Integration/Active.Directory.iRedMail - Revision history

ZhangHuangbin: /* Enable LDAP query with AD in Postfix */

ZhangHuangbin — Fri, 19 Apr 2013 02:26:48 GMT

Enable LDAP query with AD in Postfix

← Older revision		Revision as of 02:26, 19 April 2013
Line 122:		Line 122:

	* Create/Edit file: '''/etc/postfix/ad_sender_login_maps.cf''':		* Create/Edit file: '''/etc/postfix/ad_sender_login_maps.cf''':
-	{{cfg\|ad_sender_login_maps.cf\|<pre>	+	{{cfg\|/etc/postfix/ad_sender_login_maps.cf\|<pre>
	server_host = ad.example.com		server_host = ad.example.com
	server_port = 389		server_port = 389
Line 137:		Line 137:
	</pre>}}		</pre>}}

-	* Create/Edit file: '''ad_virtual_mailbox_maps.cf'''	+	* Create/Edit file: '''/etc/postfix/ad_virtual_mailbox_maps.cf'''
-	{{cfg\|ad_virtual_mailbox_maps.cf\|<pre>	+	{{cfg\|/etc/postfix/ad_virtual_mailbox_maps.cf\|<pre>
	server_host = ad.example.com		server_host = ad.example.com
	server_port = 389		server_port = 389
Line 159:		Line 159:

	* Create/Edit file: '''/etc/postfix/ad_virtual_group_maps.cf'''		* Create/Edit file: '''/etc/postfix/ad_virtual_group_maps.cf'''
-	{{cfg\|ad_virtual_group_maps.cf\|<pre>	+	{{cfg\|/etc/postfix/ad_virtual_group_maps.cf\|<pre>
	server_host = ad.example.com		server_host = ad.example.com
	server_port = 389		server_port = 389

ZhangHuangbin: /* Verify LDAP query with AD in Postfix */

ZhangHuangbin — Fri, 01 Mar 2013 07:43:47 GMT

Verify LDAP query with AD in Postfix

← Older revision		Revision as of 07:43, 1 March 2013
Line 193:		Line 193:
	</pre>}}		</pre>}}

-	DEBUG: If ~~you got blank link instead of output like above example~~, it means LDAP query doesn't get expected result.	+	* '''DEBUG''': If nothing returned by the command, it means LDAP query doesn't get expected result. Please set '''"debuglevel = 1"''' in file '''"ad_sender_login_maps.cf"''', then query again, it now will print more debug message, If you're not familiar with this kind of output message, please post the debug message in our [http://www.iredmail.org/forum/ forum] to ask help.
-	~~Try to~~ set '''"debuglevel = 1"''' in file '''"ad_sender_login_maps.cf"''', then query again, it now will print more debug message, If you're not familiar with this kind of output message, please [http://www.iredmail.org/forum ~~create a new~~ forum ~~topic~~] ~~and paste them in your post~~.	+
-		+

	* Verify sender login check:		* Verify sender login check:

ZhangHuangbin: /* Enable LDAP query with AD in Postfix */

ZhangHuangbin — Fri, 01 Mar 2013 07:39:41 GMT

Enable LDAP query with AD in Postfix

← Older revision		Revision as of 07:39, 1 March 2013
Line 110:		Line 110:
	</pre>}}		</pre>}}

-	* Create/Edit file: '''/etc/postfix/transport''':	+	* Create/Edit file: '''/etc/postfix/transport'''.
	{{cfg\|/etc/postfix/transport\|<pre>		{{cfg\|/etc/postfix/transport\|<pre>
	example.com dovecot		example.com dovecot
	</pre>}}		</pre>}}
		+	Note: '''dovecot''' here is a Postfix transport defined in /etc/postfix/master.cf, used to deliver received emails to user mailboxes.

	Run 'postmap' so that postfix can read it:		Run 'postmap' so that postfix can read it:

ZhangHuangbin: /* Enable LDAP query with AD in Postfix */

ZhangHuangbin — Fri, 01 Mar 2013 07:37:38 GMT

Enable LDAP query with AD in Postfix

← Older revision		Revision as of 07:37, 1 March 2013
Line 63:		Line 63:
	== Enable LDAP query with AD in Postfix ==		== Enable LDAP query with AD in Postfix ==

-	~~Execute below~~ commands to modify Postfix settings to:	+	We will execute some commands to modify Postfix settings to:
-		+
-	* Disable unused iRedMail special settings	+
-	* Let it query AD instead of OpenLDAP	+

		+	* Disable unused iRedMail special settings.
		+	* Authenticate against AD server instead of local OpenLDAP server.

	'''Note''': we will create three AD query files later:		'''Note''': we will create three AD query files later:
Line 74:		Line 73:
	* /etc/postfix/ad_sender_login_maps.cf		* /etc/postfix/ad_sender_login_maps.cf

		+
		+	* Disable unused iRedMail special settings:
	{{cmd\|<pre>		{{cmd\|<pre>
-	~~####~~
-	~~# Disable unused iRedMail special settings.~~
-	~~####~~
	# postconf -e virtual_alias_maps=''		# postconf -e virtual_alias_maps=''
	# postconf -e sender_bcc_maps=''		# postconf -e sender_bcc_maps=''
Line 83:		Line 81:
	# postconf -e relay_domains=''		# postconf -e relay_domains=''
	# postconf -e relay_recipient_maps=''		# postconf -e relay_recipient_maps=''
		+	</pre>}}

-	~~#####~~	+	* Add your mail domain in "smtpd_sasl_local_domain" and "virtual_mailbox_domains":
-	# Add your mail domain in "smtpd_sasl_local_domain" and "virtual_mailbox_domains".	+	{{cmd\|<pre>
-	~~#####~~	+
	# postconf -e smtpd_sasl_local_domain='example.com'		# postconf -e smtpd_sasl_local_domain='example.com'
	# postconf -e virtual_mailbox_domains='example.com'		# postconf -e virtual_mailbox_domains='example.com'
		+	</pre>}}

-	~~#####~~	+	* Change transport maps setting:
-	# Change transport maps setting.	+	{{cmd\|<pre>
-	~~#####~~	+
	# postconf -e transport_maps='hash:/etc/postfix/transport'		# postconf -e transport_maps='hash:/etc/postfix/transport'
		+	</pre>}}

-	~~#####~~	+	* Enable AD query. Note: We will create these 3 files later.
-	# Enable AD query.	+	** Verify SMTP senders
-	#	+	{{cmd\|<pre>
-	# Note: We will create these 3 files later.	+
-	~~#####~~	+
-	~~# Used to verify sender.~~	+
-	~~#####~~	+
	# postconf -e smtpd_sender_login_maps='proxy:ldap:/etc/postfix/ad_sender_login_maps.cf'		# postconf -e smtpd_sender_login_maps='proxy:ldap:/etc/postfix/ad_sender_login_maps.cf'
		+	</pre>}}

-	~~####~~	+	** Used to verify local mail users
-	# Used to ~~query~~ mail users.	+	{{cmd\|<pre>
-	~~####~~	+
	# postconf -e virtual_mailbox_maps='proxy:ldap:/etc/postfix/ad_virtual_mailbox_maps.cf'		# postconf -e virtual_mailbox_maps='proxy:ldap:/etc/postfix/ad_virtual_mailbox_maps.cf'
		+	</pre>}}

-	~~####~~	+	** Used to verify local mail lists/groups.
-	# Used to ~~query~~ mail lists/groups.	+	{{cmd\|<pre>
-	~~####~~	+
	# postconf -e virtual_alias_maps='proxy:ldap:/etc/postfix/ad_virtual_group_maps.cf'		# postconf -e virtual_alias_maps='proxy:ldap:/etc/postfix/ad_virtual_group_maps.cf'
	</pre>}}		</pre>}}

ZhangHuangbin: /* Create user account in AD, used for LDAP query */

ZhangHuangbin — Fri, 01 Mar 2013 07:31:39 GMT

Create user account in AD, used for LDAP query

← Older revision		Revision as of 07:31, 1 March 2013
Line 52:		Line 52:
	* [http://www.iredmail.org/forum/post8630.html#p8630 Dovecot will treat characters as comment after a inline '#', so please just don't use '#' in password]		* [http://www.iredmail.org/forum/post8630.html#p8630 Dovecot will treat characters as comment after a inline '#', so please just don't use '#' in password]

-	=== Test AD query with ldap command line tool ===	+	=== Test AD query with ldap command line tool on iRedMail server===
		+	We should make sure this newly created user is able to connect to AD server, so please verify it with below command on iRedMail server:

	{{cmd\|<pre>		{{cmd\|<pre>
Line 58:		Line 59:
	Enter password: password_of_vmail		Enter password: password_of_vmail
	</pre>}}		</pre>}}
		+	If it prints all users stored in AD server, then it's working as expected.

	== Enable LDAP query with AD in Postfix ==		== Enable LDAP query with AD in Postfix ==

ZhangHuangbin: /* Integrate Microsoft Active Directory */

ZhangHuangbin — Fri, 01 Mar 2013 07:27:42 GMT

Integrate Microsoft Active Directory

← Older revision		Revision as of 07:27, 1 March 2013
Line 36:		Line 36:
	We assume:		We assume:
	* Hostname of your AD server is 'ad.example.com', listen on port 389.		* Hostname of your AD server is 'ad.example.com', listen on port 389.
-	** We will use this hostname below, you can replace it by IP address.	+	** We will use this hostname below, you can replace it by IP address of this AD server if you want.
	** If you want to force LDAP connection with LDAPS, use port 636 instead.		** If you want to force LDAP connection with LDAPS, use port 636 instead.
	* Base dn in AD is "dc=example,dc=com", email addresses of all users are ends with '@example.com' (Your mail domain is 'example.com').		* Base dn in AD is "dc=example,dc=com", email addresses of all users are ends with '@example.com' (Your mail domain is 'example.com').

ZhangHuangbin: /* Requirements */

ZhangHuangbin — Fri, 01 Mar 2013 07:26:22 GMT

Requirements

← Older revision		Revision as of 07:26, 1 March 2013
Line 23:		Line 23:
	To integrate Microsoft Active Directory with iRedMail, you should have:		To integrate Microsoft Active Directory with iRedMail, you should have:

-	* A working Microsoft Windows (2000/2003) server, with Active Directory installed and working, listen on port 389 (ldap://) or 636 (ldaps://).	+	* A working Linux/BSD server with iRedMail+OpenLDAP installed.
-	* A working Linux/BSD with iRedMail+OpenLDAP installed.	+	* A working Microsoft Windows (2000/2003) server, with Active Directory installed and working properly, listen on port 389 (ldap://) or 636 (ldaps://), and allow LDAP connections from iRedMail server.
-	* iRedMail server ~~can access Windows AD server via port 389 or 636~~.	+

	= Install iRedMail =		= Install iRedMail =

ZhangHuangbin: /* Summary */

ZhangHuangbin — Fri, 01 Mar 2013 07:23:28 GMT

Summary

← Older revision		Revision as of 07:23, 1 March 2013
Line 16:		Line 16:
	Since AD uses different LDAP schema, you will lose some iRedMail special features. e.g.		Since AD uses different LDAP schema, you will lose some iRedMail special features. e.g.

-	* Per-user, per-domain ~~bcc~~ control with LDAP. You should use hash file instead.	+	* Per-user, per-domain service control with LDAP (e.g. enable/disable POP3/IMAP/SMTP services). You should use hash file instead.
-	* TO BE CONTINUED.	+	* [TO BE CONTINUED]

	= Requirements =		= Requirements =

ZhangHuangbin: /* Appendix */

ZhangHuangbin — Tue, 27 Mar 2012 04:10:30 GMT

Appendix

← Older revision		Revision as of 04:10, 27 March 2012
Line 315:		Line 315:
	</pre>}}		</pre>}}

-	= ~~Appendix~~ =	+	= Additions =
		+
		+	* If your mail domain name is different than Windows Active Directory domain: http://www.iredmail.org/forum/topic3165-integration-with-windows-domain.html

	= ChangeLog =		= ChangeLog =
	* 2011-10-22: Use 'postconf -e' to set Postfix settings instead of edit main.cf directly.		* 2011-10-22: Use 'postconf -e' to set Postfix settings instead of edit main.cf directly.
	* 2011-07-15: Replace 'userAccountControl=514' with 'userAccountControl:1.2.840.113556.1.4.803:=2'. This will still work if the user has additional attributes like password expired or never changes. Thanks Rick Culler <rculler@caresouth>.		* 2011-07-15: Replace 'userAccountControl=514' with 'userAccountControl:1.2.840.113556.1.4.803:=2'. This will still work if the user has additional attributes like password expired or never changes. Thanks Rick Culler <rculler@caresouth>.

ZhangHuangbin: /* Enable LDAP query with AD in Postfix */

ZhangHuangbin — Fri, 23 Mar 2012 06:20:58 GMT

Enable LDAP query with AD in Postfix

← Older revision		Revision as of 06:20, 23 March 2012
Line 178:		Line 178:
	debuglevel = 0		debuglevel = 0
	</pre>}}		</pre>}}
-	'''Note''': If your user have email address in both "mail" and "userPrincipalName", you will get duplicate result. Comment 'leaf_result_attribute' can fix it.	+	'''Note''':
		+	* If your user have email address in both "mail" and "userPrincipalName", you will get duplicate result. Comment 'leaf_result_attribute' can fix it.
		+	* If your group account doesn't contains attribute 'mail' and 'userPrincipalName', please try 'query_filter = (&(objectClass=group)(sAMAccountName=%u))' instead.

	Also, we need to remove iRedAPD related settings in Postfix:		Also, we need to remove iRedAPD related settings in Postfix: