Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure external LDAP authentication from my LDAP box through Zimbra. Both servers are running on CentOS.

The Zimbra wiki has documentation but it's still leaving me puzzled.

http://wiki.zimbra.com/wiki/LDAP_Authentication#Configuring_external_LDAP_authentication

This is what my ldapsearch consist of:

ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(&(objectClass=JammMailAlias)(mail=marketing@domain.com))'

Any idea what the right filter would be? I'm pulling my hair trying to figure this out.

Here's the output of the ldapsearch above:

$ ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(&(objectClass=JammMailAlias)(mail=marketing@domain.com))'
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=JammMailAlias)(mail=marketing@domain.com))
# requesting: ALL
#

# marketing@domain.com, domain.com, hosting, domain.com
dn: mail=marketing@domain.com,jvd=domain.com,o=hosting,dc=domain,dc=com
objectClass: JammMailAlias
objectClass: top
mail: marketing@domain.com
cn: Marketing Team
accountActive: TRUE
maildrop: bob
maildrop: john
maildrop: amy

lastChange: 1277317208

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Here's an ldapsearch for a user:

$ ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(&(objectClass=JammMailAccount)(mail=hfranco@domain.com))'
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=com> with scope subtree
# filter: (&(objectClass=JammMailAccount)(mail=hfranco@domain.com))
# requesting: ALL
#

# hfranco@domain.com, domain.com, hosting, domain.com
dn: mail=hfranco@domain.com,jvd=domain.com,o=hosting,dc=domain,dc=com
objectClass: JammMailAccount
objectClass: top
mail: hfranco@domain.com
cn: Hank Franco
homeDirectory: /home/domains/domain.com/hfranco
delete: FALSE
lastChange: 1218909596
mailbox: domain.com/hfranco/
userPassword:: e01ENX1zWlQzcEk4M2FNOFV3U3gzK0NqaUtRPT0=
accountActive: TRUE

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
share|improve this question
1  
Can you post an example result for that ldapsearch command? –  James Jun 24 '10 at 21:59
    
I've posted the result of the ldapsearch above –  hfranco Jun 25 '10 at 14:39
    
I'm a bit confused now. You're trying to authenticate a mail alias? Zimbra external LDAP authentication is generally on a per-user basis. Do you want to setup an external GAL instead? –  James Jun 25 '10 at 16:25
    
@James can you elaborate on GAL a little? I would like to have my users authenticate with LDAP from Zimbra. Right now we're using Squirrelmail with LDAP authentication that I'll like to replace with Zimbra. –  hfranco Jun 25 '10 at 18:58
    
GAL = global address list, it's Zimbra's address book. Can you post the output of an LDAP search against a user rather than a mail alias - that way it should be easy to see which attributes you need to search on for the Zimbra search filter. –  James Jun 27 '10 at 8:57
show 2 more comments

1 Answer

up vote 3 down vote accepted

Something like (uid=%u) should work, or given your ldapsearch example, perhaps (&(objectClass=JammMailAlias)(mail=%u@domain.com))

Zimbra replaces the %u with the username that is attempting to authenticate, and then does a search/bind as that user to authenticate.

Edit:

In your setup, you should be able to use (mail=%u@domain.com) as your search filter.

You can test this by running something like ldapsearch -x -D cn=Manager,dc=domain,dc=com -y pass -H ldap://ldap.domain.com -b dc=domain,dc=com '(mail=hfranco@domain.com)' - it should return just the one entry above.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.