Florian
Are there other options?
Thanks, Andreas
Florian Tischler System Administrator *Johann Radon Institute for Computational and Applied Mathematics (RICAM) http://www.ricam.oeaw.ac.at/ florian.tischler@oeaw.ac.at *Industrial Mathematics Institute http://www.indmath.uni-linz.ac.at/ tischler@indmath.uni-linz.ac.at http://www.ricam.oeaw.ac.at/people/page.cgi?firstn=Florian;lastn=Tischler GPG-Key: http://www.ricam.oeaw.ac.at/gpg/florian_tischler.asc tel: +43 732 2468 5250 fax: +43 732 2468 5212
Florian:
Why not add the attribute to all your users?
yeah, that would be really the simplest solution. Unfortunately the world is sometimes more complex. That's why I search for other ways...
- multiple dovecot installations
- different ldap filters based on imap or pop3
- other magic
Andreas
On 2014-05-26 16:39, Andreas Schulze wrote:
Florian: Why not add the attribute to all your users?
yeah, that would be really the simplest solution. Unfortunately the world is sometimes more complex. That's why I search for other ways...
- multiple dovecot installations
- different ldap filters based on imap or pop3
- other magic
Andreas
You could probably do something with Perdition imap proxy (imap, pop and managesieve proxy). It is very flexible:
http://horms.net/projects/perdition/
It can handle large numbers of users, very smooth and no performance issues.
participants (3)
-
Alan McGinlay
-
Andreas Schulze
-
Florian